@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/container-contents/container-state/createWithMetadata.js

@@ -0,0 +1,332 @@
+import { isContainerSystemSlot, } from "../../../internal/validators/containerSystemSlot.js";
+import { locallyAcknowledgedContainerMutationHead } from "../../../data/containers/shared/mutationAcknowledgement.js";
+import { isStaleParentContainerPathFailure } from "../../../data/containers/shared/mutationFailures.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { advanceLocallyAcknowledgedAccessManifestHeadsAtomically, locallyAuthoredAccessManifestHead, } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, readContainerMutationMetadataDocumentId, } from "../../containers/index.js";
+import { buildMaterializedDocumentCreatePlan, documentWriterProjectionFromCreateResponse, persistedDocumentCreateStateFromResponse, resolveDocumentCreateAuthor, } from "../../documents/index.js";
+import { cachePrincipalPolicyBundles } from "../../principals/policyCache.js";
+import { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { settleTerminalCreateFailure } from "./createTerminalFailure.js";
+/**
+ * Sentinel for a lost-response retry whose manifest already exists remotely.
+ * Callers avoid a duplicate; the next parent hydration settles local state.
+ */
+export const CONTAINER_ALREADY_COMMITTED = Symbol("containerAlreadyCommitted");
+async function submitContainerWithMetadataDocument(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const { apiClient } = input.runtime;
+    const result = await apiClient.createContainerWithMetadataDocumentResult(input.request, {
+        expectedPaymentRequiredOrganizationId: input.organizationId,
+        reportErrors: false,
+    });
+    return result.ok ? { ok: true, response: result.data } : result;
+}
+async function cacheStalePrincipalPolicyBundles(input) {
+    const bundles = input.failure.stalePrincipalPolicies;
+    const apiClient = input.runtime.apiClient;
+    const getCurrentPrincipalPolicy = apiClient.getCurrentPrincipalPolicy.bind(apiClient);
+    if (input.stillCurrent?.() === false)
+        return false;
+    if (!bundles || bundles.length === 0) {
+        return false;
+    }
+    // A stale-policy failure is actionable only after the supplied bundles have
+    // been verified and cached; the next attempt will rebuild from that cache.
+    await cachePrincipalPolicyBundles({
+        bundles,
+        execSql: input.runtime.infra.execSql,
+        getCurrentPrincipalPolicy,
+        log: input.runtime.util.log,
+        organizationId: input.organizationId,
+        reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    return input.stillCurrent?.() !== false;
+}
+/**
+ * Seed the metadata document's writer projection from the create response so the
+ * first read after the container is created (its own metadata sync, contents
+ * hydration) resolves locally instead of a cold `GET writer-projection`. The
+ * authorizing path is the child container projection the create was authored
+ * against — locally built rather than server-fetched, so unlike the plain
+ * document-create path this is gated on the projection's internal consistency;
+ * on any mismatch the seed is skipped and the next read falls back to a fetch.
+ */
+async function seedMetadataDocumentWriterProjection(input) {
+    const projection = documentWriterProjectionFromCreateResponse({
+        containerProjection: input.childProjection,
+        response: input.response.metadataDocument,
+    });
+    try {
+        await assertDocumentWriterProjectionConsistent(projection, {
+            execSql: input.execSql,
+            stillCurrent: input.stillCurrent,
+            trustedLocalProjection: true,
+        });
+    }
+    catch {
+        return;
+    }
+    if (input.stillCurrent?.() === false)
+        return;
+    input.runtime.apiClient.primeDocumentWriterProjection(input.response.metadataDocument.id, projection);
+}
+async function acknowledgeContainerWithMetadata(input) {
+    const persistedState = persistedDocumentCreateStateFromResponse(input.metadataDocumentPlan, input.response.metadataDocument);
+    const containerHead = await locallyAcknowledgedContainerMutationHead({
+        plan: input.containerPlan,
+        response: input.response.container,
+    });
+    await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({
+        execSql: input.execSql,
+        heads: [
+            containerHead,
+            locallyAuthoredAccessManifestHead(input.metadataDocumentPlan),
+        ],
+        stillCurrent: input.stillCurrent,
+    });
+    return persistedState;
+}
+/**
+ * Prime the new container's writer projection from the create plan the client
+ * just authored, so the first write under it (a child folder, a document)
+ * resolves locally instead of a cold `GET writer-projection`. Only primed when
+ * the locally-built projection matches what the server created — the create
+ * response echoes the container id and manifest head — so a mismatch skips the
+ * seed and the next write falls back to a fetch (same fail-closed contract as
+ * the metadata-document seed). Priming is safe for writes: the server still
+ * validates every mutation, so a projection that later goes stale (rekey/share/
+ * move evict it) just yields a rejected write that retries with a fresh fetch.
+ */
+function seedChildContainerWriterProjection(input) {
+    const createdManifestHash = input.response.container.manifestHead.manifestHash;
+    const projectedManifestHash = input.childProjection.path.at(-1)?.manifestHash;
+    // Both hashes must be present and equal, or two undefined hashes would compare
+    // equal and prime an empty/invalid projection.
+    if (!createdManifestHash ||
+        !projectedManifestHash ||
+        input.childProjection.containerId !==
+            input.response.container.containerId ||
+        projectedManifestHash !== createdManifestHash) {
+        return;
+    }
+    input.runtime.apiClient.primeContainerWriterProjection(input.response.container.containerId, input.childProjection);
+}
+/**
+ * The persisted slot is the one this client signed into the manifest state.
+ * The acknowledgement already refused a response that echoed anything else,
+ * so the server's column never chooses which local record becomes Trash.
+ */
+function signedCreateSystemSlot(state) {
+    if (state.systemSlot === null)
+        return null;
+    if (!isContainerSystemSlot(state.systemSlot)) {
+        throw new Error("Container create plan signed an invalid system slot");
+    }
+    return state.systemSlot;
+}
+async function settleContainerWithMetadataCreate(input) {
+    if (input.response.container.containerId !==
+        input.containerPlan.plan.containerId) {
+        throw new Error("Container metadata create response container mismatch");
+    }
+    // The acknowledgement echoed the signed parent, which a child always names.
+    const parentId = input.containerPlan.plan.state.parentContainerId;
+    if (parentId === null) {
+        throw new Error("A container create must commit under a parent");
+    }
+    const metadataDocumentId = readContainerMutationMetadataDocumentId({
+        response: input.response.container,
+    });
+    if (metadataDocumentId !== input.containerPlan.plan.metadataDocumentId ||
+        input.response.metadataDocument.id !==
+            input.metadataDocumentPlan.plan.documentId) {
+        throw new Error("Container metadata create response document mismatch");
+    }
+    const persistedMetadataState = await acknowledgeContainerWithMetadata({
+        containerPlan: input.containerPlan.plan,
+        execSql: input.execSql,
+        metadataDocumentPlan: input.metadataDocumentPlan.plan,
+        response: input.response,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    await seedMetadataDocumentWriterProjection({
+        childProjection: input.childProjection,
+        execSql: input.execSql,
+        response: input.response,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    seedChildContainerWriterProjection({
+        childProjection: input.childProjection,
+        response: input.response,
+        runtime: input.runtime,
+    });
+    return {
+        ok: true,
+        state: {
+            accessManifestHash: input.response.container.manifestHead.manifestHash,
+            systemSlot: signedCreateSystemSlot(input.containerPlan.plan.state),
+            containerId: input.response.container.containerId,
+            createdAt: input.response.container.createdAt,
+            metadataDocumentId,
+            organizationId: input.response.container.organizationId,
+            parentId,
+            persistedMetadataState,
+            updatedAt: input.response.container.updatedAt,
+        },
+    };
+}
+async function createRemoteContainerWithMetadataDocumentAttempt(input) {
+    const execSql = input.runtime.infra.execSql;
+    // Rebuild parent- and policy-dependent hashes, signatures, and wraps on every
+    // attempt while retaining the logical mutation identities and key material.
+    const containerPlan = await buildMaterializedContainerCreatePlan({
+        author: input.author,
+        containerId: input.containerId,
+        containerKey: input.containerKey,
+        execSql,
+        eventId: input.containerEventId,
+        metadataDocumentId: input.containerId,
+        systemSlot: input.systemSlot,
+        parentProjection: input.parentProjection,
+        parentSecretKey: input.parentSecretKey,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        signedAt: input.containerSignedAt,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+    });
+    const childProjection = childContainerWriterProjectionFromCreatePlan({
+        materializedPlan: containerPlan,
+        parentProjection: input.parentProjection,
+    });
+    const metadataDocumentPlan = await buildMaterializedDocumentCreatePlan({
+        author: input.author,
+        containerProjection: childProjection,
+        contentKey: input.metadataContentKey,
+        documentId: containerPlan.plan.metadataDocumentId,
+        eventId: input.metadataEventId,
+        execSql,
+        knownContainerKeks: new Map([
+            [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],
+        ]),
+        signedAt: input.metadataSignedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.parentSecretKey,
+        trustedLocalProjection: true,
+    });
+    const submitted = await submitContainerWithMetadataDocument({
+        organizationId: containerPlan.plan.state.organizationId,
+        request: {
+            systemSlot: input.systemSlot ?? null,
+            container: containerPlan.plan.request,
+            metadataDocument: metadataDocumentPlan.plan.request,
+        },
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!submitted?.ok) {
+        return submitted;
+    }
+    return settleContainerWithMetadataCreate({
+        childProjection,
+        containerPlan,
+        execSql,
+        metadataDocumentPlan,
+        response: submitted.response,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+}
+async function createContainerWithMetadataWithRepairs(input) {
+    const { apiClient } = input.runtime;
+    let parentProjection = input.parentProjection;
+    let didRepairStaleParent = false;
+    const policyRepairs = new PrincipalPolicyRepairBudget();
+    for (;;) {
+        const submitted = await createRemoteContainerWithMetadataDocumentAttempt({
+            ...input,
+            parentProjection,
+        });
+        if (!submitted) {
+            return null;
+        }
+        if (submitted.ok) {
+            return submitted.state;
+        }
+        if (policyRepairs.take(submitted.stalePrincipalPolicies) &&
+            (await cacheStalePrincipalPolicyBundles({
+                failure: submitted,
+                organizationId: parentProjection.organizationId,
+                runtime: input.runtime,
+                stillCurrent: input.stillCurrent,
+            }))) {
+            continue;
+        }
+        if (!didRepairStaleParent &&
+            isStaleParentContainerPathFailure(submitted) &&
+            apiClient.evictContainerWriterProjection &&
+            input.stillCurrent?.() !== false) {
+            didRepairStaleParent = true;
+            apiClient.evictContainerWriterProjection(input.parentContainerId);
+            const refreshedProjection = await apiClient.getContainerWriterProjection(input.parentContainerId);
+            if (!refreshedProjection) {
+                return null;
+            }
+            if (input.stillCurrent?.() === false)
+                return null;
+            parentProjection = refreshedProjection;
+            continue;
+        }
+        return settleTerminalCreateFailure(submitted, input.stillCurrent) ===
+            "committed"
+            ? CONTAINER_ALREADY_COMMITTED
+            : null;
+    }
+}
+export async function createRemoteContainerWithMetadataDocument(input) {
+    const author = resolveDocumentCreateAuthor(input.runtime);
+    const { apiClient } = input.runtime;
+    const parentSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;
+    if (!author || !parentSecretKey) {
+        input.runtime.util.log("Container contents: skipped container create because the writer context is unavailable.");
+        return null;
+    }
+    const parentProjection = input.parentProjection ??
+        (await apiClient.getContainerWriterProjection(input.parentContainerId));
+    if (!parentProjection) {
+        return null;
+    }
+    const containerEventId = crypto.randomUUID();
+    const containerKey = crypto.getRandomValues(new Uint8Array(32));
+    const containerSignedAt = new Date().toISOString();
+    const metadataContentKey = crypto.getRandomValues(new Uint8Array(32));
+    const metadataEventId = crypto.randomUUID();
+    const metadataSignedAt = new Date().toISOString();
+    return createContainerWithMetadataWithRepairs({
+        author,
+        containerEventId,
+        containerId: input.containerId,
+        containerKey,
+        containerSignedAt,
+        metadataContentKey,
+        metadataEventId,
+        metadataSignedAt,
+        parentContainerId: input.parentContainerId,
+        parentProjection,
+        parentSecretKey,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        systemSlot: input.systemSlot,
+    });
+}
+//# sourceMappingURL=createWithMetadata.js.map

package/workflows/container-contents/container-state/createWithMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWithMetadata.js","sourceRoot":"","sources":["createWithMetadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AAMnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,yDAAyD,CAAC;AACnH,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AAErG,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,oEAAoE,CAAC;AAE5E,OAAO,EACL,oCAAoC,EACpC,4CAA4C,EAC5C,uCAAuC,GACxC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAMtE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAG/E,KAAK,UAAU,mCAAmC,CAAC,KAKlD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,yCAAyC,CACtE,KAAK,CAAC,OAAO,EACb;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAK/C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1C,MAAM,yBAAyB,GAC7B,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,2BAA2B,CAAC;QAChC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,yBAAyB;QACzB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oCAAoC,CAAC,KAMnD;IACC,MAAM,UAAU,GAAG,0CAA0C,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,eAAe;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,wCAAwC,CAAC,UAAU,EAAE;YACzD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,6BAA6B,CACnD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,EAClC,UAAU,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAU/C;IACC,MAAM,cAAc,GAAG,wCAAwC,CAC7D,KAAK,CAAC,oBAAoB,EAC1B,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,wCAAwC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE;YACL,aAAa;YACb,iCAAiC,CAAC,KAAK,CAAC,oBAAoB,CAAC;SAC9D;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kCAAkC,CAAC,KAI3C;IACC,MAAM,mBAAmB,GACvB,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,CAAC;IACrD,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,IACE,CAAC,mBAAmB;QACpB,CAAC,qBAAqB;QACtB,KAAK,CAAC,eAAe,CAAC,WAAW;YAC/B,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;QACtC,qBAAqB,KAAK,mBAAmB,EAC7C,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CACpD,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EACpC,KAAK,CAAC,eAAe,CACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,KAAmC;IAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAYhD;IAIC,IACE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;QACpC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAClE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;QACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IACE,kBAAkB,KAAK,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB;QAClE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YAChC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,gCAAgC,CAAC;QACpE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,oCAAoC,CAAC;QACzC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,kCAAkC,CAAC;QACjC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY;YACtE,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAClE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;YACjD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS;YAC7C,kBAAkB;YAClB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc;YACvD,QAAQ;YACR,sBAAsB;YACtB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gDAAgD,CAAC,KAe/D;IAQC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,aAAa,GAAG,MAAM,oCAAoC,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,iBAAiB;QACjC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,4CAA4C,CAAC;QACnE,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,eAAe;QACpC,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,OAAO,EAAE,KAAK,CAAC,eAAe;QAC9B,OAAO;QACP,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC;QAC1D,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACvD,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,gBAAgB,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO;SACpD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,iCAAiC,CAAC;QACvC,eAAe;QACf,aAAa;QACb,OAAO;QACP,oBAAoB;QACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,KAIC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,aAAa,GAAG,IAAI,2BAA2B,EAAE,CAAC;IACxD,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,MAAM,gDAAgD,CAAC;YACvE,GAAG,KAAK;YACR,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,KAAK,CAAC;QACzB,CAAC;QACD,IACE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;YACpD,CAAC,MAAM,gCAAgC,CAAC;gBACtC,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC,EACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,CAAC,oBAAoB;YACrB,iCAAiC,CAAC,SAAS,CAAC;YAC5C,SAAS,CAAC,8BAA8B;YACxC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAChC,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC;YAC5B,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAClE,MAAM,mBAAmB,GAAG,MAAM,SAAS,CAAC,4BAA4B,CACtE,KAAK,CAAC,iBAAiB,CACxB,CAAC;YACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAClD,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,2BAA2B,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC/D,WAAW;YACX,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAQ/D;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,yFAAyF,CAC1F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,sCAAsC,CAAC;QAC5C,MAAM;QACN,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,gBAAgB;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB;QAChB,eAAe;QACf,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport {\n  type ContainerSystemSlot,\n  isContainerSystemSlot,\n} from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerCreateWithMetadataDocumentRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerCreateWithMetadataDocumentResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { locallyAcknowledgedContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { isStaleParentContainerPathFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ContainerMutationSubmitFailure } from \"../../../data/containers/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  readContainerMutationMetadataDocumentId,\n} from \"../../containers\";\nimport {\n  buildMaterializedDocumentCreatePlan,\n  documentWriterProjectionFromCreateResponse,\n  persistedDocumentCreateStateFromResponse,\n  resolveDocumentCreateAuthor,\n} from \"../../documents\";\nimport { cachePrincipalPolicyBundles } from \"../../principals/policyCache\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport { settleTerminalCreateFailure } from \"./createTerminalFailure\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n} from \"./types\";\n\n/**\n * Sentinel for a lost-response retry whose manifest already exists remotely.\n * Callers avoid a duplicate; the next parent hydration settles local state.\n */\nexport const CONTAINER_ALREADY_COMMITTED = Symbol(\"containerAlreadyCommitted\");\nexport type ContainerAlreadyCommitted = typeof CONTAINER_ALREADY_COMMITTED;\n\nasync function submitContainerWithMetadataDocument(input: {\n  readonly organizationId: string;\n  readonly request: ContainerCreateWithMetadataDocumentRequest;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | {\n      readonly ok: true;\n      readonly response: ContainerCreateWithMetadataDocumentResponse;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const { apiClient } = input.runtime;\n  const result = await apiClient.createContainerWithMetadataDocumentResult(\n    input.request,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n    },\n  );\n  return result.ok ? { ok: true, response: result.data } : result;\n}\n\nasync function cacheStalePrincipalPolicyBundles(input: {\n  readonly failure: ContainerMutationSubmitFailure;\n  readonly organizationId: string;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  const bundles = input.failure.stalePrincipalPolicies;\n  const apiClient = input.runtime.apiClient;\n  const getCurrentPrincipalPolicy =\n    apiClient.getCurrentPrincipalPolicy.bind(apiClient);\n  if (input.stillCurrent?.() === false) return false;\n  if (!bundles || bundles.length === 0) {\n    return false;\n  }\n\n  // A stale-policy failure is actionable only after the supplied bundles have\n  // been verified and cached; the next attempt will rebuild from that cache.\n  await cachePrincipalPolicyBundles({\n    bundles,\n    execSql: input.runtime.infra.execSql,\n    getCurrentPrincipalPolicy,\n    log: input.runtime.util.log,\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  return input.stillCurrent?.() !== false;\n}\n\n/**\n * Seed the metadata document's writer projection from the create response so the\n * first read after the container is created (its own metadata sync, contents\n * hydration) resolves locally instead of a cold `GET writer-projection`. The\n * authorizing path is the child container projection the create was authored\n * against — locally built rather than server-fetched, so unlike the plain\n * document-create path this is gated on the projection's internal consistency;\n * on any mismatch the seed is skipped and the next read falls back to a fetch.\n */\nasync function seedMetadataDocumentWriterProjection(input: {\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly execSql?: ExecSql | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  const projection = documentWriterProjectionFromCreateResponse({\n    containerProjection: input.childProjection,\n    response: input.response.metadataDocument,\n  });\n  try {\n    await assertDocumentWriterProjectionConsistent(projection, {\n      execSql: input.execSql,\n      stillCurrent: input.stillCurrent,\n      trustedLocalProjection: true,\n    });\n  } catch {\n    return;\n  }\n  if (input.stillCurrent?.() === false) return;\n  input.runtime.apiClient.primeDocumentWriterProjection(\n    input.response.metadataDocument.id,\n    projection,\n  );\n}\n\nasync function acknowledgeContainerWithMetadata(input: {\n  containerPlan: Parameters<\n    typeof locallyAcknowledgedContainerMutationHead\n  >[0][\"plan\"];\n  execSql: ExecSql;\n  metadataDocumentPlan: Parameters<\n    typeof persistedDocumentCreateStateFromResponse\n  >[0];\n  response: ContainerCreateWithMetadataDocumentResponse;\n  stillCurrent?: (() => boolean) | undefined;\n}) {\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    input.metadataDocumentPlan,\n    input.response.metadataDocument,\n  );\n  const containerHead = await locallyAcknowledgedContainerMutationHead({\n    plan: input.containerPlan,\n    response: input.response.container,\n  });\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [\n      containerHead,\n      locallyAuthoredAccessManifestHead(input.metadataDocumentPlan),\n    ],\n    stillCurrent: input.stillCurrent,\n  });\n  return persistedState;\n}\n\n/**\n * Prime the new container's writer projection from the create plan the client\n * just authored, so the first write under it (a child folder, a document)\n * resolves locally instead of a cold `GET writer-projection`. Only primed when\n * the locally-built projection matches what the server created — the create\n * response echoes the container id and manifest head — so a mismatch skips the\n * seed and the next write falls back to a fetch (same fail-closed contract as\n * the metadata-document seed). Priming is safe for writes: the server still\n * validates every mutation, so a projection that later goes stale (rekey/share/\n * move evict it) just yields a rejected write that retries with a fresh fetch.\n */\nfunction seedChildContainerWriterProjection(input: {\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly runtime: ContainerWorkflowRuntime;\n}): void {\n  const createdManifestHash =\n    input.response.container.manifestHead.manifestHash;\n  const projectedManifestHash = input.childProjection.path.at(-1)?.manifestHash;\n  // Both hashes must be present and equal, or two undefined hashes would compare\n  // equal and prime an empty/invalid projection.\n  if (\n    !createdManifestHash ||\n    !projectedManifestHash ||\n    input.childProjection.containerId !==\n      input.response.container.containerId ||\n    projectedManifestHash !== createdManifestHash\n  ) {\n    return;\n  }\n\n  input.runtime.apiClient.primeContainerWriterProjection(\n    input.response.container.containerId,\n    input.childProjection,\n  );\n}\n\n/**\n * The persisted slot is the one this client signed into the manifest state.\n * The acknowledgement already refused a response that echoed anything else,\n * so the server's column never chooses which local record becomes Trash.\n */\nfunction signedCreateSystemSlot(\n  state: ContainerAccessManifestState,\n): ContainerSystemSlot | null {\n  if (state.systemSlot === null) return null;\n  if (!isContainerSystemSlot(state.systemSlot)) {\n    throw new Error(\"Container create plan signed an invalid system slot\");\n  }\n  return state.systemSlot;\n}\n\nasync function settleContainerWithMetadataCreate(input: {\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly containerPlan: Awaited<\n    ReturnType<typeof buildMaterializedContainerCreatePlan>\n  >;\n  readonly execSql: ExecSql;\n  readonly metadataDocumentPlan: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<{\n  readonly ok: true;\n  readonly state: CreatedRemoteContainerState;\n} | null> {\n  if (\n    input.response.container.containerId !==\n    input.containerPlan.plan.containerId\n  ) {\n    throw new Error(\"Container metadata create response container mismatch\");\n  }\n  // The acknowledgement echoed the signed parent, which a child always names.\n  const parentId = input.containerPlan.plan.state.parentContainerId;\n  if (parentId === null) {\n    throw new Error(\"A container create must commit under a parent\");\n  }\n  const metadataDocumentId = readContainerMutationMetadataDocumentId({\n    response: input.response.container,\n  });\n  if (\n    metadataDocumentId !== input.containerPlan.plan.metadataDocumentId ||\n    input.response.metadataDocument.id !==\n      input.metadataDocumentPlan.plan.documentId\n  ) {\n    throw new Error(\"Container metadata create response document mismatch\");\n  }\n  const persistedMetadataState = await acknowledgeContainerWithMetadata({\n    containerPlan: input.containerPlan.plan,\n    execSql: input.execSql,\n    metadataDocumentPlan: input.metadataDocumentPlan.plan,\n    response: input.response,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  await seedMetadataDocumentWriterProjection({\n    childProjection: input.childProjection,\n    execSql: input.execSql,\n    response: input.response,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  seedChildContainerWriterProjection({\n    childProjection: input.childProjection,\n    response: input.response,\n    runtime: input.runtime,\n  });\n  return {\n    ok: true,\n    state: {\n      accessManifestHash: input.response.container.manifestHead.manifestHash,\n      systemSlot: signedCreateSystemSlot(input.containerPlan.plan.state),\n      containerId: input.response.container.containerId,\n      createdAt: input.response.container.createdAt,\n      metadataDocumentId,\n      organizationId: input.response.container.organizationId,\n      parentId,\n      persistedMetadataState,\n      updatedAt: input.response.container.updatedAt,\n    },\n  };\n}\n\nasync function createRemoteContainerWithMetadataDocumentAttempt(input: {\n  readonly author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  readonly containerEventId: string;\n  readonly containerId: string;\n  readonly containerKey: Uint8Array;\n  readonly containerSignedAt: string;\n  readonly metadataContentKey: Uint8Array;\n  readonly metadataEventId: string;\n  readonly metadataSignedAt: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly parentSecretKey: Uint8Array;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly systemSlot?: ContainerSystemSlot | null | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | {\n      readonly ok: true;\n      readonly state: CreatedRemoteContainerState;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  const execSql = input.runtime.infra.execSql;\n  // Rebuild parent- and policy-dependent hashes, signatures, and wraps on every\n  // attempt while retaining the logical mutation identities and key material.\n  const containerPlan = await buildMaterializedContainerCreatePlan({\n    author: input.author,\n    containerId: input.containerId,\n    containerKey: input.containerKey,\n    execSql,\n    eventId: input.containerEventId,\n    metadataDocumentId: input.containerId,\n    systemSlot: input.systemSlot,\n    parentProjection: input.parentProjection,\n    parentSecretKey: input.parentSecretKey,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.containerSignedAt,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  const childProjection = childContainerWriterProjectionFromCreatePlan({\n    materializedPlan: containerPlan,\n    parentProjection: input.parentProjection,\n  });\n  const metadataDocumentPlan = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: childProjection,\n    contentKey: input.metadataContentKey,\n    documentId: containerPlan.plan.metadataDocumentId,\n    eventId: input.metadataEventId,\n    execSql,\n    knownContainerKeks: new Map([\n      [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n    ]),\n    signedAt: input.metadataSignedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.parentSecretKey,\n    trustedLocalProjection: true,\n  });\n  const submitted = await submitContainerWithMetadataDocument({\n    organizationId: containerPlan.plan.state.organizationId,\n    request: {\n      systemSlot: input.systemSlot ?? null,\n      container: containerPlan.plan.request,\n      metadataDocument: metadataDocumentPlan.plan.request,\n    },\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!submitted?.ok) {\n    return submitted;\n  }\n  return settleContainerWithMetadataCreate({\n    childProjection,\n    containerPlan,\n    execSql,\n    metadataDocumentPlan,\n    response: submitted.response,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nasync function createContainerWithMetadataWithRepairs(\n  input: Parameters<\n    typeof createRemoteContainerWithMetadataDocumentAttempt\n  >[0] & {\n    readonly parentContainerId: string;\n  },\n): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  const { apiClient } = input.runtime;\n  let parentProjection = input.parentProjection;\n  let didRepairStaleParent = false;\n  const policyRepairs = new PrincipalPolicyRepairBudget();\n  for (;;) {\n    const submitted = await createRemoteContainerWithMetadataDocumentAttempt({\n      ...input,\n      parentProjection,\n    });\n    if (!submitted) {\n      return null;\n    }\n    if (submitted.ok) {\n      return submitted.state;\n    }\n    if (\n      policyRepairs.take(submitted.stalePrincipalPolicies) &&\n      (await cacheStalePrincipalPolicyBundles({\n        failure: submitted,\n        organizationId: parentProjection.organizationId,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      }))\n    ) {\n      continue;\n    }\n    if (\n      !didRepairStaleParent &&\n      isStaleParentContainerPathFailure(submitted) &&\n      apiClient.evictContainerWriterProjection &&\n      input.stillCurrent?.() !== false\n    ) {\n      didRepairStaleParent = true;\n      apiClient.evictContainerWriterProjection(input.parentContainerId);\n      const refreshedProjection = await apiClient.getContainerWriterProjection(\n        input.parentContainerId,\n      );\n      if (!refreshedProjection) {\n        return null;\n      }\n      if (input.stillCurrent?.() === false) return null;\n      parentProjection = refreshedProjection;\n      continue;\n    }\n    return settleTerminalCreateFailure(submitted, input.stillCurrent) ===\n      \"committed\"\n      ? CONTAINER_ALREADY_COMMITTED\n      : null;\n  }\n}\n\nexport async function createRemoteContainerWithMetadataDocument(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const { apiClient } = input.runtime;\n  const parentSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !parentSecretKey) {\n    input.runtime.util.log(\n      \"Container contents: skipped container create because the writer context is unavailable.\",\n    );\n    return null;\n  }\n\n  const parentProjection =\n    input.parentProjection ??\n    (await apiClient.getContainerWriterProjection(input.parentContainerId));\n  if (!parentProjection) {\n    return null;\n  }\n\n  const containerEventId = crypto.randomUUID();\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerSignedAt = new Date().toISOString();\n  const metadataContentKey = crypto.getRandomValues(new Uint8Array(32));\n  const metadataEventId = crypto.randomUUID();\n  const metadataSignedAt = new Date().toISOString();\n  return createContainerWithMetadataWithRepairs({\n    author,\n    containerEventId,\n    containerId: input.containerId,\n    containerKey,\n    containerSignedAt,\n    metadataContentKey,\n    metadataEventId,\n    metadataSignedAt,\n    parentContainerId: input.parentContainerId,\n    parentProjection,\n    parentSecretKey,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    systemSlot: input.systemSlot,\n  });\n}\n"]}

package/workflows/container-contents/container-state/delete.js

@@ -0,0 +1,34 @@
+import { deleteRemoteContainer } from "./remote.js";
+export async function deleteContainerState(input) {
+    const isRemoteContainer = Boolean(input.containerState.record.documentId);
+    let deletedAt;
+    if (isRemoteContainer) {
+        const deletedRemoteContainer = await deleteRemoteContainer({
+            containerId: input.containerState.container.id,
+            organizationId: input.containerState.container.organizationId,
+            runtime: input.runtime,
+        });
+        if (!deletedRemoteContainer) {
+            return "remote-failed";
+        }
+        deletedAt = deletedRemoteContainer.deletedAt;
+    }
+    const execSql = input.runtime.infra.execSql;
+    const containerId = input.containerState.container.id;
+    const deletedContainerIds = await input.persistence.deleteContainers(execSql, [
+        {
+            containerId,
+            reason: "deleted",
+            updatedAt: deletedAt ?? new Date().toISOString(),
+        },
+    ], {
+        expectedContainers: [
+            { containerId, expectedContainer: input.containerState.container },
+        ],
+        stillCurrent: input.stillCurrent,
+    });
+    if (deletedContainerIds.includes(containerId))
+        return "deleted";
+    return isRemoteContainer ? "remote-deleted" : "local-conflict";
+}
+//# sourceMappingURL=delete.js.map

package/workflows/container-contents/container-state/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["delete.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AASjD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IACC,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,SAA6B,CAAC;IAElC,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,sBAAsB,GAAG,MAAM,qBAAqB,CAAC;YACzD,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC9C,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,GAAG,sBAAsB,CAAC,SAAS,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IACtD,MAAM,mBAAmB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAClE,OAAO,EACP;QACE;YACE,WAAW;YACX,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD;KACF,EACD;QACE,kBAAkB,EAAE;YAClB,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE;SACnE;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CACF,CAAC;IACF,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACjE,CAAC","sourcesContent":["import type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { deleteRemoteContainer } from \"./remote\";\nimport type { ContainerWorkflowRuntime } from \"./types\";\n\ntype DeleteContainerStateResult =\n  | \"deleted\"\n  | \"local-conflict\"\n  | \"remote-deleted\"\n  | \"remote-failed\";\n\nexport async function deleteContainerState(input: {\n  containerState: ContainerState;\n  persistence: ContainerContentsPersistence;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<DeleteContainerStateResult> {\n  const isRemoteContainer = Boolean(input.containerState.record.documentId);\n  let deletedAt: string | undefined;\n\n  if (isRemoteContainer) {\n    const deletedRemoteContainer = await deleteRemoteContainer({\n      containerId: input.containerState.container.id,\n      organizationId: input.containerState.container.organizationId,\n      runtime: input.runtime,\n    });\n    if (!deletedRemoteContainer) {\n      return \"remote-failed\";\n    }\n    deletedAt = deletedRemoteContainer.deletedAt;\n  }\n  const execSql = input.runtime.infra.execSql;\n  const containerId = input.containerState.container.id;\n  const deletedContainerIds = await input.persistence.deleteContainers(\n    execSql,\n    [\n      {\n        containerId,\n        reason: \"deleted\",\n        updatedAt: deletedAt ?? new Date().toISOString(),\n      },\n    ],\n    {\n      expectedContainers: [\n        { containerId, expectedContainer: input.containerState.container },\n      ],\n      stillCurrent: input.stillCurrent,\n    },\n  );\n  if (deletedContainerIds.includes(containerId)) return \"deleted\";\n  return isRemoteContainer ? \"remote-deleted\" : \"local-conflict\";\n}\n"]}

package/workflows/container-contents/container-state/groupGrantVerification.js

@@ -0,0 +1,93 @@
+import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { principalPolicyBundleContainsReference } from "../../../data/principalPolicyStates.js";
+import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, referencedPrincipalHeadFromPolicy, } from "../../containers/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { loadContainerWriterProjectionForState } from "./projectionCache.js";
+function projectionHasCurrentGroupGrant(input) {
+    const state = readContainerState(getTargetContainerContext(input.projection).manifest);
+    return (state.containerId === input.expectedContainerId &&
+        state.organizationId === input.expectedOrganizationId &&
+        state.directGrants.some((grant) => grant.subjectType === "group" &&
+            grant.subjectId === input.groupId &&
+            grant.accessLevel === input.accessLevel) &&
+        state.referencedPrincipalHeads.some((head) => head.principalType === input.currentHead.principalType &&
+            head.principalId === input.currentHead.principalId &&
+            head.version === input.currentHead.version &&
+            head.keyEpoch === input.currentHead.keyEpoch &&
+            head.stateHash === input.currentHead.stateHash &&
+            head.keyFingerprint === input.currentHead.keyFingerprint));
+}
+async function containerStateHasCurrentGroupGrantInternal(input) {
+    if (input.stillCurrent?.() === false)
+        return false;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection ||
+        input.stillCurrent?.() === false ||
+        input.expectedGroupHead.principalType !== "group" ||
+        input.expectedGroupHead.principalId !== input.groupId ||
+        input.containerState.container.id !== input.expectedContainerId ||
+        input.containerState.container.organizationId !==
+            input.expectedOrganizationId ||
+        projection.containerId !== input.expectedContainerId ||
+        projection.organizationId !== input.expectedOrganizationId) {
+        return false;
+    }
+    const { bundle, checkpointPolicies, dependencyBundles, policy } = await loadVerifiedGroupSharePrincipalPolicy({
+        apiClient: input.runtime.apiClient,
+        execSql: input.runtime.infra.execSql,
+        expectedGroupHead: input.expectedGroupHead,
+        groupId: input.groupId,
+        organizationId: input.expectedOrganizationId,
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return false;
+    if (!principalPolicyBundleContainsReference(bundle, input.expectedGroupHead)) {
+        return false;
+    }
+    const currentHead = referencedPrincipalHeadFromPolicy(policy);
+    await advanceVerifiedSharePolicies(input.runtime.infra.execSql, {
+        checkpointPolicies,
+        dependencyBundles,
+        organizationId: input.expectedOrganizationId,
+    }, input.stillCurrent);
+    if (input.stillCurrent?.() === false)
+        return false;
+    await verifyContainerWriterProjection({
+        execSql: input.runtime.infra.execSql,
+        principalPolicyCache: principalPolicyCacheForVerifiedPolicies(checkpointPolicies),
+        projection,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+    });
+    const isCurrent = projectionHasCurrentGroupGrant({
+        accessLevel: input.accessLevel,
+        currentHead,
+        expectedContainerId: input.expectedContainerId,
+        expectedOrganizationId: input.expectedOrganizationId,
+        groupId: input.groupId,
+        projection,
+    });
+    if (isCurrent) {
+        try {
+            await savePrincipalPolicyBundle(input.runtime.infra.execSql, bundle, new Date().toISOString(), input.expectedOrganizationId, { stillCurrent: input.stillCurrent });
+        }
+        catch {
+            // The cryptographically verified root grant is already safe. A local
+            // cache failure must not keep it pending or trigger duplicate re-wraps.
+        }
+    }
+    return input.stillCurrent?.() !== false && isCurrent;
+}
+export async function containerStateHasCurrentGroupGrant(input) {
+    return ((await nullOnProjectionVerificationCancellation(() => containerStateHasCurrentGroupGrantInternal(input))) ?? false);
+}
+//# sourceMappingURL=groupGrantVerification.js.map

package/workflows/container-contents/container-state/groupGrantVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupGrantVerification.js","sourceRoot":"","sources":["groupGrantVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uCAAuC,EAAE,MAAM,iEAAiE,CAAC;AAC1H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,EACrC,iCAAiC,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAC;AAK1E,SAAS,8BAA8B,CAAC,KASvC;IACC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CACrD,CAAC;IACF,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QAC/C,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACrD,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C;QACD,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,WAAW,CAAC,aAAa;YACtD,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW;YAClD,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO;YAC1C,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ;YAC5C,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,CAAC,SAAS;YAC9C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,CAAC,cAAc,CAC3D,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAUzD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IACE,CAAC,UAAU;QACX,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAChC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;QACjD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,mBAAmB;QAC/D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC3C,KAAK,CAAC,sBAAsB;QAC9B,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QACpD,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAC1D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAC7D,MAAM,qCAAqC,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,sBAAsB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,IACE,CAAC,sCAAsC,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,EACxE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B;QACE,kBAAkB;QAClB,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,sBAAsB;KAC7C,EACD,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;QAC7D,UAAU;QACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,8BAA8B,CAAC;QAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW;QACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;KACX,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,sBAAsB,EAC5B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAuE;IAEvE,OAAO,CACL,CAAC,MAAM,wCAAwC,CAAC,GAAG,EAAE,CACnD,0CAA0C,CAAC,KAAK,CAAC,CAClD,CAAC,IAAI,KAAK,CACZ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport { principalPolicyBundleContainsReference } from \"../../../data/principalPolicyStates\";\nimport {\n  advanceVerifiedSharePolicies,\n  loadVerifiedGroupSharePrincipalPolicy,\n  referencedPrincipalHeadFromPolicy,\n} from \"../../containers\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"./projectionCache\";\nimport type { ContainerWorkflowRuntime } from \"./types\";\n\ntype GroupGrantAccessLevel = \"read\" | \"write\" | \"admin\";\n\nfunction projectionHasCurrentGroupGrant(input: {\n  accessLevel: GroupGrantAccessLevel;\n  expectedContainerId: string;\n  expectedOrganizationId: string;\n  groupId: string;\n  currentHead: ReferencedPrincipalHead;\n  projection: NonNullable<\n    Awaited<ReturnType<typeof loadContainerWriterProjectionForState>>\n  >;\n}): boolean {\n  const state = readContainerState(\n    getTargetContainerContext(input.projection).manifest,\n  );\n  return (\n    state.containerId === input.expectedContainerId &&\n    state.organizationId === input.expectedOrganizationId &&\n    state.directGrants.some(\n      (grant) =>\n        grant.subjectType === \"group\" &&\n        grant.subjectId === input.groupId &&\n        grant.accessLevel === input.accessLevel,\n    ) &&\n    state.referencedPrincipalHeads.some(\n      (head) =>\n        head.principalType === input.currentHead.principalType &&\n        head.principalId === input.currentHead.principalId &&\n        head.version === input.currentHead.version &&\n        head.keyEpoch === input.currentHead.keyEpoch &&\n        head.stateHash === input.currentHead.stateHash &&\n        head.keyFingerprint === input.currentHead.keyFingerprint,\n    )\n  );\n}\n\nasync function containerStateHasCurrentGroupGrantInternal(input: {\n  accessLevel: GroupGrantAccessLevel;\n  containerState: ContainerState;\n  expectedContainerId: string;\n  expectedGroupHead: ReferencedPrincipalHead;\n  expectedOrganizationId: string;\n  groupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  if (input.stillCurrent?.() === false) return false;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (\n    !projection ||\n    input.stillCurrent?.() === false ||\n    input.expectedGroupHead.principalType !== \"group\" ||\n    input.expectedGroupHead.principalId !== input.groupId ||\n    input.containerState.container.id !== input.expectedContainerId ||\n    input.containerState.container.organizationId !==\n      input.expectedOrganizationId ||\n    projection.containerId !== input.expectedContainerId ||\n    projection.organizationId !== input.expectedOrganizationId\n  ) {\n    return false;\n  }\n\n  const { bundle, checkpointPolicies, dependencyBundles, policy } =\n    await loadVerifiedGroupSharePrincipalPolicy({\n      apiClient: input.runtime.apiClient,\n      execSql: input.runtime.infra.execSql,\n      expectedGroupHead: input.expectedGroupHead,\n      groupId: input.groupId,\n      organizationId: input.expectedOrganizationId,\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  if (input.stillCurrent?.() === false) return false;\n  if (\n    !principalPolicyBundleContainsReference(bundle, input.expectedGroupHead)\n  ) {\n    return false;\n  }\n  const currentHead = referencedPrincipalHeadFromPolicy(policy);\n  await advanceVerifiedSharePolicies(\n    input.runtime.infra.execSql,\n    {\n      checkpointPolicies,\n      dependencyBundles,\n      organizationId: input.expectedOrganizationId,\n    },\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return false;\n  await verifyContainerWriterProjection({\n    execSql: input.runtime.infra.execSql,\n    principalPolicyCache:\n      principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n    projection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  const isCurrent = projectionHasCurrentGroupGrant({\n    accessLevel: input.accessLevel,\n    currentHead,\n    expectedContainerId: input.expectedContainerId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    groupId: input.groupId,\n    projection,\n  });\n  if (isCurrent) {\n    try {\n      await savePrincipalPolicyBundle(\n        input.runtime.infra.execSql,\n        bundle,\n        new Date().toISOString(),\n        input.expectedOrganizationId,\n        { stillCurrent: input.stillCurrent },\n      );\n    } catch {\n      // The cryptographically verified root grant is already safe. A local\n      // cache failure must not keep it pending or trigger duplicate re-wraps.\n    }\n  }\n  return input.stillCurrent?.() !== false && isCurrent;\n}\n\nexport async function containerStateHasCurrentGroupGrant(\n  input: Parameters<typeof containerStateHasCurrentGroupGrantInternal>[0],\n): Promise<boolean> {\n  return (\n    (await nullOnProjectionVerificationCancellation(() =>\n      containerStateHasCurrentGroupGrantInternal(input),\n    )) ?? false\n  );\n}\n"]}

package/workflows/container-contents/container-state/localPathDepth.js

@@ -0,0 +1,60 @@
+import { MAX_CONTAINER_PATH_LENGTH } from "../../../internal/validators/util/index.js";
+import { assertContainerPathLengthFits } from "../../../data/containers/shared/containerPathLimits.js";
+/** Containers from the root through `containerId`, as this device holds them. */
+function localContainerPathLength(containersById, containerId) {
+    const seen = new Set();
+    let current = containerId;
+    while (current !== null && !seen.has(current)) {
+        seen.add(current);
+        current = containersById.get(current)?.container.parentId ?? null;
+    }
+    return seen.size;
+}
+/** Levels below `containerId` among the descendants this device holds. */
+function localSubtreeHeight(containersById, containerId) {
+    const childIds = new Map();
+    for (const [id, { container }] of containersById) {
+        if (container.parentId === null)
+            continue;
+        const siblings = childIds.get(container.parentId) ?? [];
+        siblings.push(id);
+        childIds.set(container.parentId, siblings);
+    }
+    const seen = new Set([containerId]);
+    let level = [containerId];
+    let height = 0;
+    for (;;) {
+        const next = level
+            .flatMap((id) => childIds.get(id) ?? [])
+            .filter((id) => !seen.has(id));
+        if (next.length === 0)
+            return height;
+        for (const id of next)
+            seen.add(id);
+        level = next;
+        height += 1;
+    }
+}
+/** Whether a new child of `parentId` fits, as this device holds its path. */
+export function localChildPathFits(containersById, parentId) {
+    return (localContainerPathLength(containersById, parentId) <
+        MAX_CONTAINER_PATH_LENGTH);
+}
+/**
+ * Refuse a local create before it is queued when the new child would exceed
+ * the readable path length; a queued intent would otherwise never sync.
+ */
+export function assertLocalChildPathFits(containersById, parentId) {
+    assertContainerPathLengthFits(localContainerPathLength(containersById, parentId) + 1);
+}
+/**
+ * Refuse a local move before it is queued when the moved subtree would exceed
+ * the readable path length. The server also counts descendants this device
+ * cannot see; replay abandons a move it refuses for that reason.
+ */
+export function assertLocalMovePathFits(containersById, containerId, parentId) {
+    assertContainerPathLengthFits(localContainerPathLength(containersById, parentId) +
+        1 +
+        localSubtreeHeight(containersById, containerId));
+}
+//# sourceMappingURL=localPathDepth.js.map

package/workflows/container-contents/container-state/localPathDepth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localPathDepth.js","sourceRoot":"","sources":["localPathDepth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAOpG,iFAAiF;AACjF,SAAS,wBAAwB,CAC/B,cAA+B,EAC/B,WAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAkB,WAAW,CAAC;IACzC,OAAO,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CACzB,cAA+B,EAC/B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QACjD,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,KAAK;aACf,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;aACvC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,cAA+B,EAC/B,QAAgB;IAEhB,OAAO,CACL,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC;QAClD,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,cAA+B,EAC/B,QAAgB;IAEhB,6BAA6B,CAC3B,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,cAA+B,EAC/B,WAAmB,EACnB,QAAgB;IAEhB,6BAA6B,CAC3B,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC;QAChD,CAAC;QACD,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,CAClD,CAAC;AACJ,CAAC","sourcesContent":["import { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { assertContainerPathLengthFits } from \"../../../data/containers/shared/containerPathLimits\";\n\ntype LocalContainers = ReadonlyMap<\n  string,\n  { readonly container: { readonly parentId: string | null } }\n>;\n\n/** Containers from the root through `containerId`, as this device holds them. */\nfunction localContainerPathLength(\n  containersById: LocalContainers,\n  containerId: string,\n): number {\n  const seen = new Set<string>();\n  let current: string | null = containerId;\n  while (current !== null && !seen.has(current)) {\n    seen.add(current);\n    current = containersById.get(current)?.container.parentId ?? null;\n  }\n  return seen.size;\n}\n\n/** Levels below `containerId` among the descendants this device holds. */\nfunction localSubtreeHeight(\n  containersById: LocalContainers,\n  containerId: string,\n): number {\n  const childIds = new Map<string, string[]>();\n  for (const [id, { container }] of containersById) {\n    if (container.parentId === null) continue;\n    const siblings = childIds.get(container.parentId) ?? [];\n    siblings.push(id);\n    childIds.set(container.parentId, siblings);\n  }\n  const seen = new Set([containerId]);\n  let level = [containerId];\n  let height = 0;\n  for (;;) {\n    const next = level\n      .flatMap((id) => childIds.get(id) ?? [])\n      .filter((id) => !seen.has(id));\n    if (next.length === 0) return height;\n    for (const id of next) seen.add(id);\n    level = next;\n    height += 1;\n  }\n}\n\n/** Whether a new child of `parentId` fits, as this device holds its path. */\nexport function localChildPathFits(\n  containersById: LocalContainers,\n  parentId: string,\n): boolean {\n  return (\n    localContainerPathLength(containersById, parentId) <\n    MAX_CONTAINER_PATH_LENGTH\n  );\n}\n\n/**\n * Refuse a local create before it is queued when the new child would exceed\n * the readable path length; a queued intent would otherwise never sync.\n */\nexport function assertLocalChildPathFits(\n  containersById: LocalContainers,\n  parentId: string,\n): void {\n  assertContainerPathLengthFits(\n    localContainerPathLength(containersById, parentId) + 1,\n  );\n}\n\n/**\n * Refuse a local move before it is queued when the moved subtree would exceed\n * the readable path length. The server also counts descendants this device\n * cannot see; replay abandons a move it refuses for that reason.\n */\nexport function assertLocalMovePathFits(\n  containersById: LocalContainers,\n  containerId: string,\n  parentId: string,\n): void {\n  assertContainerPathLengthFits(\n    localContainerPathLength(containersById, parentId) +\n      1 +\n      localSubtreeHeight(containersById, containerId),\n  );\n}\n"]}