@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/containers/child/create.js

@@ -0,0 +1,337 @@
+import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
+import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
+import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
+import { buildContainerCreateBody, buildContainerCreateKeyEpoch, buildParentRecipientTargets, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../data/containers/shared/events.js";
+import { acknowledgeContainerMutation } from "../../../data/containers/shared/mutationAcknowledgement.js";
+import { asContainerManifestBundle, getParentCreateContext, readContainerState, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, } from "../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
+import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
+import { repairContainerCreateFailure, submitRemoteContainerCreate, } from "./createSubmission.js";
+import { containerMutationRequestCore } from "./mutationRequestCore.js";
+import { requireUnwrappedKek } from "./rotationContext.js";
+function assertContainerCreatePlanInput(input) {
+    if (input.containerKey.byteLength !== 32) {
+        throw new Error("Container KEK material must be 32 bytes");
+    }
+    // The child container's organization is derived from the parent projection
+    // (see buildContainerCreatePlan), so it always matches the parent by
+    // construction — a member writing under another org's shared root is the
+    // expected case, not an error. The author supplies only the signer identity.
+}
+function buildContainerCreateRequest(input) {
+    return {
+        ...containerMutationRequestCore("create", {
+            ...input,
+            userRecipientKeys: [],
+        }),
+        previousManifest: null,
+        parentContainerPath: input.parentProjection.path.map(asContainerManifestBundle),
+        predecessorBridge: null,
+        keyring: null,
+        parentKekState: readCanonicalRecord(input.parentKek, "Container create parent KEK state"),
+    };
+}
+async function resolveContainerCreatePlanContext(input) {
+    assertContainerCreatePlanInput(input);
+    assertContainerKekPathCurrent(input.parentProjection.containerKeks);
+    const containerId = input.containerId ?? crypto.randomUUID();
+    return {
+        ...input,
+        containerId,
+        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
+            containerId,
+            keyMaterial: input.containerKey,
+        }),
+        containerKeyEpochId: await resolveContainerKekEpochId({
+            containerId,
+            keyEpoch: 1,
+            keyMaterial: input.containerKey,
+            override: input.containerKeyEpochId,
+        }),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),
+        parent: getParentCreateContext(input.parentProjection),
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    };
+}
+function buildChildContainerCreateBody(context, managedGrant) {
+    const baseBody = buildContainerCreateBody({
+        systemSlot: context.systemSlot ?? null,
+        containerKeyEpochId: context.containerKeyEpochId,
+        containerKeyPublicKey: context.containerKeyPublicKey,
+        metadataDocumentId: context.metadataDocumentId,
+        parentContainerId: context.parentProjection.containerId,
+        parentManifestHash: context.parent.manifest.manifestHash,
+    });
+    if (!managedGrant) {
+        return baseBody;
+    }
+    return {
+        ...baseBody,
+        directGrants: [
+            {
+                accessLevel: managedGrant.accessLevel,
+                subjectId: managedGrant.principalHead.principalId,
+                subjectType: managedGrant.principalHead.principalType,
+            },
+        ],
+        referencedPrincipalHeads: [managedGrant.principalHead],
+    };
+}
+// A managed-principal grant adds a second recipient: the group/organization key
+// wrap alongside the parent-inheritance wrap. The server derives both targets
+// (parent inheritance + directGrant) and requires exactly one wrap each; target
+// order is irrelevant since the key-target hash is normalized.
+async function buildChildContainerWrapsAndTargets(input) {
+    const { context, managedGrant, manifestHash } = input;
+    const parentPublicKey = readContainerState(context.parent.manifest).containerKeyPublicKey;
+    if (!parentPublicKey)
+        throw new Error("Container parent wrapping public key is missing");
+    const parentWrap = await wrapContainerKeyToParent({
+        containerKey: context.containerKey,
+        containerKeyEpochId: context.containerKeyEpochId,
+        manifestHash,
+        parentKek: context.parent.kek,
+        parentPublicKey,
+    });
+    const parentTargets = buildParentRecipientTargets(context.parent.kek);
+    if (!managedGrant) {
+        return { recipientTargets: parentTargets, wraps: [parentWrap] };
+    }
+    const managedRecipient = await wrapContainerKeyToManagedPrincipal({
+        containerKey: context.containerKey,
+        containerKeyEpochId: context.containerKeyEpochId,
+        manifestHash,
+        principalEncapsulationPublicKey: managedGrant.principalEncapsulationPublicKey,
+        principalHead: managedGrant.principalHead,
+    });
+    return {
+        recipientTargets: [...parentTargets, managedRecipient.recipientTarget],
+        wraps: [parentWrap, managedRecipient.wrap],
+    };
+}
+export async function buildContainerCreatePlan(input) {
+    const context = await resolveContainerCreatePlanContext(input);
+    const parentContainerId = context.parentProjection.containerId;
+    const parentManifestHash = context.parent.manifest.manifestHash;
+    const managedGrant = input.managedPrincipalGrant;
+    const body = buildChildContainerCreateBody(context, managedGrant);
+    // The new container belongs to the parent's organization, not the author's.
+    // A member writing under another org's shared root mints a container owned by
+    // that org; the author only supplies the signer identity.
+    const organizationId = context.parentProjection.organizationId;
+    const { event, eventHash } = await signContainerCreateEvent({
+        author: context.author,
+        body,
+        containerId: context.containerId,
+        eventId: context.eventId,
+        organizationId,
+        parentPath: context.parentProjection.path,
+        signedAt: context.signedAt,
+    });
+    const { manifest, manifestHash, state } = await deriveContainerCreateManifest({
+        systemSlot: context.systemSlot ?? null,
+        containerId: context.containerId,
+        containerKeyEpochId: context.containerKeyEpochId,
+        containerKeyPublicKey: context.containerKeyPublicKey,
+        directGrants: body.directGrants,
+        eventHash,
+        metadataDocumentId: context.metadataDocumentId,
+        organizationId,
+        parentContainerId,
+        parentManifestHash,
+        referencedPrincipalHeads: body.referencedPrincipalHeads,
+    });
+    const keyEpoch = buildContainerCreateKeyEpoch({
+        containerId: context.containerId,
+        containerKeyEpochId: context.containerKeyEpochId,
+        eventHash,
+        manifestHash,
+        parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,
+    });
+    const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({
+        context,
+        managedGrant,
+        manifestHash,
+    });
+    const keyTargetHash = await computeContainerKekRecipientTargetHash(recipientTargets);
+    const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);
+    return {
+        body,
+        containerId: context.containerId,
+        containerKeyEpochId: context.containerKeyEpochId,
+        event,
+        eventHash,
+        keyEpoch,
+        keyEpochHash,
+        keyTargetHash,
+        manifest,
+        manifestHash,
+        metadataDocumentId: context.metadataDocumentId,
+        parentContainerId,
+        parentManifestHash,
+        recipientTargets,
+        request: buildContainerCreateRequest({
+            body,
+            event,
+            keyEpoch,
+            manifest,
+            manifestHash,
+            parentKek: context.parent.kek,
+            parentProjection: context.parentProjection,
+            principalPolicies: context.principalPolicies ?? [],
+            wraps,
+        }),
+        state,
+        wraps,
+    };
+}
+export async function buildMaterializedContainerCreatePlan(input) {
+    const containerKey = input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));
+    const parentKeksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        projection: input.parentProjection,
+        secretKey: input.parentSecretKey,
+        ...projectionVerificationOptions(input),
+    });
+    const parent = getParentCreateContext(input.parentProjection);
+    requireUnwrappedKek(parentKeksByEpochId, parent.kek, "Container parent");
+    // Checked on the path verification just accepted, never on the raw response.
+    assertContainerChildPathFits(input.parentProjection.path);
+    const principalPolicies = input.resolveProjectionUserKey
+        ? await collectContainerWriterProjectionPrincipalPolicies({
+            execSql: input.execSql,
+            projection: input.parentProjection,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        })
+        : [];
+    if (input.resolveProjectionUserKey) {
+        assertContainerAuthorAccess({
+            author: {
+                ...input.author,
+                organizationId: input.parentProjection.organizationId,
+            },
+            projection: input.parentProjection,
+            principalPolicies,
+            minimumAccess: input.systemSlot ? "admin" : "write",
+        });
+    }
+    const plan = await buildContainerCreatePlan({
+        author: input.author,
+        containerId: input.containerId,
+        containerKey,
+        containerKeyEpochId: input.containerKeyEpochId,
+        eventId: input.eventId,
+        managedPrincipalGrant: input.managedPrincipalGrant,
+        metadataDocumentId: input.metadataDocumentId,
+        systemSlot: input.systemSlot,
+        parentProjection: input.parentProjection,
+        principalPolicies,
+        signedAt: input.signedAt,
+    });
+    return {
+        containerKey,
+        plan,
+    };
+}
+export { childContainerWriterProjectionFromCreatePlan } from "./createProjection.js";
+async function createRemoteContainerWithRepairs(input) {
+    let parentProjection = input.parentProjection;
+    const repairState = {
+        didRepairStaleParent: false,
+        policyRepairs: new PrincipalPolicyRepairBudget(),
+    };
+    for (;;) {
+        const materializedPlan = await buildMaterializedContainerCreatePlan({
+            author: input.request.author,
+            containerId: input.containerId,
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.request.containerKeyEpochId,
+            eventId: input.eventId,
+            execSql: input.request.execSql,
+            metadataDocumentId: input.metadataDocumentId,
+            parentProjection,
+            parentSecretKey: input.request.parentSecretKey,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            signedAt: input.signedAt,
+            stillCurrent: input.request.stillCurrent,
+            warmReferencedPrincipalPolicies: input.request.warmReferencedPrincipalPolicies,
+        });
+        const submitted = await submitRemoteContainerCreate({
+            apiClient: input.request.apiClient,
+            plan: materializedPlan.plan,
+            stillCurrent: input.request.stillCurrent,
+        });
+        if (!submitted)
+            return null;
+        if (!submitted.ok) {
+            const repair = await repairContainerCreateFailure({
+                apiClient: input.request.apiClient,
+                execSql: input.request.execSql,
+                failure: submitted,
+                parentContainerId: input.request.parentContainerId,
+                parentProjection,
+                reportSecurityIncident: input.request.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.request.resolveTrustedUserIdentity,
+                state: repairState,
+                stillCurrent: input.request.stillCurrent,
+            });
+            if (repair.kind === "retry") {
+                parentProjection = repair.parentProjection;
+                continue;
+            }
+            if (repair.kind === "unavailable") {
+                return null;
+            }
+            submitted.report();
+            return null;
+        }
+        const acknowledged = await acknowledgeContainerMutation({
+            execSql: input.request.execSql,
+            plan: materializedPlan.plan,
+            response: submitted.response,
+            stillCurrent: input.request.stillCurrent,
+        });
+        return {
+            acknowledged,
+            result: {
+                containerKey: materializedPlan.containerKey,
+                containerId: submitted.response.containerId,
+                metadataDocumentId: materializedPlan.plan.metadataDocumentId,
+                plan: materializedPlan.plan,
+                response: submitted.response,
+            },
+        };
+    }
+}
+async function createRemoteContainerOutcome(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container create");
+    const parentProjection = input.parentProjection ??
+        (await input.apiClient.getContainerWriterProjection(input.parentContainerId));
+    if (!parentProjection) {
+        return null;
+    }
+    return nullOnProjectionVerificationCancellation(() => createRemoteContainerWithRepairs({
+        containerId: input.containerId ?? crypto.randomUUID(),
+        containerKey: input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),
+        parentProjection,
+        request: input,
+        resolveProjectionUserKey,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    }));
+}
+export async function createRemoteContainer(input) {
+    const outcome = await createRemoteContainerOutcome(input);
+    return outcome?.acknowledged && input.stillCurrent?.() !== false
+        ? outcome.result
+        : null;
+}
+//# sourceMappingURL=create.js.map

package/workflows/containers/child/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAClD,yBAAyB,CAC1B;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;gBAC9B,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;gBAC5D,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,KAAK,EAAE,WAAW;gBAClB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerCreateAccessEventBody,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  deriveContainerKekWrappingPublicKey,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n  buildContainerCreateBody,\n  buildContainerCreateKeyEpoch,\n  buildParentRecipientTargets,\n  deriveContainerCreateManifest,\n  resolveContainerKekEpochId,\n  signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n  asContainerManifestBundle,\n  getParentCreateContext,\n  readContainerState,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  BuildContainerCreatePlanInput,\n  ContainerCreatePlan,\n  ContainerCreatePlanContext,\n  ContainerMutationAuthor,\n  CreateRemoteContainerResult,\n  MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n  type ContainerCreateRepairState,\n  type RemoteContainerCreateInput,\n  repairContainerCreateFailure,\n  submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n  containerKey: Uint8Array;\n}): void {\n  if (input.containerKey.byteLength !== 32) {\n    throw new Error(\"Container KEK material must be 32 bytes\");\n  }\n  // The child container's organization is derived from the parent projection\n  // (see buildContainerCreatePlan), so it always matches the parent by\n  // construction — a member writing under another org's shared root is the\n  // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n  body: ContainerCreateAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse;\n  parentProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"create\", {\n      ...input,\n      userRecipientKeys: [],\n    }),\n    previousManifest: null,\n    parentContainerPath: input.parentProjection.path.map(\n      asContainerManifestBundle,\n    ),\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecord(\n      input.parentKek,\n      \"Container create parent KEK state\",\n    ),\n  };\n}\n\nasync function resolveContainerCreatePlanContext(\n  input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n  assertContainerCreatePlanInput(input);\n  assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n  const containerId = input.containerId ?? crypto.randomUUID();\n\n  return {\n    ...input,\n    containerId,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId,\n      keyMaterial: input.containerKey,\n    }),\n    containerKeyEpochId: await resolveContainerKekEpochId({\n      containerId,\n      keyEpoch: 1,\n      keyMaterial: input.containerKey,\n      override: input.containerKeyEpochId,\n    }),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n    parent: getParentCreateContext(input.parentProjection),\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n}\n\nfunction buildChildContainerCreateBody(\n  context: ContainerCreatePlanContext,\n  managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n  const baseBody = buildContainerCreateBody({\n    systemSlot: context.systemSlot ?? null,\n    containerKeyEpochId: context.containerKeyEpochId,\n    containerKeyPublicKey: context.containerKeyPublicKey,\n    metadataDocumentId: context.metadataDocumentId,\n    parentContainerId: context.parentProjection.containerId,\n    parentManifestHash: context.parent.manifest.manifestHash,\n  });\n  if (!managedGrant) {\n    return baseBody;\n  }\n  return {\n    ...baseBody,\n    directGrants: [\n      {\n        accessLevel: managedGrant.accessLevel,\n        subjectId: managedGrant.principalHead.principalId,\n        subjectType: managedGrant.principalHead.principalType,\n      },\n    ],\n    referencedPrincipalHeads: [managedGrant.principalHead],\n  };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n  context: ContainerCreatePlanContext;\n  managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n  manifestHash: string;\n}): Promise<{\n  recipientTargets: ContainerKekRecipientTarget[];\n  wraps: ContainerKeyWrap[];\n}> {\n  const { context, managedGrant, manifestHash } = input;\n  const parentPublicKey = readContainerState(\n    context.parent.manifest,\n  ).containerKeyPublicKey;\n  if (!parentPublicKey)\n    throw new Error(\"Container parent wrapping public key is missing\");\n  const parentWrap = await wrapContainerKeyToParent({\n    containerKey: context.containerKey,\n    containerKeyEpochId: context.containerKeyEpochId,\n    manifestHash,\n    parentKek: context.parent.kek,\n    parentPublicKey,\n  });\n  const parentTargets = buildParentRecipientTargets(context.parent.kek);\n  if (!managedGrant) {\n    return { recipientTargets: parentTargets, wraps: [parentWrap] };\n  }\n  const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: context.containerKey,\n    containerKeyEpochId: context.containerKeyEpochId,\n    manifestHash,\n    principalEncapsulationPublicKey:\n      managedGrant.principalEncapsulationPublicKey,\n    principalHead: managedGrant.principalHead,\n  });\n  return {\n    recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n    wraps: [parentWrap, managedRecipient.wrap],\n  };\n}\n\nexport async function buildContainerCreatePlan(\n  input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n  const context = await resolveContainerCreatePlanContext(input);\n  const parentContainerId = context.parentProjection.containerId;\n  const parentManifestHash = context.parent.manifest.manifestHash;\n  const managedGrant = input.managedPrincipalGrant;\n  const body = buildChildContainerCreateBody(context, managedGrant);\n  // The new container belongs to the parent's organization, not the author's.\n  // A member writing under another org's shared root mints a container owned by\n  // that org; the author only supplies the signer identity.\n  const organizationId = context.parentProjection.organizationId;\n  const { event, eventHash } = await signContainerCreateEvent({\n    author: context.author,\n    body,\n    containerId: context.containerId,\n    eventId: context.eventId,\n    organizationId,\n    parentPath: context.parentProjection.path,\n    signedAt: context.signedAt,\n  });\n  const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n    {\n      systemSlot: context.systemSlot ?? null,\n      containerId: context.containerId,\n      containerKeyEpochId: context.containerKeyEpochId,\n      containerKeyPublicKey: context.containerKeyPublicKey,\n      directGrants: body.directGrants,\n      eventHash,\n      metadataDocumentId: context.metadataDocumentId,\n      organizationId,\n      parentContainerId,\n      parentManifestHash,\n      referencedPrincipalHeads: body.referencedPrincipalHeads,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: context.containerId,\n    containerKeyEpochId: context.containerKeyEpochId,\n    eventHash,\n    manifestHash,\n    parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n  });\n  const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n    context,\n    managedGrant,\n    manifestHash,\n  });\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  return {\n    body,\n    containerId: context.containerId,\n    containerKeyEpochId: context.containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyEpochHash,\n    keyTargetHash,\n    manifest,\n    manifestHash,\n    metadataDocumentId: context.metadataDocumentId,\n    parentContainerId,\n    parentManifestHash,\n    recipientTargets,\n    request: buildContainerCreateRequest({\n      body,\n      event,\n      keyEpoch,\n      manifest,\n      manifestHash,\n      parentKek: context.parent.kek,\n      parentProjection: context.parentProjection,\n      principalPolicies: context.principalPolicies ?? [],\n      wraps,\n    }),\n    state,\n    wraps,\n  };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n  input: {\n    author: ContainerMutationAuthor;\n    containerId?: string | undefined;\n    containerKey?: Uint8Array | undefined;\n    containerKeyEpochId?: string | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n    metadataDocumentId?: string | undefined;\n    systemSlot?: string | null | undefined;\n    parentProjection: ContainerWriterProjectionResponse;\n    parentSecretKey: Uint8Array;\n    signedAt?: string | undefined;\n    // Fetches the parent path's referenced principal policies on demand when\n    // they are not cached locally — lets a member create under another org's\n    // shared root without having first hydrated that org's group policy.\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n  const containerKey =\n    input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n  const parentKeksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.parentProjection,\n    secretKey: input.parentSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const parent = getParentCreateContext(input.parentProjection);\n  requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n  // Checked on the path verification just accepted, never on the raw response.\n  assertContainerChildPathFits(input.parentProjection.path);\n  const principalPolicies = input.resolveProjectionUserKey\n    ? await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        projection: input.parentProjection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      })\n    : [];\n  if (input.resolveProjectionUserKey) {\n    assertContainerAuthorAccess({\n      author: {\n        ...input.author,\n        organizationId: input.parentProjection.organizationId,\n      },\n      projection: input.parentProjection,\n      principalPolicies,\n      minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n    });\n  }\n  const plan = await buildContainerCreatePlan({\n    author: input.author,\n    containerId: input.containerId,\n    containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventId: input.eventId,\n    managedPrincipalGrant: input.managedPrincipalGrant,\n    metadataDocumentId: input.metadataDocumentId,\n    systemSlot: input.systemSlot,\n    parentProjection: input.parentProjection,\n    principalPolicies,\n    signedAt: input.signedAt,\n  });\n\n  return {\n    containerKey,\n    plan,\n  };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n  readonly containerId: string;\n  readonly containerKey: Uint8Array;\n  readonly eventId: string;\n  readonly metadataDocumentId: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly request: RemoteContainerCreateInput;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly signedAt: string;\n}): Promise<{\n  readonly acknowledged: boolean;\n  readonly result: CreateRemoteContainerResult;\n} | null> {\n  let parentProjection = input.parentProjection;\n  const repairState: ContainerCreateRepairState = {\n    didRepairStaleParent: false,\n    policyRepairs: new PrincipalPolicyRepairBudget(),\n  };\n  for (;;) {\n    const materializedPlan = await buildMaterializedContainerCreatePlan({\n      author: input.request.author,\n      containerId: input.containerId,\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.request.containerKeyEpochId,\n      eventId: input.eventId,\n      execSql: input.request.execSql,\n      metadataDocumentId: input.metadataDocumentId,\n      parentProjection,\n      parentSecretKey: input.request.parentSecretKey,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      signedAt: input.signedAt,\n      stillCurrent: input.request.stillCurrent,\n      warmReferencedPrincipalPolicies:\n        input.request.warmReferencedPrincipalPolicies,\n    });\n    const submitted = await submitRemoteContainerCreate({\n      apiClient: input.request.apiClient,\n      plan: materializedPlan.plan,\n      stillCurrent: input.request.stillCurrent,\n    });\n    if (!submitted) return null;\n    if (!submitted.ok) {\n      const repair = await repairContainerCreateFailure({\n        apiClient: input.request.apiClient,\n        execSql: input.request.execSql,\n        failure: submitted,\n        parentContainerId: input.request.parentContainerId,\n        parentProjection,\n        reportSecurityIncident: input.request.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.request.resolveTrustedUserIdentity,\n        state: repairState,\n        stillCurrent: input.request.stillCurrent,\n      });\n      if (repair.kind === \"retry\") {\n        parentProjection = repair.parentProjection;\n        continue;\n      }\n      if (repair.kind === \"unavailable\") {\n        return null;\n      }\n      submitted.report();\n      return null;\n    }\n    const acknowledged = await acknowledgeContainerMutation({\n      execSql: input.request.execSql,\n      plan: materializedPlan.plan,\n      response: submitted.response,\n      stillCurrent: input.request.stillCurrent,\n    });\n    return {\n      acknowledged,\n      result: {\n        containerKey: materializedPlan.containerKey,\n        containerId: submitted.response.containerId,\n        metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n        plan: materializedPlan.plan,\n        response: submitted.response,\n      },\n    };\n  }\n}\n\nasync function createRemoteContainerOutcome(\n  input: RemoteContainerCreateInput,\n): Promise<{\n  readonly acknowledged: boolean;\n  readonly result: CreateRemoteContainerResult;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container create\",\n  );\n  const parentProjection =\n    input.parentProjection ??\n    (await input.apiClient.getContainerWriterProjection(\n      input.parentContainerId,\n    ));\n  if (!parentProjection) {\n    return null;\n  }\n  return nullOnProjectionVerificationCancellation(() =>\n    createRemoteContainerWithRepairs({\n      containerId: input.containerId ?? crypto.randomUUID(),\n      containerKey:\n        input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n      eventId: input.eventId ?? crypto.randomUUID(),\n      metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n      parentProjection,\n      request: input,\n      resolveProjectionUserKey,\n      signedAt: input.signedAt ?? new Date().toISOString(),\n    }),\n  );\n}\n\nexport async function createRemoteContainer(\n  input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult | null> {\n  const outcome = await createRemoteContainerOutcome(input);\n  return outcome?.acknowledged && input.stillCurrent?.() !== false\n    ? outcome.result\n    : null;\n}\n"]}

package/workflows/containers/child/createProjection.d.ts

@@ -0,0 +1,6 @@
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { MaterializedContainerCreatePlan } from "../../../data/containers/shared/types.js";
+export declare function childContainerWriterProjectionFromCreatePlan(input: {
+    materializedPlan: MaterializedContainerCreatePlan;
+    parentProjection: ContainerWriterProjectionResponse;
+}): ContainerWriterProjectionResponse;

package/workflows/containers/child/createProjection.js

@@ -0,0 +1,43 @@
+import { getParentCreateContext } from "../../../data/containers/shared/projection.js";
+import { readCanonicalRecord, readCanonicalRecords, } from "../../../data/keyingCanonicalJson.js";
+export function childContainerWriterProjectionFromCreatePlan(input) {
+    const { materializedPlan, parentProjection } = input;
+    const { plan } = materializedPlan;
+    const parentKek = getParentCreateContext(parentProjection).kek;
+    return {
+        policyEvidence: parentProjection.policyEvidence,
+        containerId: plan.containerId,
+        organizationId: plan.state.organizationId,
+        path: [
+            ...parentProjection.path,
+            {
+                event: {
+                    event: readCanonicalRecord(plan.event, "Container child event"),
+                    body: readCanonicalRecord(plan.body, "Container child body"),
+                    eventHash: plan.eventHash,
+                },
+                manifest: readCanonicalRecord(plan.manifest, "Container child manifest"),
+                manifestHash: plan.manifestHash,
+                state: readCanonicalRecord(plan.state, "Container child state"),
+            },
+        ],
+        containerKeks: [
+            ...parentProjection.containerKeks,
+            {
+                containerId: plan.containerId,
+                accessManifestHash: plan.manifestHash,
+                containerKeyEpochId: plan.containerKeyEpochId,
+                containerKeyEpoch: plan.keyEpoch.keyEpoch,
+                keyEpoch: readCanonicalRecord(plan.keyEpoch, "Container child key epoch"),
+                keyEpochHash: plan.keyEpochHash,
+                keyTargetHash: plan.keyTargetHash,
+                containerManifestHistory: [],
+                parentContainerKeyEpochId: parentKek.containerKeyEpochId,
+                keyring: null,
+                recipientTargets: readCanonicalRecords(plan.recipientTargets, "Container child recipient targets"),
+                wraps: readCanonicalRecords(plan.wraps, "Container child wraps"),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=createProjection.js.map

package/workflows/containers/child/createProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createProjection.js","sourceRoot":"","sources":["createProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,UAAU,4CAA4C,CAAC,KAG5D;IACC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC;IAE/D,OAAO;QACL,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI;YACxB;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,gBAAgB,CAAC,aAAa;YACjC;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,2BAA2B,CAC5B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,SAAS,CAAC,mBAAmB;gBACxD,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,mCAAmC,CACpC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { getParentCreateContext } from \"../../../data/containers/shared/projection\";\nimport type { MaterializedContainerCreatePlan } from \"../../../data/containers/shared/types\";\nimport {\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\n\nexport function childContainerWriterProjectionFromCreatePlan(input: {\n  materializedPlan: MaterializedContainerCreatePlan;\n  parentProjection: ContainerWriterProjectionResponse;\n}): ContainerWriterProjectionResponse {\n  const { materializedPlan, parentProjection } = input;\n  const { plan } = materializedPlan;\n  const parentKek = getParentCreateContext(parentProjection).kek;\n\n  return {\n    policyEvidence: parentProjection.policyEvidence,\n    containerId: plan.containerId,\n    organizationId: plan.state.organizationId,\n    path: [\n      ...parentProjection.path,\n      {\n        event: {\n          event: readCanonicalRecord(plan.event, \"Container child event\"),\n          body: readCanonicalRecord(plan.body, \"Container child body\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(\n          plan.manifest,\n          \"Container child manifest\",\n        ),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container child state\"),\n      },\n    ],\n    containerKeks: [\n      ...parentProjection.containerKeks,\n      {\n        containerId: plan.containerId,\n        accessManifestHash: plan.manifestHash,\n        containerKeyEpochId: plan.containerKeyEpochId,\n        containerKeyEpoch: plan.keyEpoch.keyEpoch,\n        keyEpoch: readCanonicalRecord(\n          plan.keyEpoch,\n          \"Container child key epoch\",\n        ),\n        keyEpochHash: plan.keyEpochHash,\n        keyTargetHash: plan.keyTargetHash,\n        containerManifestHistory: [],\n        parentContainerKeyEpochId: parentKek.containerKeyEpochId,\n        keyring: null,\n        recipientTargets: readCanonicalRecords(\n          plan.recipientTargets,\n          \"Container child recipient targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container child wraps\"),\n      },\n    ],\n  };\n}\n"]}

package/workflows/containers/child/createSubmission.d.ts

@@ -0,0 +1,58 @@
+import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerCreateApi, ContainerCreatePlan, ContainerMutationAuthor, ContainerMutationSubmitFailure } from "../../../data/containers/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
+export interface ContainerCreateRepairState {
+    didRepairStaleParent: boolean;
+    policyRepairs: PrincipalPolicyRepairBudget;
+}
+export interface RemoteContainerCreateInput {
+    apiClient: ContainerCreateApi;
+    author: ContainerMutationAuthor;
+    containerId?: string | undefined;
+    containerKey?: Uint8Array | undefined;
+    containerKeyEpochId?: string | undefined;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    metadataDocumentId?: string | undefined;
+    parentContainerId: string;
+    parentProjection?: ContainerWriterProjectionResponse | undefined;
+    parentSecretKey: Uint8Array;
+    reportSecurityIncident: SecurityIncidentReporter;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+type ContainerCreateFailureRepair = {
+    readonly kind: "none";
+} | {
+    readonly kind: "unavailable";
+} | {
+    readonly kind: "retry";
+    readonly parentProjection: ContainerWriterProjectionResponse;
+};
+export declare function submitRemoteContainerCreate(input: {
+    readonly apiClient: ContainerCreateApi;
+    readonly plan: ContainerCreatePlan;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<{
+    readonly ok: true;
+    readonly response: ContainerMutationResponse;
+} | ContainerMutationSubmitFailure | null>;
+export declare function repairContainerCreateFailure(input: {
+    readonly apiClient: ContainerCreateApi;
+    readonly execSql: ExecSql;
+    readonly failure: ContainerMutationSubmitFailure;
+    readonly parentContainerId: string;
+    readonly parentProjection: ContainerWriterProjectionResponse;
+    readonly reportSecurityIncident: SecurityIncidentReporter;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly state: ContainerCreateRepairState;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<ContainerCreateFailureRepair>;
+export {};

package/workflows/containers/child/createSubmission.js

@@ -0,0 +1,45 @@
+import { isStaleParentContainerPathFailure } from "../../../data/containers/shared/mutationFailures.js";
+import { cacheRemoteContainerCreatePolicyRepair } from "./policyRepair.js";
+export async function submitRemoteContainerCreate(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const result = await input.apiClient.createContainerResult(input.plan.request, {
+        expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,
+        reportErrors: false,
+    });
+    return result.ok ? { ok: true, response: result.data } : result;
+}
+export async function repairContainerCreateFailure(input) {
+    if (input.stillCurrent?.() === false) {
+        return { kind: "unavailable" };
+    }
+    if (input.state.policyRepairs.take(input.failure.stalePrincipalPolicies) &&
+        (await cacheRemoteContainerCreatePolicyRepair({
+            apiClient: input.apiClient,
+            execSql: input.execSql,
+            failure: input.failure,
+            organizationId: input.parentProjection.organizationId,
+            reportSecurityIncident: input.reportSecurityIncident,
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            stillCurrent: input.stillCurrent,
+        }))) {
+        return { kind: "retry", parentProjection: input.parentProjection };
+    }
+    if (input.stillCurrent?.() === false) {
+        return { kind: "unavailable" };
+    }
+    if (input.state.didRepairStaleParent ||
+        !isStaleParentContainerPathFailure(input.failure)) {
+        return { kind: "none" };
+    }
+    input.state.didRepairStaleParent = true;
+    input.apiClient.evictContainerWriterProjection(input.parentContainerId);
+    const parentProjection = await input.apiClient.getContainerWriterProjection(input.parentContainerId);
+    if (input.stillCurrent?.() === false) {
+        return { kind: "unavailable" };
+    }
+    return parentProjection
+        ? { kind: "retry", parentProjection }
+        : { kind: "unavailable" };
+}
+//# sourceMappingURL=createSubmission.js.map

package/workflows/containers/child/createSubmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSubmission.js","sourceRoot":"","sources":["createSubmission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AAerG,OAAO,EAAE,sCAAsC,EAAE,MAAM,gBAAgB,CAAC;AAmCxE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CACxD,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;QACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACtE,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IACE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC;QACpE,CAAC,MAAM,sCAAsC,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;YACrD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,EACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAChC,CAAC,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACxC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACzE,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isStaleParentContainerPathFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n  ContainerCreateApi,\n  ContainerCreatePlan,\n  ContainerMutationAuthor,\n  ContainerMutationSubmitFailure,\n} from \"../../../data/containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport { cacheRemoteContainerCreatePolicyRepair } from \"./policyRepair\";\n\nexport interface ContainerCreateRepairState {\n  didRepairStaleParent: boolean;\n  policyRepairs: PrincipalPolicyRepairBudget;\n}\n\nexport interface RemoteContainerCreateInput {\n  apiClient: ContainerCreateApi;\n  author: ContainerMutationAuthor;\n  containerId?: string | undefined;\n  containerKey?: Uint8Array | undefined;\n  containerKeyEpochId?: string | undefined;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  metadataDocumentId?: string | undefined;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  parentSecretKey: Uint8Array;\n  reportSecurityIncident: SecurityIncidentReporter;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ntype ContainerCreateFailureRepair =\n  | { readonly kind: \"none\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly kind: \"retry\";\n      readonly parentProjection: ContainerWriterProjectionResponse;\n    };\n\nexport async function submitRemoteContainerCreate(input: {\n  readonly apiClient: ContainerCreateApi;\n  readonly plan: ContainerCreatePlan;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | {\n      readonly ok: true;\n      readonly response: ContainerMutationResponse;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const result = await input.apiClient.createContainerResult(\n    input.plan.request,\n    {\n      expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,\n      reportErrors: false,\n    },\n  );\n  return result.ok ? { ok: true, response: result.data } : result;\n}\n\nexport async function repairContainerCreateFailure(input: {\n  readonly apiClient: ContainerCreateApi;\n  readonly execSql: ExecSql;\n  readonly failure: ContainerMutationSubmitFailure;\n  readonly parentContainerId: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: ContainerCreateRepairState;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<ContainerCreateFailureRepair> {\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  if (\n    input.state.policyRepairs.take(input.failure.stalePrincipalPolicies) &&\n    (await cacheRemoteContainerCreatePolicyRepair({\n      apiClient: input.apiClient,\n      execSql: input.execSql,\n      failure: input.failure,\n      organizationId: input.parentProjection.organizationId,\n      reportSecurityIncident: input.reportSecurityIncident,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    }))\n  ) {\n    return { kind: \"retry\", parentProjection: input.parentProjection };\n  }\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  if (\n    input.state.didRepairStaleParent ||\n    !isStaleParentContainerPathFailure(input.failure)\n  ) {\n    return { kind: \"none\" };\n  }\n  input.state.didRepairStaleParent = true;\n  input.apiClient.evictContainerWriterProjection(input.parentContainerId);\n  const parentProjection = await input.apiClient.getContainerWriterProjection(\n    input.parentContainerId,\n  );\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  return parentProjection\n    ? { kind: \"retry\", parentProjection }\n    : { kind: \"unavailable\" };\n}\n"]}

package/workflows/containers/child/keyringOverrideLineage.d.ts

@@ -0,0 +1,22 @@
+import { type ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
+/**
+ * A rebuilt keyring override that omits an epoch the container's signed
+ * lineage names. That is what a rebuild made before a concurrent rotation
+ * looks like, so it is not tampering: rebuild from the current log and retry.
+ * It is deliberately not a `KeyingVerificationError`, which callers may read
+ * as tampering, unlike an epoch outside the lineage, which no honest rebuild
+ * names.
+ */
+export declare class ContainerKeyringOverrideStaleError extends Error {
+    constructor();
+}
+/**
+ * A rebuilt keyring override is sealed forward under this device's signature,
+ * so it must name exactly the epochs the container's signed lineage commits to
+ * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
+ * verification walked it, wherever the projection served it: the target KEK's
+ * own served history is not enough, since a server can serve the target's
+ * older manifests under its parent's KEK, letting an invented id over
+ * server-chosen material take the real epoch's ordinal.
+ */
+export declare function assertOverrideMatchesSignedLineage(entries: readonly ContainerKekKeyringEntry[], signedEpochIds: ReadonlySet<string>): void;

package/workflows/containers/child/keyringOverrideLineage.js

@@ -0,0 +1,39 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+const LABEL = "Container rekey keyring override";
+/**
+ * A rebuilt keyring override that omits an epoch the container's signed
+ * lineage names. That is what a rebuild made before a concurrent rotation
+ * looks like, so it is not tampering: rebuild from the current log and retry.
+ * It is deliberately not a `KeyingVerificationError`, which callers may read
+ * as tampering, unlike an epoch outside the lineage, which no honest rebuild
+ * names.
+ */
+export class ContainerKeyringOverrideStaleError extends Error {
+    constructor() {
+        super(`${LABEL} omits an epoch the container's signed lineage names; rebuild it from the current log`);
+        this.name = "ContainerKeyringOverrideStaleError";
+    }
+}
+/**
+ * A rebuilt keyring override is sealed forward under this device's signature,
+ * so it must name exactly the epochs the container's signed lineage commits to
+ * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
+ * verification walked it, wherever the projection served it: the target KEK's
+ * own served history is not enough, since a server can serve the target's
+ * older manifests under its parent's KEK, letting an invented id over
+ * server-chosen material take the real epoch's ordinal.
+ */
+export function assertOverrideMatchesSignedLineage(entries, signedEpochIds) {
+    const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));
+    for (const epochId of entryIds) {
+        if (!signedEpochIds.has(epochId)) {
+            throw new KeyingVerificationError("object_mismatch", `${LABEL} names an epoch outside the container's signed lineage`);
+        }
+    }
+    for (const epochId of signedEpochIds) {
+        if (!entryIds.has(epochId)) {
+            throw new ContainerKeyringOverrideStaleError();
+        }
+    }
+}
+//# sourceMappingURL=keyringOverrideLineage.js.map