@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/containers/shared/heldContainerHeads.js

@@ -0,0 +1,124 @@
+import { MAX_CONTAINER_PATH_LENGTH } from "../../../internal/validators/util/index.js";
+import { readCanonicalRecord } from "../../keyingCanonicalJson.js";
+import { resolveCanonicalExecSql } from "../../sqlite/sqlSchema.js";
+// Opportunistic, process-local evidence, not a persistent cache or freshness
+// oracle. No secret keys are retained. Eviction merely limits cascade coverage.
+const heldByDatabase = new WeakMap();
+// Executor-wide limits: another organization's activity may evict evidence,
+// which only skips optional recitations and never changes durable checkpoints.
+const MAX_HEADS = 256;
+const MAX_POLICIES = 512;
+function heldContainers(execSql) {
+    const canonical = resolveCanonicalExecSql(execSql);
+    let held = heldByDatabase.get(canonical);
+    if (!held) {
+        held = { heads: new Map(), policies: new Map() };
+        heldByDatabase.set(canonical, held);
+    }
+    return held;
+}
+function boundedSet(map, key, value, max) {
+    map.delete(key);
+    map.set(key, value);
+    if (map.size > max) {
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined)
+            map.delete(oldest);
+    }
+}
+function rememberHead(execSql, head, build) {
+    const heads = heldContainers(execSql).heads;
+    const previous = heads.get(head.state.containerId);
+    if (previous && previous.state.epoch >= head.state.epoch) {
+        if (previous.bundle.manifestHash === head.manifestHash) {
+            boundedSet(heads, head.state.containerId, previous, MAX_HEADS);
+        }
+        return;
+    }
+    boundedSet(heads, head.state.containerId, structuredClone(build()), MAX_HEADS);
+}
+/** Called only after the complete projection and its durable pins validate. */
+export function rememberVerifiedContainerHeads(input) {
+    for (const policy of input.policies) {
+        if (policy.principalType === "organization" &&
+            policy.principalId !== input.organizationId) {
+            throw new Error("Held principal policy belongs to another organization");
+        }
+    }
+    // Group signed states contain no organization ID. Their scope is supplied
+    // by the already-verified projection/policy caller, not inferred here.
+    for (const head of input.heads) {
+        if (head.state.organizationId !== input.organizationId) {
+            throw new Error("Held container head belongs to another organization");
+        }
+    }
+    for (const head of input.heads) {
+        rememberHead(input.execSql, head, () => ({
+            state: head.state,
+            bundle: {
+                event: readCanonicalRecord(head.event, "Verified container event"),
+                manifest: readCanonicalRecord(head.manifest, "Verified container manifest"),
+                manifestHash: head.manifestHash,
+                state: readCanonicalRecord(head.state, "Verified container state"),
+            },
+        }));
+    }
+    const policies = heldContainers(input.execSql).policies;
+    for (const policy of input.policies) {
+        const key = `${input.organizationId}:${policy.principalType}:${policy.principalId}`;
+        const previous = policies.get(key);
+        if (previous && previous.policy.version > policy.version)
+            continue;
+        if (previous?.policy.version === policy.version &&
+            previous.policy.stateHash !== policy.stateHash)
+            continue;
+        boundedSet(policies, key, { organizationId: input.organizationId, policy: structuredClone(policy) }, MAX_POLICIES);
+    }
+}
+/** Caller must first correlate the exact response and durably acknowledge it. */
+export function rememberAcknowledgedContainerHead(execSql, plan) {
+    const head = {
+        state: plan.state,
+        bundle: {
+            event: readCanonicalRecord({
+                event: plan.event,
+                eventHash: plan.eventHash,
+                body: plan.body,
+            }, "Acknowledged container event"),
+            manifest: readCanonicalRecord(plan.manifest, "Acknowledged container manifest"),
+            manifestHash: plan.manifestHash,
+            state: readCanonicalRecord(plan.state, "Acknowledged container state"),
+        },
+    };
+    rememberHead(execSql, plan, () => head);
+    return head;
+}
+export function heldContainerSnapshot(execSql, organizationId) {
+    const held = heldContainers(execSql);
+    return {
+        heads: new Map([...held.heads]
+            .filter(([, head]) => head.state.organizationId === organizationId)
+            .map(([id, head]) => [id, structuredClone(head)])),
+        policies: [...held.policies.values()]
+            .filter((entry) => entry.organizationId === organizationId)
+            .map((entry) => structuredClone(entry.policy)),
+    };
+}
+/** Resolve parent edges only; parentManifestHash is historical keying evidence. */
+export function heldContainerPath(heads, containerId) {
+    const path = [];
+    const seen = new Set();
+    let id = containerId;
+    while (id !== null) {
+        if (seen.has(id) || path.length >= MAX_CONTAINER_PATH_LENGTH)
+            return null;
+        seen.add(id);
+        const head = heads.get(id);
+        if (!head)
+            return null;
+        path.unshift(head);
+        id = head.state.parentContainerId;
+    }
+    return path;
+}
+//# sourceMappingURL=heldContainerHeads.js.map

package/data/containers/shared/heldContainerHeads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heldContainerHeads.js","sourceRoot":"","sources":["heldContainerHeads.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAgB,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAmB/E,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,cAAc,GAAG,IAAI,OAAO,EAA2B,CAAC;AAC9D,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACjD,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAmB,EACnB,GAAW,EACX,KAAQ,EACR,GAAW;IAEX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAgB,EAChB,IAAqE,EACrE,KAA8B;IAE9B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;IACT,CAAC;IACD,UAAU,CACR,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,WAAW,EACtB,eAAe,CAAC,KAAK,EAAE,CAAC,EACxB,SAAS,CACV,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,IACE,MAAM,CAAC,aAAa,KAAK,cAAc;YACvC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC3C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE;gBACN,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC;gBAClE,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,6BAA6B,CAC9B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC;aACnE;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YAAE,SAAS;QACnE,IACE,QAAQ,EAAE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAC3C,QAAQ,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAE9C,SAAS;QACX,UAAU,CACR,QAAQ,EACR,GAAG,EACH,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EACzE,YAAY,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,OAAgB,EAChB,IAGC;IAED,MAAM,IAAI,GAAsB;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE;YACN,KAAK,EAAE,mBAAmB,CACxB;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,EACD,8BAA8B,CAC/B;YACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,iCAAiC,CAClC;YACD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,8BAA8B,CAAC;SACvE;KACF,CAAC;IACF,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,cAAsB;IAEtB,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,IAAI,GAAG,CACZ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC;aAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,CAAU,CAAC,CAC7D;QACD,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC;aAC1D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,KAA6C,EAC7C,WAAmB;IAEnB,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,EAAE,GAAkB,WAAW,CAAC;IACpC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,yBAAyB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWire } from \"@tearleads/validators/request\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { readCanonicalRecord } from \"../../keyingCanonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport { type ExecSql, resolveCanonicalExecSql } from \"../../sqlite/sqlSchema\";\nimport type { AuthoredContainerMutationHead } from \"./mutationAcknowledgement\";\n\nexport interface HeldContainerHead {\n  readonly bundle: AccessManifestBundleWire;\n  readonly state: ContainerAccessManifestState;\n}\n\ninterface HeldContainers {\n  readonly heads: Map<string, HeldContainerHead>;\n  readonly policies: Map<\n    string,\n    {\n      readonly organizationId: string;\n      readonly policy: PrincipalPolicyCheckpointEvidence;\n    }\n  >;\n}\n\n// Opportunistic, process-local evidence, not a persistent cache or freshness\n// oracle. No secret keys are retained. Eviction merely limits cascade coverage.\nconst heldByDatabase = new WeakMap<ExecSql, HeldContainers>();\n// Executor-wide limits: another organization's activity may evict evidence,\n// which only skips optional recitations and never changes durable checkpoints.\nconst MAX_HEADS = 256;\nconst MAX_POLICIES = 512;\n\nfunction heldContainers(execSql: ExecSql): HeldContainers {\n  const canonical = resolveCanonicalExecSql(execSql);\n  let held = heldByDatabase.get(canonical);\n  if (!held) {\n    held = { heads: new Map(), policies: new Map() };\n    heldByDatabase.set(canonical, held);\n  }\n  return held;\n}\n\nfunction boundedSet<T>(\n  map: Map<string, T>,\n  key: string,\n  value: T,\n  max: number,\n) {\n  map.delete(key);\n  map.set(key, value);\n  if (map.size > max) {\n    const oldest = map.keys().next().value;\n    if (oldest !== undefined) map.delete(oldest);\n  }\n}\n\nfunction rememberHead(\n  execSql: ExecSql,\n  head: Pick<VerifiedContainerAccessManifest, \"state\" | \"manifestHash\">,\n  build: () => HeldContainerHead,\n): void {\n  const heads = heldContainers(execSql).heads;\n  const previous = heads.get(head.state.containerId);\n  if (previous && previous.state.epoch >= head.state.epoch) {\n    if (previous.bundle.manifestHash === head.manifestHash) {\n      boundedSet(heads, head.state.containerId, previous, MAX_HEADS);\n    }\n    return;\n  }\n  boundedSet(\n    heads,\n    head.state.containerId,\n    structuredClone(build()),\n    MAX_HEADS,\n  );\n}\n\n/** Called only after the complete projection and its durable pins validate. */\nexport function rememberVerifiedContainerHeads(input: {\n  readonly organizationId: string;\n  readonly execSql: ExecSql;\n  readonly heads: readonly VerifiedContainerAccessManifest[];\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}): void {\n  for (const policy of input.policies) {\n    if (\n      policy.principalType === \"organization\" &&\n      policy.principalId !== input.organizationId\n    ) {\n      throw new Error(\"Held principal policy belongs to another organization\");\n    }\n  }\n  // Group signed states contain no organization ID. Their scope is supplied\n  // by the already-verified projection/policy caller, not inferred here.\n  for (const head of input.heads) {\n    if (head.state.organizationId !== input.organizationId) {\n      throw new Error(\"Held container head belongs to another organization\");\n    }\n  }\n  for (const head of input.heads) {\n    rememberHead(input.execSql, head, () => ({\n      state: head.state,\n      bundle: {\n        event: readCanonicalRecord(head.event, \"Verified container event\"),\n        manifest: readCanonicalRecord(\n          head.manifest,\n          \"Verified container manifest\",\n        ),\n        manifestHash: head.manifestHash,\n        state: readCanonicalRecord(head.state, \"Verified container state\"),\n      },\n    }));\n  }\n  const policies = heldContainers(input.execSql).policies;\n  for (const policy of input.policies) {\n    const key = `${input.organizationId}:${policy.principalType}:${policy.principalId}`;\n    const previous = policies.get(key);\n    if (previous && previous.policy.version > policy.version) continue;\n    if (\n      previous?.policy.version === policy.version &&\n      previous.policy.stateHash !== policy.stateHash\n    )\n      continue;\n    boundedSet(\n      policies,\n      key,\n      { organizationId: input.organizationId, policy: structuredClone(policy) },\n      MAX_POLICIES,\n    );\n  }\n}\n\n/** Caller must first correlate the exact response and durably acknowledge it. */\nexport function rememberAcknowledgedContainerHead(\n  execSql: ExecSql,\n  plan: Pick<\n    AuthoredContainerMutationHead,\n    \"body\" | \"event\" | \"eventHash\" | \"manifest\" | \"manifestHash\" | \"state\"\n  >,\n): HeldContainerHead {\n  const head: HeldContainerHead = {\n    state: plan.state,\n    bundle: {\n      event: readCanonicalRecord(\n        {\n          event: plan.event,\n          eventHash: plan.eventHash,\n          body: plan.body,\n        },\n        \"Acknowledged container event\",\n      ),\n      manifest: readCanonicalRecord(\n        plan.manifest,\n        \"Acknowledged container manifest\",\n      ),\n      manifestHash: plan.manifestHash,\n      state: readCanonicalRecord(plan.state, \"Acknowledged container state\"),\n    },\n  };\n  rememberHead(execSql, plan, () => head);\n  return head;\n}\n\nexport function heldContainerSnapshot(\n  execSql: ExecSql,\n  organizationId: string,\n) {\n  const held = heldContainers(execSql);\n  return {\n    heads: new Map(\n      [...held.heads]\n        .filter(([, head]) => head.state.organizationId === organizationId)\n        .map(([id, head]) => [id, structuredClone(head)] as const),\n    ),\n    policies: [...held.policies.values()]\n      .filter((entry) => entry.organizationId === organizationId)\n      .map((entry) => structuredClone(entry.policy)),\n  };\n}\n\n/** Resolve parent edges only; parentManifestHash is historical keying evidence. */\nexport function heldContainerPath(\n  heads: ReadonlyMap<string, HeldContainerHead>,\n  containerId: string,\n): HeldContainerHead[] | null {\n  const path: HeldContainerHead[] = [];\n  const seen = new Set<string>();\n  let id: string | null = containerId;\n  while (id !== null) {\n    if (seen.has(id) || path.length >= MAX_CONTAINER_PATH_LENGTH) return null;\n    seen.add(id);\n    const head = heads.get(id);\n    if (!head) return null;\n    path.unshift(head);\n    id = head.state.parentContainerId;\n  }\n  return path;\n}\n"]}

package/data/containers/shared/mutationAcknowledgement.js

@@ -0,0 +1,187 @@
+import { accessManifestCheckpointFromManifest, compareCanonicalStrings, computeContainerKekKeyringHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../keyingCanonicalJson.js";
+import { advanceLocallyAcknowledgedAccessManifestHeadsAtomically, } from "../../persistence/locallyAcknowledgedCheckpointPersistence.js";
+function assertCanonicalMatch(input) {
+    if (canonicalKeyingJsonString(input.actual, `${input.label} response`) !==
+        canonicalKeyingJsonString(input.expected, `${input.label} plan`)) {
+        throw new Error(`Container mutation response ${input.label} mismatch`);
+    }
+}
+function sortedCanonicalValues(values, label) {
+    return [...values].sort((left, right) => compareCanonicalStrings(canonicalKeyingJsonString(left, label), canonicalKeyingJsonString(right, label)));
+}
+function expectedRecipientTargets(wraps) {
+    return sortedCanonicalValues(wraps.map((wrap) => ({
+        recipientId: wrap.recipientId,
+        recipientKeyEpochId: wrap.recipientKeyEpochId,
+        recipientKeyFingerprint: wrap.recipientKeyFingerprint,
+        recipientKind: wrap.recipientKind,
+    })), "recipient target");
+}
+function assertResponseIdentity(plan, response) {
+    if (response.containerId !== plan.containerId ||
+        response.organizationId !== plan.state.organizationId ||
+        response.parentId !== plan.state.parentContainerId) {
+        throw new Error("Container mutation response object identity mismatch");
+    }
+    // The top-level slot column is what local system-container lookups key on,
+    // so it must echo the slot this client signed into the manifest state; an
+    // omitted slot is the server's spelling of null.
+    if ((response.systemSlot ?? null) !== plan.state.systemSlot) {
+        throw new Error("Container mutation response system slot mismatch");
+    }
+    if (response.manifestHead.epoch !== plan.state.epoch ||
+        response.manifestHead.manifestHash !== plan.manifestHash ||
+        response.accessManifest.manifestHash !== plan.manifestHash) {
+        throw new Error("Container mutation response manifest head mismatch");
+    }
+    if (response.containerKek.containerId !== plan.containerId ||
+        response.containerKek.accessManifestHash !== plan.manifestHash ||
+        response.containerKek.containerKeyEpochId !== plan.keyEpoch.id ||
+        response.containerKek.containerKeyEpoch !== plan.keyEpoch.keyEpoch) {
+        throw new Error("Container mutation response KEK identity mismatch");
+    }
+}
+/** A rotation body commits a keyring hash; other bodies do not. */
+function readOptionalKeyringHash(body) {
+    const value = Reflect.get(body, "keyringHash");
+    return typeof value === "string" ? value : null;
+}
+/**
+ * The response's keyring must be the one this client's own signed event
+ * committed to. Without this a server could echo a substituted snapshot and
+ * have it acknowledged into durable local state — the acknowledgement is the
+ * moment the response becomes trusted, so the commitment is checked here.
+ */
+async function assertAcknowledgedKeyring(plan, response) {
+    const committedHash = readOptionalKeyringHash(plan.body);
+    const keyring = response.containerKek.keyring;
+    if (committedHash === null) {
+        // A non-rotating mutation keeps its epoch, so the echoed keyring must be
+        // the immutable artifact that epoch already had. Accepting anything else
+        // would let a server null or substitute the snapshot in the response that
+        // becomes the next writer projection.
+        const expected = plan.previousKeyring ?? null;
+        if (expected === null) {
+            // The epoch had no keyring, so the response must not invent one: an
+            // injected snapshot would become the next writer projection's history.
+            if (keyring) {
+                throw new Error("Container mutation response added a keyring to an unchanged epoch");
+            }
+            return;
+        }
+        if (!keyring) {
+            throw new Error("Container mutation response dropped its unchanged keyring");
+        }
+        if ((await computeContainerKekKeyringHash(keyring)) !==
+            (await computeContainerKekKeyringHash(expected))) {
+            throw new Error("Container mutation response replaced its unchanged keyring");
+        }
+        return;
+    }
+    if (!keyring) {
+        throw new Error("Container mutation response is missing its keyring");
+    }
+    if ((await computeContainerKekKeyringHash(keyring)) !== committedHash) {
+        throw new Error("Container mutation response keyring does not match its signed event");
+    }
+}
+async function assertResponseContent(plan, response) {
+    assertCanonicalMatch({
+        actual: response.accessManifest.event.event,
+        expected: plan.event,
+        label: "event",
+    });
+    assertCanonicalMatch({
+        actual: response.accessManifest.event.body,
+        expected: plan.body,
+        label: "event body",
+    });
+    if (response.accessManifest.event.eventHash !== plan.eventHash) {
+        throw new Error("Container mutation response event hash mismatch");
+    }
+    assertCanonicalMatch({
+        actual: response.accessManifest.manifest,
+        expected: plan.manifest,
+        label: "manifest",
+    });
+    assertCanonicalMatch({
+        actual: response.accessManifest.state,
+        expected: plan.state,
+        label: "state",
+    });
+    assertCanonicalMatch({
+        actual: response.containerKek.keyEpoch,
+        expected: plan.keyEpoch,
+        label: "key epoch",
+    });
+    await assertAcknowledgedKeyring(plan, response);
+    assertCanonicalMatch({
+        actual: sortedCanonicalValues(response.containerKek.wraps, "response wrap"),
+        expected: sortedCanonicalValues(plan.wraps, "planned wrap"),
+        label: "wraps",
+    });
+    const recipientTargets = expectedRecipientTargets(plan.wraps);
+    const responseTargets = sortedCanonicalValues(response.containerKek.recipientTargets, "response recipient target");
+    assertCanonicalMatch({
+        actual: responseTargets,
+        expected: recipientTargets,
+        label: "recipient targets",
+    });
+    if (response.containerKek.keyEpochHash !==
+        (await computeContainerKeyEpochHash(plan.keyEpoch)) ||
+        response.containerKek.keyTargetHash !==
+            (await computeContainerKekRecipientTargetHash(recipientTargets)) ||
+        response.containerKek.parentContainerKeyEpochId !==
+            plan.keyEpoch.parentContainerKeyEpochId) {
+        throw new Error("Container mutation response KEK commitment mismatch");
+    }
+    assertCanonicalMatch({
+        actual: response.referencedPrincipalHeads,
+        expected: plan.manifest.referencedPrincipalHeads,
+        label: "referenced principal heads",
+    });
+}
+export async function locallyAcknowledgedContainerMutationHead(input) {
+    assertResponseIdentity(input.plan, input.response);
+    await assertResponseContent(input.plan, input.response);
+    return {
+        checkpoint: accessManifestCheckpointFromManifest({
+            manifest: input.plan.manifest,
+            manifestHash: input.plan.manifestHash,
+        }),
+        previousManifestHash: input.plan.manifest.previousManifestHash,
+    };
+}
+/** Correlates an API acknowledgement to the locally signed plan before pinning. */
+export async function acknowledgeContainerMutation(input) {
+    return advanceLocallyAcknowledgedAccessManifestHeadsAtomically({
+        execSql: input.execSql,
+        heads: [
+            await locallyAcknowledgedContainerMutationHead({
+                plan: input.plan,
+                response: input.response,
+            }),
+        ],
+        stillCurrent: input.stillCurrent,
+    });
+}
+/** Correlates and advances a complete authored mutation batch atomically. */
+export async function acknowledgeContainerMutationBatch(input) {
+    if (input.plans.length !== input.responses.length) {
+        throw new Error("Container mutation acknowledgement batch is incomplete");
+    }
+    const heads = await Promise.all(input.plans.map(async (plan, index) => {
+        const response = input.responses[index];
+        if (!response) {
+            throw new Error("Container mutation acknowledgement batch is incomplete");
+        }
+        return locallyAcknowledgedContainerMutationHead({ plan, response });
+    }));
+    return advanceLocallyAcknowledgedAccessManifestHeadsAtomically({
+        execSql: input.execSql,
+        heads,
+        stillCurrent: input.stillCurrent,
+    });
+}
+//# sourceMappingURL=mutationAcknowledgement.js.map

package/data/containers/shared/mutationAcknowledgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutationAcknowledgement.js","sourceRoot":"","sources":["mutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oCAAoC,EAKpC,uBAAuB,EACvB,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,uDAAuD,GAExD,MAAM,4DAA4D,CAAC;AAoBpE,SAAS,oBAAoB,CAAC,KAI7B;IACC,IACE,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,WAAW,CAAC;QAClE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,OAAO,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,KAAK,WAAW,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAI,MAAoB,EAAE,KAAa;IACnE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,uBAAuB,CACrB,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,EACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAkC;IAElC,OAAO,qBAAqB,CAC1B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC,EACH,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAmC,EACnC,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACzC,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IACE,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IACE,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtD,QAAQ,CAAC,YAAY,CAAC,kBAAkB,KAAK,IAAI,CAAC,YAAY;QAC9D,QAAQ,CAAC,YAAY,CAAC,mBAAmB,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC9D,QAAQ,CAAC,YAAY,CAAC,iBAAiB,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAAmC,EACnC,QAAmC;IAEnC,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;IAC9C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;QAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,oEAAoE;YACpE,uEAAuE;YACvE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC,MAAM,8BAA8B,CAAC,QAAQ,CAAC,CAAC,EAChD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAmC,EACnC,QAAmC;IAEnC,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK;QAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;QAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,KAAK,EAAE,YAAY;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ;QACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK;QACrC,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,oBAAoB,CAAC;QACnB,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3E,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC;QAC3D,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,qBAAqB,CAC3C,QAAQ,CAAC,YAAY,CAAC,gBAAgB,EACtC,2BAA2B,CAC5B,CAAC;IACF,oBAAoB,CAAC;QACnB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,mBAAmB;KAC3B,CAAC,CAAC;IACH,IACE,QAAQ,CAAC,YAAY,CAAC,YAAY;QAChC,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,aAAa;YACjC,CAAC,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;QAClE,QAAQ,CAAC,YAAY,CAAC,yBAAyB;YAC7C,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,oBAAoB,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,wBAAwB;QACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,wBAAwB;QAChD,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAG9D;IACC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO;QACL,UAAU,EAAE,oCAAoC,CAAC;YAC/C,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;SACtC,CAAC;QACF,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KAC/D,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,OAAO,uDAAuD,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE;YACL,MAAM,wCAAwC,CAAC;gBAC7C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;SACH;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAKvD;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,wCAAwC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,uDAAuD,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  accessManifestCheckpointFromManifest,\n  type ContainerAccessManifestState,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  compareCanonicalStrings,\n  computeContainerKekKeyringHash,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../keyingCanonicalJson\";\nimport {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  type LocallyAcknowledgedAccessManifestHead,\n} from \"../../persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\nexport interface AuthoredContainerMutationHead {\n  readonly body: object;\n  readonly containerId: string;\n  readonly event: AccessEvent;\n  readonly eventHash: string;\n  readonly keyEpoch: ContainerKeyEpoch;\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n  /**\n   * The keyring the epoch already had, for mutations that keep their epoch.\n   * Its artifact is immutable, so the response must echo exactly this.\n   */\n  readonly previousKeyring?: Record<string, unknown> | null | undefined;\n  readonly state: ContainerAccessManifestState;\n  readonly wraps: readonly ContainerKeyWrap[];\n}\n\nfunction assertCanonicalMatch(input: {\n  readonly actual: unknown;\n  readonly expected: unknown;\n  readonly label: string;\n}): void {\n  if (\n    canonicalKeyingJsonString(input.actual, `${input.label} response`) !==\n    canonicalKeyingJsonString(input.expected, `${input.label} plan`)\n  ) {\n    throw new Error(`Container mutation response ${input.label} mismatch`);\n  }\n}\n\nfunction sortedCanonicalValues<T>(values: readonly T[], label: string): T[] {\n  return [...values].sort((left, right) =>\n    compareCanonicalStrings(\n      canonicalKeyingJsonString(left, label),\n      canonicalKeyingJsonString(right, label),\n    ),\n  );\n}\n\nfunction expectedRecipientTargets(\n  wraps: readonly ContainerKeyWrap[],\n): ContainerKekRecipientTarget[] {\n  return sortedCanonicalValues(\n    wraps.map((wrap) => ({\n      recipientId: wrap.recipientId,\n      recipientKeyEpochId: wrap.recipientKeyEpochId,\n      recipientKeyFingerprint: wrap.recipientKeyFingerprint,\n      recipientKind: wrap.recipientKind,\n    })),\n    \"recipient target\",\n  );\n}\n\nfunction assertResponseIdentity(\n  plan: AuthoredContainerMutationHead,\n  response: ContainerMutationResponse,\n): void {\n  if (\n    response.containerId !== plan.containerId ||\n    response.organizationId !== plan.state.organizationId ||\n    response.parentId !== plan.state.parentContainerId\n  ) {\n    throw new Error(\"Container mutation response object identity mismatch\");\n  }\n  // The top-level slot column is what local system-container lookups key on,\n  // so it must echo the slot this client signed into the manifest state; an\n  // omitted slot is the server's spelling of null.\n  if ((response.systemSlot ?? null) !== plan.state.systemSlot) {\n    throw new Error(\"Container mutation response system slot mismatch\");\n  }\n  if (\n    response.manifestHead.epoch !== plan.state.epoch ||\n    response.manifestHead.manifestHash !== plan.manifestHash ||\n    response.accessManifest.manifestHash !== plan.manifestHash\n  ) {\n    throw new Error(\"Container mutation response manifest head mismatch\");\n  }\n  if (\n    response.containerKek.containerId !== plan.containerId ||\n    response.containerKek.accessManifestHash !== plan.manifestHash ||\n    response.containerKek.containerKeyEpochId !== plan.keyEpoch.id ||\n    response.containerKek.containerKeyEpoch !== plan.keyEpoch.keyEpoch\n  ) {\n    throw new Error(\"Container mutation response KEK identity mismatch\");\n  }\n}\n\n/** A rotation body commits a keyring hash; other bodies do not. */\nfunction readOptionalKeyringHash(body: object): string | null {\n  const value = Reflect.get(body, \"keyringHash\");\n  return typeof value === \"string\" ? value : null;\n}\n\n/**\n * The response's keyring must be the one this client's own signed event\n * committed to. Without this a server could echo a substituted snapshot and\n * have it acknowledged into durable local state — the acknowledgement is the\n * moment the response becomes trusted, so the commitment is checked here.\n */\nasync function assertAcknowledgedKeyring(\n  plan: AuthoredContainerMutationHead,\n  response: ContainerMutationResponse,\n): Promise<void> {\n  const committedHash = readOptionalKeyringHash(plan.body);\n  const keyring = response.containerKek.keyring;\n  if (committedHash === null) {\n    // A non-rotating mutation keeps its epoch, so the echoed keyring must be\n    // the immutable artifact that epoch already had. Accepting anything else\n    // would let a server null or substitute the snapshot in the response that\n    // becomes the next writer projection.\n    const expected = plan.previousKeyring ?? null;\n    if (expected === null) {\n      // The epoch had no keyring, so the response must not invent one: an\n      // injected snapshot would become the next writer projection's history.\n      if (keyring) {\n        throw new Error(\n          \"Container mutation response added a keyring to an unchanged epoch\",\n        );\n      }\n      return;\n    }\n    if (!keyring) {\n      throw new Error(\n        \"Container mutation response dropped its unchanged keyring\",\n      );\n    }\n    if (\n      (await computeContainerKekKeyringHash(keyring)) !==\n      (await computeContainerKekKeyringHash(expected))\n    ) {\n      throw new Error(\n        \"Container mutation response replaced its unchanged keyring\",\n      );\n    }\n    return;\n  }\n  if (!keyring) {\n    throw new Error(\"Container mutation response is missing its keyring\");\n  }\n  if ((await computeContainerKekKeyringHash(keyring)) !== committedHash) {\n    throw new Error(\n      \"Container mutation response keyring does not match its signed event\",\n    );\n  }\n}\n\nasync function assertResponseContent(\n  plan: AuthoredContainerMutationHead,\n  response: ContainerMutationResponse,\n): Promise<void> {\n  assertCanonicalMatch({\n    actual: response.accessManifest.event.event,\n    expected: plan.event,\n    label: \"event\",\n  });\n  assertCanonicalMatch({\n    actual: response.accessManifest.event.body,\n    expected: plan.body,\n    label: \"event body\",\n  });\n  if (response.accessManifest.event.eventHash !== plan.eventHash) {\n    throw new Error(\"Container mutation response event hash mismatch\");\n  }\n  assertCanonicalMatch({\n    actual: response.accessManifest.manifest,\n    expected: plan.manifest,\n    label: \"manifest\",\n  });\n  assertCanonicalMatch({\n    actual: response.accessManifest.state,\n    expected: plan.state,\n    label: \"state\",\n  });\n  assertCanonicalMatch({\n    actual: response.containerKek.keyEpoch,\n    expected: plan.keyEpoch,\n    label: \"key epoch\",\n  });\n  await assertAcknowledgedKeyring(plan, response);\n  assertCanonicalMatch({\n    actual: sortedCanonicalValues(response.containerKek.wraps, \"response wrap\"),\n    expected: sortedCanonicalValues(plan.wraps, \"planned wrap\"),\n    label: \"wraps\",\n  });\n  const recipientTargets = expectedRecipientTargets(plan.wraps);\n  const responseTargets = sortedCanonicalValues(\n    response.containerKek.recipientTargets,\n    \"response recipient target\",\n  );\n  assertCanonicalMatch({\n    actual: responseTargets,\n    expected: recipientTargets,\n    label: \"recipient targets\",\n  });\n  if (\n    response.containerKek.keyEpochHash !==\n      (await computeContainerKeyEpochHash(plan.keyEpoch)) ||\n    response.containerKek.keyTargetHash !==\n      (await computeContainerKekRecipientTargetHash(recipientTargets)) ||\n    response.containerKek.parentContainerKeyEpochId !==\n      plan.keyEpoch.parentContainerKeyEpochId\n  ) {\n    throw new Error(\"Container mutation response KEK commitment mismatch\");\n  }\n  assertCanonicalMatch({\n    actual: response.referencedPrincipalHeads,\n    expected: plan.manifest.referencedPrincipalHeads,\n    label: \"referenced principal heads\",\n  });\n}\n\nexport async function locallyAcknowledgedContainerMutationHead(input: {\n  readonly plan: AuthoredContainerMutationHead;\n  readonly response: ContainerMutationResponse;\n}): Promise<LocallyAcknowledgedAccessManifestHead> {\n  assertResponseIdentity(input.plan, input.response);\n  await assertResponseContent(input.plan, input.response);\n  return {\n    checkpoint: accessManifestCheckpointFromManifest({\n      manifest: input.plan.manifest,\n      manifestHash: input.plan.manifestHash,\n    }),\n    previousManifestHash: input.plan.manifest.previousManifestHash,\n  };\n}\n\n/** Correlates an API acknowledgement to the locally signed plan before pinning. */\nexport async function acknowledgeContainerMutation(input: {\n  readonly execSql: ExecSql;\n  readonly plan: AuthoredContainerMutationHead;\n  readonly response: ContainerMutationResponse;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  return advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [\n      await locallyAcknowledgedContainerMutationHead({\n        plan: input.plan,\n        response: input.response,\n      }),\n    ],\n    stillCurrent: input.stillCurrent,\n  });\n}\n\n/** Correlates and advances a complete authored mutation batch atomically. */\nexport async function acknowledgeContainerMutationBatch(input: {\n  readonly execSql: ExecSql;\n  readonly plans: readonly AuthoredContainerMutationHead[];\n  readonly responses: readonly ContainerMutationResponse[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  if (input.plans.length !== input.responses.length) {\n    throw new Error(\"Container mutation acknowledgement batch is incomplete\");\n  }\n  const heads = await Promise.all(\n    input.plans.map(async (plan, index) => {\n      const response = input.responses[index];\n      if (!response) {\n        throw new Error(\n          \"Container mutation acknowledgement batch is incomplete\",\n        );\n      }\n      return locallyAcknowledgedContainerMutationHead({ plan, response });\n    }),\n  );\n  return advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/containers/shared/mutationFailures.js

@@ -0,0 +1,51 @@
+import { CONTAINER_MUTATION_ERROR_CODES, CONTAINER_NOT_FOUND_ERROR_CODE, CONTAINER_UNAVAILABLE_ERROR_CODE, DOCUMENT_SYNC_ERROR_CODES, } from "../../../internal/validators/response/index.js";
+export function isContainerNotFoundFailure(failure) {
+    return (failure.status === 404 && failure.code === CONTAINER_NOT_FOUND_ERROR_CODE);
+}
+/**
+ * A mutation cited a container path element whose live row is gone: the
+ * server retained its manifest head (so the reference resolved) but the
+ * container was deleted before the commit. Container ids are immutable, so
+ * this never heals by retrying the same request.
+ */
+function isContainerUnavailableFailure(failure) {
+    return (failure.status === 409 && failure.code === CONTAINER_UNAVAILABLE_ERROR_CODE);
+}
+/**
+ * Both server-verified proofs that a cited container no longer exists: the
+ * coded projection 404 (fetched before the mutation) and the coded commit 409
+ * (the container vanished between fetch and commit). Uncoded 404s and 409s
+ * are excluded on purpose — they may be transient.
+ */
+export function isVanishedContainerFailure(failure) {
+    return (isContainerNotFoundFailure(failure) ||
+        isContainerUnavailableFailure(failure));
+}
+/**
+ * The server refused a create or move for exceeding the readable path length.
+ * Final: resubmitting the same request never succeeds.
+ */
+export function isContainerPathTooDeepFailure(failure) {
+    return (failure.status === 409 &&
+        failure.code === CONTAINER_MUTATION_ERROR_CODES.pathTooDeep);
+}
+export function isStaleParentContainerPathFailure(failure) {
+    return (failure.status === 409 &&
+        (failure.code === CONTAINER_MUTATION_ERROR_CODES.stateStale ||
+            failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale));
+}
+/**
+ * A create whose response was lost re-sends the same stable container id; the
+ * server then reports that the container manifest already exists. That proves
+ * the first attempt committed, so the caller can await remote hydration.
+ *
+ * A metadata-document conflict is deliberately excluded. The compound server
+ * transaction can create the container and then roll everything back when the
+ * metadata document already exists, so that code alone does not prove the
+ * container exists remotely.
+ */
+export function isContainerManifestAlreadyExistsConflict(failure) {
+    return (failure.status === 409 &&
+        failure.code === CONTAINER_MUTATION_ERROR_CODES.manifestAlreadyExists);
+}
+//# sourceMappingURL=mutationFailures.js.map

package/data/containers/shared/mutationFailures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutationFailures.js","sourceRoot":"","sources":["mutationFailures.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAQxC,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,8BAA8B,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CACpC,OAAiC;IAEjC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,gCAAgC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,OAAO,CACL,0BAA0B,CAAC,OAAO,CAAC;QACnC,6BAA6B,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAiC;IAEjC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,8BAA8B,CAAC,WAAW,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAuC;IAEvC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,CAAC,OAAO,CAAC,IAAI,KAAK,8BAA8B,CAAC,UAAU;YACzD,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,UAAU,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wCAAwC,CACtD,OAAuC;IAEvC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,8BAA8B,CAAC,qBAAqB,CACtE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTAINER_MUTATION_ERROR_CODES,\n  CONTAINER_NOT_FOUND_ERROR_CODE,\n  CONTAINER_UNAVAILABLE_ERROR_CODE,\n  DOCUMENT_SYNC_ERROR_CODES,\n} from \"@tearleads/validators/response\";\nimport type { ContainerMutationSubmitFailure } from \"./types\";\n\ninterface ContainerBehaviorFailure {\n  readonly code?: string | undefined;\n  readonly status: number | null;\n}\n\nexport function isContainerNotFoundFailure(\n  failure: ContainerBehaviorFailure,\n): boolean {\n  return (\n    failure.status === 404 && failure.code === CONTAINER_NOT_FOUND_ERROR_CODE\n  );\n}\n\n/**\n * A mutation cited a container path element whose live row is gone: the\n * server retained its manifest head (so the reference resolved) but the\n * container was deleted before the commit. Container ids are immutable, so\n * this never heals by retrying the same request.\n */\nfunction isContainerUnavailableFailure(\n  failure: ContainerBehaviorFailure,\n): boolean {\n  return (\n    failure.status === 409 && failure.code === CONTAINER_UNAVAILABLE_ERROR_CODE\n  );\n}\n\n/**\n * Both server-verified proofs that a cited container no longer exists: the\n * coded projection 404 (fetched before the mutation) and the coded commit 409\n * (the container vanished between fetch and commit). Uncoded 404s and 409s\n * are excluded on purpose — they may be transient.\n */\nexport function isVanishedContainerFailure(\n  failure: ContainerBehaviorFailure,\n): boolean {\n  return (\n    isContainerNotFoundFailure(failure) ||\n    isContainerUnavailableFailure(failure)\n  );\n}\n\n/**\n * The server refused a create or move for exceeding the readable path length.\n * Final: resubmitting the same request never succeeds.\n */\nexport function isContainerPathTooDeepFailure(\n  failure: ContainerBehaviorFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === CONTAINER_MUTATION_ERROR_CODES.pathTooDeep\n  );\n}\n\nexport function isStaleParentContainerPathFailure(\n  failure: ContainerMutationSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    (failure.code === CONTAINER_MUTATION_ERROR_CODES.stateStale ||\n      failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale)\n  );\n}\n\n/**\n * A create whose response was lost re-sends the same stable container id; the\n * server then reports that the container manifest already exists. That proves\n * the first attempt committed, so the caller can await remote hydration.\n *\n * A metadata-document conflict is deliberately excluded. The compound server\n * transaction can create the container and then roll everything back when the\n * metadata document already exists, so that code alone does not prove the\n * container exists remotely.\n */\nexport function isContainerManifestAlreadyExistsConflict(\n  failure: ContainerMutationSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === CONTAINER_MUTATION_ERROR_CODES.manifestAlreadyExists\n  );\n}\n"]}

package/data/containers/shared/mutationRequestOptions.d.ts

@@ -0,0 +1,4 @@
+export interface ContainerMutationRequestOptions {
+    readonly expectedPaymentRequiredOrganizationId?: string | undefined;
+    readonly reportErrors?: boolean | undefined;
+}

package/data/containers/shared/mutationRequestOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mutationRequestOptions.js.map

package/data/containers/shared/mutationRequestOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutationRequestOptions.js","sourceRoot":"","sources":["mutationRequestOptions.ts"],"names":[],"mappings":"","sourcesContent":["export interface ContainerMutationRequestOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n"]}

package/data/containers/shared/principalPolicies.js

@@ -0,0 +1,34 @@
+import { readCanonicalRecord } from "../../keyingCanonicalJson.js";
+export function principalPolicyRequestRecord(policy, label = "Container principal policy") {
+    return readCanonicalRecord({
+        principalType: policy.principalType,
+        principalId: policy.principalId,
+        version: policy.version,
+        keyEpoch: policy.keyEpoch,
+        stateHash: policy.stateHash,
+        state: {
+            ...policy.state,
+            stateHash: policy.stateHash,
+        },
+        projection: policy.projection,
+        grants: policy.grants,
+        checkpoint: policy.checkpoint,
+    }, label);
+}
+function principalPolicyKey(policy) {
+    return [
+        policy.principalType,
+        policy.principalId,
+        policy.version,
+        policy.keyEpoch,
+        policy.stateHash,
+    ].join(":");
+}
+export function uniquePrincipalPolicies(policies) {
+    const policiesByKey = new Map();
+    for (const policy of policies) {
+        policiesByKey.set(principalPolicyKey(policy), policy);
+    }
+    return [...policiesByKey.values()];
+}
+//# sourceMappingURL=principalPolicies.js.map

package/data/containers/shared/principalPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicies.js","sourceRoot":"","sources":["principalPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE,MAAM,UAAU,4BAA4B,CAC1C,MAAyC,EACzC,KAAK,GAAG,4BAA4B;IAEpC,OAAO,mBAAmB,CACxB;QACE,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;QACD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,EACD,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO;QACL,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,SAAS;KACjB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAErC,QAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAa,CAAC;IAE3C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport { readCanonicalRecord } from \"../../keyingCanonicalJson\";\nimport type {\n  PrincipalPolicyCheckpointEvidence,\n  PrincipalPolicyCurrentEvidence,\n} from \"../../principals/principalPolicyEvidence\";\n\nexport function principalPolicyRequestRecord(\n  policy: PrincipalPolicyCheckpointEvidence,\n  label = \"Container principal policy\",\n): Record<string, unknown> {\n  return readCanonicalRecord(\n    {\n      principalType: policy.principalType,\n      principalId: policy.principalId,\n      version: policy.version,\n      keyEpoch: policy.keyEpoch,\n      stateHash: policy.stateHash,\n      state: {\n        ...policy.state,\n        stateHash: policy.stateHash,\n      },\n      projection: policy.projection,\n      grants: policy.grants,\n      checkpoint: policy.checkpoint,\n    },\n    label,\n  );\n}\n\nfunction principalPolicyKey(\n  policy: Pick<\n    VerifiedPrincipalPolicy,\n    \"keyEpoch\" | \"principalId\" | \"principalType\" | \"stateHash\" | \"version\"\n  >,\n): string {\n  return [\n    policy.principalType,\n    policy.principalId,\n    policy.version,\n    policy.keyEpoch,\n    policy.stateHash,\n  ].join(\":\");\n}\n\nexport function uniquePrincipalPolicies<\n  T extends PrincipalPolicyCurrentEvidence,\n>(policies: readonly T[]): T[] {\n  const policiesByKey = new Map<string, T>();\n\n  for (const policy of policies) {\n    policiesByKey.set(principalPolicyKey(policy), policy);\n  }\n\n  return [...policiesByKey.values()];\n}\n"]}

package/data/containers/shared/projection.js

@@ -0,0 +1,158 @@
+import { derivePrincipalRecipientKeyEpochId, wrapDekForRecipients, } from "../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { readManifestContainerId } from "../../documents/shared/readers.js";
+import { readCanonicalManifestBundle, readContainerAccessManifestState, } from "./readers.js";
+export function uniqueSortedManifestHashes(path) {
+    return [...new Set(path.map((bundle) => bundle.manifestHash))].sort();
+}
+function getLeafContainerContext(projection, errors) {
+    if (projection.path.length !== projection.containerKeks.length) {
+        throw new Error(errors.inconsistentPath);
+    }
+    const manifest = projection.path.at(-1);
+    const kek = projection.containerKeks.at(-1);
+    if (!manifest || !kek) {
+        throw new Error(errors.emptyProjection);
+    }
+    if (readManifestContainerId(manifest) !== projection.containerId) {
+        throw new Error(errors.inconsistentTarget);
+    }
+    if (kek.containerId !== projection.containerId) {
+        throw new Error(errors.inconsistentKek);
+    }
+    if (kek.accessManifestHash !== manifest.manifestHash) {
+        throw new Error(errors.staleKek);
+    }
+    return { manifest, kek };
+}
+export function getParentCreateContext(parentProjection) {
+    return getLeafContainerContext(parentProjection, {
+        emptyProjection: "Container parent projection is empty",
+        inconsistentKek: "Container parent KEK target is inconsistent",
+        inconsistentPath: "Container parent projection path and KEKs are inconsistent",
+        inconsistentTarget: "Container parent projection target is inconsistent",
+        staleKek: "Container parent KEK is stale",
+    });
+}
+export function asContainerManifestBundle(bundle) {
+    return readCanonicalManifestBundle(bundle, "Container manifest bundle");
+}
+export function readContainerState(bundle) {
+    return readContainerAccessManifestState(bundle.state, "Container manifest state");
+}
+export function getTargetContainerContext(projection) {
+    return getLeafContainerContext(projection, {
+        emptyProjection: "Container projection is empty",
+        inconsistentKek: "Container target KEK is inconsistent",
+        inconsistentPath: "Container projection path and KEKs are inconsistent",
+        inconsistentTarget: "Container projection target is inconsistent",
+        staleKek: "Container target KEK is stale",
+    });
+}
+export function getParentKekForTarget(projection) {
+    const targetState = readContainerState(getTargetContainerContext(projection).manifest);
+    if (!targetState.parentContainerId) {
+        return null;
+    }
+    const parentKek = projection.containerKeks.at(-2);
+    if (!parentKek || parentKek.containerId !== targetState.parentContainerId) {
+        throw new Error("Container parent KEK is unavailable");
+    }
+    return parentKek;
+}
+export async function wrapContainerKeyToParent(input) {
+    const [wrapped] = await wrapDekForRecipients(input.containerKey, [
+        base64ToBytes(input.parentPublicKey),
+    ]);
+    if (!wrapped)
+        throw new Error("Container parent wrap is unavailable");
+    return {
+        containerKeyEpochId: input.containerKeyEpochId,
+        recipientKind: "container",
+        recipientId: input.parentKek.containerId,
+        recipientKeyEpochId: input.parentKek.containerKeyEpochId,
+        recipientKeyFingerprint: input.parentKek.keyEpochHash,
+        kemCipherText: bytesToBase64(wrapped.kemCipherText),
+        wrappedKey: bytesToBase64(wrapped.wrappedKey),
+        wrapManifestHash: input.manifestHash,
+    };
+}
+export async function wrapContainerKeyToRootUser(input) {
+    const [recipient] = await wrapDekForRecipients(input.containerKey, [
+        input.recipientEncapsulationPublicKey,
+    ]);
+    if (!recipient) {
+        throw new Error("Container root recipient wrap is unavailable");
+    }
+    const userRecipientKey = {
+        userId: input.userId,
+        recipientKeyEpochId: `user:${input.userId}:encapsulation:${recipient.keyFingerprint}`,
+        recipientKeyFingerprint: recipient.keyFingerprint,
+    };
+    const recipientTarget = {
+        recipientKind: "user",
+        recipientId: input.userId,
+        recipientKeyEpochId: userRecipientKey.recipientKeyEpochId,
+        recipientKeyFingerprint: userRecipientKey.recipientKeyFingerprint,
+    };
+    return {
+        recipientTarget,
+        userRecipientKey,
+        wrap: {
+            containerKeyEpochId: input.containerKeyEpochId,
+            recipientKind: "user",
+            recipientId: input.userId,
+            recipientKeyEpochId: userRecipientKey.recipientKeyEpochId,
+            recipientKeyFingerprint: userRecipientKey.recipientKeyFingerprint,
+            kemCipherText: bytesToBase64(recipient.kemCipherText),
+            wrappedKey: bytesToBase64(recipient.wrappedKey),
+            wrapManifestHash: input.manifestHash,
+        },
+    };
+}
+export async function wrapContainerKeyToManagedPrincipal(input) {
+    const [recipient] = await wrapDekForRecipients(input.containerKey, [
+        base64ToBytes(input.principalEncapsulationPublicKey),
+    ]);
+    if (!recipient) {
+        throw new Error("Container managed principal recipient wrap is unavailable");
+    }
+    const recipientTarget = {
+        recipientKind: input.principalHead.principalType,
+        recipientId: input.principalHead.principalId,
+        recipientKeyEpochId: derivePrincipalRecipientKeyEpochId(input.principalHead),
+        recipientKeyFingerprint: input.principalHead.keyFingerprint,
+    };
+    return {
+        recipientTarget,
+        wrap: {
+            containerKeyEpochId: input.containerKeyEpochId,
+            recipientKind: recipientTarget.recipientKind,
+            recipientId: recipientTarget.recipientId,
+            recipientKeyEpochId: recipientTarget.recipientKeyEpochId,
+            recipientKeyFingerprint: recipientTarget.recipientKeyFingerprint,
+            kemCipherText: bytesToBase64(recipient.kemCipherText),
+            wrappedKey: bytesToBase64(recipient.wrappedKey),
+            wrapManifestHash: input.manifestHash,
+        },
+    };
+}
+export function getParentWrappingPublicKey(projection) {
+    const targetState = readContainerState(getTargetContainerContext(projection).manifest);
+    if (!targetState.parentContainerId) {
+        return null;
+    }
+    const parent = projection.path.at(-2);
+    if (!parent) {
+        throw new Error("Container parent wrapping public key is unavailable");
+    }
+    const parentState = readContainerState(parent);
+    if (parentState.containerId !== targetState.parentContainerId) {
+        throw new Error("Container parent wrapping public key is unavailable");
+    }
+    const publicKey = parentState.containerKeyPublicKey;
+    if (!publicKey)
+        throw new Error("Container parent wrapping public key is missing");
+    return publicKey;
+}
+//# sourceMappingURL=projection.js.map