@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/containers/root/create.js

@@ -0,0 +1,290 @@
+import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, normalizeContainerAccessEventBody, } from "../../../internal/crypto/index.js";
+import { buildContainerCreateBody, buildContainerCreateKeyEpoch, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../data/containers/shared/events.js";
+import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
+import { readCanonicalJson, readCanonicalRecord, readCanonicalRecords, } from "../../../data/keyingCanonicalJson.js";
+import { principalHeadFromInitialGroupPolicy, principalPolicyRecordFromInitialGroupPolicy, } from "./initialGroupPolicy.js";
+function buildRootContainerCreateBody(input) {
+    const baseBody = buildContainerCreateBody({
+        systemSlot: input.systemSlot,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+        metadataDocumentId: input.metadataDocumentId,
+        parentContainerId: null,
+        parentManifestHash: null,
+    });
+    if (input.managedPrincipalHead) {
+        return {
+            ...baseBody,
+            directGrants: [
+                {
+                    accessLevel: "admin",
+                    subjectId: input.managedPrincipalHead.principalId,
+                    subjectType: input.managedPrincipalHead.principalType,
+                },
+                ...(input.memberHead
+                    ? [
+                        {
+                            accessLevel: "read",
+                            subjectId: input.memberHead.principalId,
+                            subjectType: "group",
+                        },
+                    ]
+                    : []),
+            ],
+            referencedPrincipalHeads: [
+                input.managedPrincipalHead,
+                ...(input.memberHead ? [input.memberHead] : []),
+            ],
+        };
+    }
+    return {
+        ...baseBody,
+        directGrants: [
+            {
+                accessLevel: "admin",
+                subjectId: input.author.signerUserId,
+                subjectType: "user",
+            },
+        ],
+    };
+}
+function buildRootContainerCreateRequest(input) {
+    return {
+        event: readCanonicalRecord(input.event, "Container root create event"),
+        body: readCanonicalRecord(input.body, "Container root create body"),
+        expectedManifestHash: input.manifestHash,
+        manifest: readCanonicalRecord(input.manifest, "Container root create manifest"),
+        previousManifest: null,
+        parentContainerPath: [],
+        principalPolicies: readCanonicalRecords(input.principalPolicies, "Container root create principal policies"),
+        keyEpoch: readCanonicalRecord(input.keyEpoch, "Container root create key epoch"),
+        predecessorBridge: null,
+        keyring: null,
+        wraps: readCanonicalRecords(input.wraps, "Container root create wraps"),
+        userRecipientKeys: readCanonicalRecords(input.userRecipientKeys, "Container root create user recipient keys"),
+    };
+}
+async function buildRootManagedPrincipalContext(adminGroup) {
+    if (!adminGroup) {
+        return {
+            managedPrincipalHead: null,
+            managedPrincipalPolicies: [],
+        };
+    }
+    const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({
+        principalId: adminGroup.groupId,
+        policy: adminGroup.initialGroupPolicy,
+    });
+    return {
+        managedPrincipalHead,
+        managedPrincipalPolicies: [
+            principalPolicyRecordFromInitialGroupPolicy({
+                head: managedPrincipalHead,
+                policy: adminGroup.initialGroupPolicy,
+            }),
+        ],
+    };
+}
+async function deriveRootCreateArtifacts(input) {
+    if (!input.body.containerKeyPublicKey)
+        throw new Error("Root container public key is missing");
+    const { event, eventHash } = await signContainerCreateEvent({
+        author: input.author,
+        body: input.body,
+        containerId: input.containerId,
+        eventId: crypto.randomUUID(),
+        // A root container belongs to the creator's own organization.
+        organizationId: input.author.organizationId,
+        parentPath: [],
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    });
+    const { manifest, manifestHash, state } = await deriveContainerCreateManifest({
+        systemSlot: input.body.systemSlot,
+        containerId: input.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.body.containerKeyPublicKey,
+        directGrants: input.body.directGrants,
+        eventHash,
+        metadataDocumentId: input.metadataDocumentId,
+        // A root container belongs to the creator's own organization.
+        organizationId: input.author.organizationId,
+        parentContainerId: null,
+        parentManifestHash: null,
+        referencedPrincipalHeads: input.body.referencedPrincipalHeads,
+    });
+    const keyEpoch = buildContainerCreateKeyEpoch({
+        containerId: input.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        eventHash,
+        manifestHash,
+        parentContainerKeyEpochId: null,
+    });
+    return { event, eventHash, keyEpoch, manifest, manifestHash, state };
+}
+async function wrapRootContainerKeyForPlan(input) {
+    if (input.adminGroup && input.managedPrincipalHead) {
+        return {
+            ...(await wrapContainerKeyToManagedPrincipal({
+                containerKey: input.containerKey,
+                containerKeyEpochId: input.containerKeyEpochId,
+                manifestHash: input.manifestHash,
+                principalEncapsulationPublicKey: input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,
+                principalHead: input.managedPrincipalHead,
+            })),
+            userRecipientKey: null,
+        };
+    }
+    return wrapContainerKeyToRootUser({
+        containerKey: input.containerKey,
+        containerKeyEpochId: input.containerKeyEpochId,
+        manifestHash: input.manifestHash,
+        recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,
+        userId: input.userId,
+    });
+}
+async function wrapRootContainerRecipients(input) {
+    const root = await wrapRootContainerKeyForPlan(input);
+    const member = input.memberGroup && input.memberHead
+        ? await wrapContainerKeyToManagedPrincipal({
+            ...input,
+            principalEncapsulationPublicKey: input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,
+            principalHead: input.memberHead,
+        })
+        : null;
+    return {
+        recipientTargets: [
+            root.recipientTarget,
+            ...(member ? [member.recipientTarget] : []),
+        ],
+        wraps: [root.wrap, ...(member ? [member.wrap] : [])],
+        userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],
+    };
+}
+function rootKeyMaterial(key) {
+    const material = key ?? crypto.getRandomValues(new Uint8Array(32));
+    if (material.byteLength !== 32)
+        throw new Error("Container KEK material must be 32 bytes");
+    return material;
+}
+function normalizedRootCreateBody(input) {
+    const body = normalizeContainerAccessEventBody(readCanonicalJson(buildRootContainerCreateBody(input), "Root create body"));
+    if (body.eventType !== "container.create")
+        throw new Error("Expected root creation body");
+    return body;
+}
+export async function buildRootContainerCreatePlan(input) {
+    const containerKey = rootKeyMaterial(input.containerKey);
+    const adminGroup = input.adminGroup ?? null;
+    const { managedPrincipalHead, managedPrincipalPolicies } = await buildRootManagedPrincipalContext(adminGroup);
+    const member = await buildRootManagedPrincipalContext(input.memberGroup ?? null);
+    if (input.memberGroup && !adminGroup)
+        throw new Error("Members root grant requires Admins authority");
+    managedPrincipalPolicies.push(...member.managedPrincipalPolicies);
+    const containerKeyEpochId = await resolveContainerKekEpochId({
+        containerId: input.containerId,
+        keyEpoch: 1,
+        keyMaterial: containerKey,
+    });
+    const body = normalizedRootCreateBody({
+        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
+            containerId: input.containerId,
+            keyMaterial: containerKey,
+        }),
+        memberHead: member.managedPrincipalHead,
+        systemSlot: input.systemSlot ?? null,
+        author: input.author,
+        containerKeyEpochId,
+        managedPrincipalHead,
+        metadataDocumentId: input.metadataDocumentId,
+    });
+    const { event, eventHash, keyEpoch, manifest, manifestHash, state } = await deriveRootCreateArtifacts({
+        author: input.author,
+        body,
+        containerId: input.containerId,
+        containerKeyEpochId,
+        metadataDocumentId: input.metadataDocumentId,
+        signedAt: input.signedAt,
+    });
+    const { recipientTargets, wraps, userRecipientKeys } = await wrapRootContainerRecipients({
+        memberGroup: input.memberGroup ?? null,
+        memberHead: member.managedPrincipalHead,
+        adminGroup,
+        containerKey,
+        containerKeyEpochId,
+        manifestHash,
+        managedPrincipalHead,
+        recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,
+        userId: input.author.signerUserId,
+    });
+    const keyTargetHash = await computeContainerKekRecipientTargetHash(recipientTargets);
+    const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);
+    const plan = {
+        body,
+        containerId: input.containerId,
+        containerKeyEpochId,
+        event,
+        eventHash,
+        keyEpoch,
+        keyEpochHash,
+        keyTargetHash,
+        manifest,
+        manifestHash,
+        metadataDocumentId: input.metadataDocumentId,
+        parentContainerId: null,
+        parentManifestHash: null,
+        recipientTargets,
+        request: buildRootContainerCreateRequest({
+            body,
+            event,
+            keyEpoch,
+            manifest,
+            manifestHash,
+            principalPolicies: managedPrincipalPolicies,
+            userRecipientKeys,
+            wraps,
+        }),
+        state,
+        wraps,
+    };
+    return { containerKey, plan };
+}
+export function rootContainerWriterProjectionFromCreatePlan(plan) {
+    return {
+        policyEvidence: {
+            organization: null,
+            organizationPayloads: [],
+            groups: [],
+        },
+        containerId: plan.containerId,
+        organizationId: plan.state.organizationId,
+        path: [
+            {
+                event: {
+                    event: readCanonicalRecord(plan.event, "Container root event"),
+                    body: readCanonicalRecord(plan.body, "Container root body"),
+                    eventHash: plan.eventHash,
+                },
+                manifest: readCanonicalRecord(plan.manifest, "Container root manifest"),
+                manifestHash: plan.manifestHash,
+                state: readCanonicalRecord(plan.state, "Container root state"),
+            },
+        ],
+        containerKeks: [
+            {
+                containerId: plan.containerId,
+                accessManifestHash: plan.manifestHash,
+                containerKeyEpochId: plan.containerKeyEpochId,
+                containerKeyEpoch: plan.keyEpoch.keyEpoch,
+                keyEpoch: readCanonicalRecord(plan.keyEpoch, "Container root key epoch"),
+                keyEpochHash: plan.keyEpochHash,
+                keyTargetHash: plan.keyTargetHash,
+                containerManifestHistory: [],
+                parentContainerKeyEpochId: null,
+                keyring: null,
+                recipientTargets: readCanonicalRecords(plan.recipientTargets, "Container root recipient targets"),
+                wraps: readCanonicalRecords(plan.wraps, "Container root wraps"),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=create.js.map

package/workflows/containers/root/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,sBAAsB,CAAC;AAE9B,SAAS,4BAA4B,CAAC,KAQrC;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ;oBACE,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,WAAW;oBACjD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;iBACtD;gBACD,GAAG,CAAC,KAAK,CAAC,UAAU;oBAClB,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE,MAAe;4BAC5B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;4BACvC,WAAW,EAAE,OAAgB;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,wBAAwB,EAAE;gBACxB,KAAK,CAAC,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KASxC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACtE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;QACnE,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,gCAAgC,CACjC;QACD,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,EAAE;QACvB,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,0CAA0C,CAC3C;QACD,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,iCAAiC,CAClC;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACvE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,UAAiD;IAKjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,WAAW,EAAE,UAAU,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,kBAAkB;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,wBAAwB,EAAE;YACxB,2CAA2C,CAAC;gBAC1C,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,SAAS;QACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;KAC9D,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,CAAC,MAAM,kCAAkC,CAAC;gBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAC7B,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;gBAClE,aAAa,EAAE,KAAK,CAAC,oBAAoB;aAC1C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAGC;IAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;QACnC,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,GAAG,KAAK;YACR,+BAA+B,EAC7B,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;YACnE,aAAa,EAAE,KAAK,CAAC,UAAU;SAChC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,gBAAgB,EAAE;YAChB,IAAI,CAAC,eAAe;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyD;IAEzD,MAAM,IAAI,GAAG,iCAAiC,CAC5C,iBAAiB,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GACtD,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,gCAAgC,CACnD,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,UAAU;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,wBAAwB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,yBAAyB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACL,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAClD,MAAM,2BAA2B,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,oBAAoB;QACpB,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACL,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAwB;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB;QAChB,OAAO,EAAE,+BAA+B,CAAC;YACvC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,iBAAiB,EAAE,wBAAwB;YAC3C,iBAAiB;YACjB,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,IAAyB;IAEzB,OAAO;QACL,cAAc,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;oBAC9D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC;oBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;gBACvE,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAC/D;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,kCAAkC,CACnC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAChE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerCreateAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  deriveContainerKekWrappingPublicKey,\n  normalizeContainerAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationRequest,\n  CreateOrganizationGroupRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  buildContainerCreateBody,\n  buildContainerCreateKeyEpoch,\n  deriveContainerCreateManifest,\n  resolveContainerKekEpochId,\n  signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerCreatePlan,\n  ContainerMutationAuthor,\n  MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\n\nimport {\n  principalHeadFromInitialGroupPolicy,\n  principalPolicyRecordFromInitialGroupPolicy,\n} from \"./initialGroupPolicy\";\n\nfunction buildRootContainerCreateBody(input: {\n  author: ContainerMutationAuthor;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string;\n  metadataDocumentId: string;\n  memberHead: ContainerGrantPrincipalHead | null;\n  systemSlot: ContainerSystemSlot | null;\n}): ContainerCreateAccessEventBody {\n  const baseBody = buildContainerCreateBody({\n    systemSlot: input.systemSlot,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n  });\n  if (input.managedPrincipalHead) {\n    return {\n      ...baseBody,\n      directGrants: [\n        {\n          accessLevel: \"admin\",\n          subjectId: input.managedPrincipalHead.principalId,\n          subjectType: input.managedPrincipalHead.principalType,\n        },\n        ...(input.memberHead\n          ? [\n              {\n                accessLevel: \"read\" as const,\n                subjectId: input.memberHead.principalId,\n                subjectType: \"group\" as const,\n              },\n            ]\n          : []),\n      ],\n      referencedPrincipalHeads: [\n        input.managedPrincipalHead,\n        ...(input.memberHead ? [input.memberHead] : []),\n      ],\n    };\n  }\n\n  return {\n    ...baseBody,\n    directGrants: [\n      {\n        accessLevel: \"admin\",\n        subjectId: input.author.signerUserId,\n        subjectType: \"user\",\n      },\n    ],\n  };\n}\n\nfunction buildRootContainerCreateRequest(input: {\n  body: ContainerCreateAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  principalPolicies: readonly Record<string, unknown>[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    event: readCanonicalRecord(input.event, \"Container root create event\"),\n    body: readCanonicalRecord(input.body, \"Container root create body\"),\n    expectedManifestHash: input.manifestHash,\n    manifest: readCanonicalRecord(\n      input.manifest,\n      \"Container root create manifest\",\n    ),\n    previousManifest: null,\n    parentContainerPath: [],\n    principalPolicies: readCanonicalRecords(\n      input.principalPolicies,\n      \"Container root create principal policies\",\n    ),\n    keyEpoch: readCanonicalRecord(\n      input.keyEpoch,\n      \"Container root create key epoch\",\n    ),\n    predecessorBridge: null,\n    keyring: null,\n    wraps: readCanonicalRecords(input.wraps, \"Container root create wraps\"),\n    userRecipientKeys: readCanonicalRecords(\n      input.userRecipientKeys,\n      \"Container root create user recipient keys\",\n    ),\n  };\n}\n\nasync function buildRootManagedPrincipalContext(\n  adminGroup: CreateOrganizationGroupRequest | null,\n): Promise<{\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  managedPrincipalPolicies: Record<string, unknown>[];\n}> {\n  if (!adminGroup) {\n    return {\n      managedPrincipalHead: null,\n      managedPrincipalPolicies: [],\n    };\n  }\n\n  const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({\n    principalId: adminGroup.groupId,\n    policy: adminGroup.initialGroupPolicy,\n  });\n\n  return {\n    managedPrincipalHead,\n    managedPrincipalPolicies: [\n      principalPolicyRecordFromInitialGroupPolicy({\n        head: managedPrincipalHead,\n        policy: adminGroup.initialGroupPolicy,\n      }),\n    ],\n  };\n}\n\nasync function deriveRootCreateArtifacts(input: {\n  author: ContainerMutationAuthor;\n  body: ContainerCreateAccessEventBody;\n  containerId: string;\n  containerKeyEpochId: string;\n  metadataDocumentId: string;\n  signedAt: string | undefined;\n}) {\n  if (!input.body.containerKeyPublicKey)\n    throw new Error(\"Root container public key is missing\");\n  const { event, eventHash } = await signContainerCreateEvent({\n    author: input.author,\n    body: input.body,\n    containerId: input.containerId,\n    eventId: crypto.randomUUID(),\n    // A root container belongs to the creator's own organization.\n    organizationId: input.author.organizationId,\n    parentPath: [],\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n    {\n      systemSlot: input.body.systemSlot,\n      containerId: input.containerId,\n      containerKeyEpochId: input.containerKeyEpochId,\n      containerKeyPublicKey: input.body.containerKeyPublicKey,\n      directGrants: input.body.directGrants,\n      eventHash,\n      metadataDocumentId: input.metadataDocumentId,\n      // A root container belongs to the creator's own organization.\n      organizationId: input.author.organizationId,\n      parentContainerId: null,\n      parentManifestHash: null,\n      referencedPrincipalHeads: input.body.referencedPrincipalHeads,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash,\n    manifestHash,\n    parentContainerKeyEpochId: null,\n  });\n  return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\nasync function wrapRootContainerKeyForPlan(input: {\n  adminGroup: CreateOrganizationGroupRequest | null;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  recipientEncapsulationPublicKey: Uint8Array;\n  userId: string;\n}) {\n  if (input.adminGroup && input.managedPrincipalHead) {\n    return {\n      ...(await wrapContainerKeyToManagedPrincipal({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        principalEncapsulationPublicKey:\n          input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,\n        principalHead: input.managedPrincipalHead,\n      })),\n      userRecipientKey: null,\n    };\n  }\n\n  return wrapContainerKeyToRootUser({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n    userId: input.userId,\n  });\n}\n\nasync function wrapRootContainerRecipients(\n  input: Parameters<typeof wrapRootContainerKeyForPlan>[0] & {\n    memberGroup: CreateOrganizationGroupRequest | null;\n    memberHead: ContainerGrantPrincipalHead | null;\n  },\n) {\n  const root = await wrapRootContainerKeyForPlan(input);\n  const member =\n    input.memberGroup && input.memberHead\n      ? await wrapContainerKeyToManagedPrincipal({\n          ...input,\n          principalEncapsulationPublicKey:\n            input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,\n          principalHead: input.memberHead,\n        })\n      : null;\n  return {\n    recipientTargets: [\n      root.recipientTarget,\n      ...(member ? [member.recipientTarget] : []),\n    ],\n    wraps: [root.wrap, ...(member ? [member.wrap] : [])],\n    userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],\n  };\n}\n\nfunction rootKeyMaterial(key?: Uint8Array): Uint8Array {\n  const material = key ?? crypto.getRandomValues(new Uint8Array(32));\n  if (material.byteLength !== 32)\n    throw new Error(\"Container KEK material must be 32 bytes\");\n  return material;\n}\n\nfunction normalizedRootCreateBody(\n  input: Parameters<typeof buildRootContainerCreateBody>[0],\n): ContainerCreateAccessEventBody {\n  const body = normalizeContainerAccessEventBody(\n    readCanonicalJson(buildRootContainerCreateBody(input), \"Root create body\"),\n  );\n  if (body.eventType !== \"container.create\")\n    throw new Error(\"Expected root creation body\");\n  return body;\n}\n\nexport async function buildRootContainerCreatePlan(input: {\n  adminGroup?: CreateOrganizationGroupRequest | undefined;\n  memberGroup?: CreateOrganizationGroupRequest | undefined;\n  systemSlot?: ContainerSystemSlot | undefined;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  containerKey?: Uint8Array | undefined;\n  metadataDocumentId: string;\n  recipientEncapsulationPublicKey: Uint8Array;\n  signedAt?: string | undefined;\n}): Promise<MaterializedContainerCreatePlan> {\n  const containerKey = rootKeyMaterial(input.containerKey);\n  const adminGroup = input.adminGroup ?? null;\n  const { managedPrincipalHead, managedPrincipalPolicies } =\n    await buildRootManagedPrincipalContext(adminGroup);\n\n  const member = await buildRootManagedPrincipalContext(\n    input.memberGroup ?? null,\n  );\n  if (input.memberGroup && !adminGroup)\n    throw new Error(\"Members root grant requires Admins authority\");\n  managedPrincipalPolicies.push(...member.managedPrincipalPolicies);\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.containerId,\n    keyEpoch: 1,\n    keyMaterial: containerKey,\n  });\n  const body = normalizedRootCreateBody({\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.containerId,\n      keyMaterial: containerKey,\n    }),\n    memberHead: member.managedPrincipalHead,\n    systemSlot: input.systemSlot ?? null,\n    author: input.author,\n    containerKeyEpochId,\n    managedPrincipalHead,\n    metadataDocumentId: input.metadataDocumentId,\n  });\n  const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveRootCreateArtifacts({\n      author: input.author,\n      body,\n      containerId: input.containerId,\n      containerKeyEpochId,\n      metadataDocumentId: input.metadataDocumentId,\n      signedAt: input.signedAt,\n    });\n  const { recipientTargets, wraps, userRecipientKeys } =\n    await wrapRootContainerRecipients({\n      memberGroup: input.memberGroup ?? null,\n      memberHead: member.managedPrincipalHead,\n      adminGroup,\n      containerKey,\n      containerKeyEpochId,\n      manifestHash,\n      managedPrincipalHead,\n      recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n      userId: input.author.signerUserId,\n    });\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  const plan: ContainerCreatePlan = {\n    body,\n    containerId: input.containerId,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyEpochHash,\n    keyTargetHash,\n    manifest,\n    manifestHash,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n    recipientTargets,\n    request: buildRootContainerCreateRequest({\n      body,\n      event,\n      keyEpoch,\n      manifest,\n      manifestHash,\n      principalPolicies: managedPrincipalPolicies,\n      userRecipientKeys,\n      wraps,\n    }),\n    state,\n    wraps,\n  };\n\n  return { containerKey, plan };\n}\n\nexport function rootContainerWriterProjectionFromCreatePlan(\n  plan: ContainerCreatePlan,\n): ContainerWriterProjectionResponse {\n  return {\n    policyEvidence: {\n      organization: null,\n      organizationPayloads: [],\n      groups: [],\n    },\n    containerId: plan.containerId,\n    organizationId: plan.state.organizationId,\n    path: [\n      {\n        event: {\n          event: readCanonicalRecord(plan.event, \"Container root event\"),\n          body: readCanonicalRecord(plan.body, \"Container root body\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(plan.manifest, \"Container root manifest\"),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container root state\"),\n      },\n    ],\n    containerKeks: [\n      {\n        containerId: plan.containerId,\n        accessManifestHash: plan.manifestHash,\n        containerKeyEpochId: plan.containerKeyEpochId,\n        containerKeyEpoch: plan.keyEpoch.keyEpoch,\n        keyEpoch: readCanonicalRecord(\n          plan.keyEpoch,\n          \"Container root key epoch\",\n        ),\n        keyEpochHash: plan.keyEpochHash,\n        keyTargetHash: plan.keyTargetHash,\n        containerManifestHistory: [],\n        parentContainerKeyEpochId: null,\n        keyring: null,\n        recipientTargets: readCanonicalRecords(\n          plan.recipientTargets,\n          \"Container root recipient targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container root wraps\"),\n      },\n    ],\n  };\n}\n"]}

package/workflows/containers/root/initialGroupPolicy.js

@@ -0,0 +1,35 @@
+import { computePrincipalStateHash } from "../../../internal/crypto/index.js";
+import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
+export async function principalHeadFromInitialGroupPolicy(input) {
+    return {
+        principalType: "group",
+        principalId: input.principalId,
+        version: input.policy.state.version,
+        keyEpoch: input.policy.state.keyEpoch,
+        stateHash: await computePrincipalStateHash(input.policy.state),
+        keyFingerprint: input.policy.state.keyFingerprint,
+    };
+}
+export function principalPolicyRecordFromInitialGroupPolicy(input) {
+    const { head } = input;
+    return readCanonicalRecord({
+        principalType: head.principalType,
+        principalId: head.principalId,
+        version: head.version,
+        keyEpoch: head.keyEpoch,
+        stateHash: head.stateHash,
+        state: {
+            ...input.policy.state,
+            stateHash: head.stateHash,
+        },
+        projection: input.policy.projection,
+        grants: input.policy.grants,
+        checkpoint: {
+            principalType: head.principalType,
+            principalId: head.principalId,
+            version: head.version,
+            stateHash: head.stateHash,
+        },
+    }, "Initial managed principal policy");
+}
+//# sourceMappingURL=initialGroupPolicy.js.map

package/workflows/containers/root/initialGroupPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initialGroupPolicy.js","sourceRoot":"","sources":["initialGroupPolicy.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAUxE,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqC;IAErC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QACnC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ;QACrC,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAG3D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,OAAO,mBAAmB,CACxB;QACE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,UAAU,EAAE;YACV,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,EACD,kCAAkC,CACnC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerGrantPrincipalHead,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\n\ntype InitialManagedPrincipalPolicy =\n  CreateOrganizationGroupRequest[\"initialGroupPolicy\"];\n\ninterface RootManagedPrincipalGrantInput {\n  readonly principalId: string;\n  readonly policy: InitialManagedPrincipalPolicy;\n}\n\nexport async function principalHeadFromInitialGroupPolicy(\n  input: RootManagedPrincipalGrantInput,\n): Promise<ContainerGrantPrincipalHead> {\n  return {\n    principalType: \"group\",\n    principalId: input.principalId,\n    version: input.policy.state.version,\n    keyEpoch: input.policy.state.keyEpoch,\n    stateHash: await computePrincipalStateHash(input.policy.state),\n    keyFingerprint: input.policy.state.keyFingerprint,\n  };\n}\n\nexport function principalPolicyRecordFromInitialGroupPolicy(input: {\n  readonly head: ReferencedPrincipalHead;\n  readonly policy: InitialManagedPrincipalPolicy;\n}): Record<string, unknown> {\n  const { head } = input;\n\n  return readCanonicalRecord(\n    {\n      principalType: head.principalType,\n      principalId: head.principalId,\n      version: head.version,\n      keyEpoch: head.keyEpoch,\n      stateHash: head.stateHash,\n      state: {\n        ...input.policy.state,\n        stateHash: head.stateHash,\n      },\n      projection: input.policy.projection,\n      grants: input.policy.grants,\n      checkpoint: {\n        principalType: head.principalType,\n        principalId: head.principalId,\n        version: head.version,\n        stateHash: head.stateHash,\n      },\n    },\n    \"Initial managed principal policy\",\n  );\n}\n"]}

package/workflows/containers/writeRefusal.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Why the SDK refused to author a container-scoped write before anything was
+ * encrypted or sent:
+ *
+ * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this
+ *   writer's next document sync pass, or a peer, re-keys it parent-first.
+ * - `repair-inaccessible`: the same, but the stale container is one this writer
+ *   can neither re-key nor be given the key for. Queued changes stay queued and
+ *   sync once a member with access to `containerId` repairs it.
+ * - `unauthorized`: the signed path grants this signer too little access.
+ */
+export type ContainerWriteRefusal = {
+    readonly kind: "repair-required";
+    readonly containerId: string;
+} | {
+    readonly kind: "repair-inaccessible";
+    readonly containerId: string;
+} | {
+    readonly kind: "unauthorized";
+};
+/** Null for anything else, including keying-verification failures. */
+export declare function classifyContainerWriteRefusal(error: unknown): ContainerWriteRefusal | null;

package/workflows/containers/writeRefusal.js

@@ -0,0 +1,32 @@
+import { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
+function namedError(error, name) {
+    return error instanceof Error && error.name === name;
+}
+/** A same-named error from elsewhere may lack the field; never say "undefined". */
+function repairContainerId(error) {
+    const containerId = Reflect.get(Object(error), "containerId");
+    return typeof containerId === "string" && containerId.length > 0
+        ? containerId
+        : null;
+}
+/** Null for anything else, including keying-verification failures. */
+export function classifyContainerWriteRefusal(error) {
+    // Match by name as well: a host bundling the SDK twice holds two classes.
+    if (error instanceof ContainerKekRepairInaccessibleError ||
+        namedError(error, "ContainerKekRepairInaccessibleError")) {
+        const containerId = repairContainerId(error);
+        return containerId ? { kind: "repair-inaccessible", containerId } : null;
+    }
+    if (error instanceof ContainerKekRepairRequiredError ||
+        namedError(error, "ContainerKekRepairRequiredError")) {
+        const containerId = repairContainerId(error);
+        return containerId ? { kind: "repair-required", containerId } : null;
+    }
+    if (error instanceof ContainerAuthorAccessError ||
+        namedError(error, "ContainerAuthorAccessError")) {
+        return { kind: "unauthorized" };
+    }
+    return null;
+}
+//# sourceMappingURL=writeRefusal.js.map

package/workflows/containers/writeRefusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeRefusal.js","sourceRoot":"","sources":["writeRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAkB1D,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,0EAA0E;IAC1E,IACE,KAAK,YAAY,mCAAmC;QACpD,UAAU,CAAC,KAAK,EAAE,qCAAqC,CAAC,EACxD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,IACE,KAAK,YAAY,+BAA+B;QAChD,UAAU,CAAC,KAAK,EAAE,iCAAiC,CAAC,EACpD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\n\n/**\n * Why the SDK refused to author a container-scoped write before anything was\n * encrypted or sent:\n *\n * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this\n *   writer's next document sync pass, or a peer, re-keys it parent-first.\n * - `repair-inaccessible`: the same, but the stale container is one this writer\n *   can neither re-key nor be given the key for. Queued changes stay queued and\n *   sync once a member with access to `containerId` repairs it.\n * - `unauthorized`: the signed path grants this signer too little access.\n */\nexport type ContainerWriteRefusal =\n  | { readonly kind: \"repair-required\"; readonly containerId: string }\n  | { readonly kind: \"repair-inaccessible\"; readonly containerId: string }\n  | { readonly kind: \"unauthorized\" };\n\nfunction namedError(error: unknown, name: string): error is Error {\n  return error instanceof Error && error.name === name;\n}\n\n/** A same-named error from elsewhere may lack the field; never say \"undefined\". */\nfunction repairContainerId(error: unknown): string | null {\n  const containerId = Reflect.get(Object(error), \"containerId\");\n  return typeof containerId === \"string\" && containerId.length > 0\n    ? containerId\n    : null;\n}\n\n/** Null for anything else, including keying-verification failures. */\nexport function classifyContainerWriteRefusal(\n  error: unknown,\n): ContainerWriteRefusal | null {\n  // Match by name as well: a host bundling the SDK twice holds two classes.\n  if (\n    error instanceof ContainerKekRepairInaccessibleError ||\n    namedError(error, \"ContainerKekRepairInaccessibleError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-inaccessible\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    namedError(error, \"ContainerKekRepairRequiredError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-required\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerAuthorAccessError ||\n    namedError(error, \"ContainerAuthorAccessError\")\n  ) {\n    return { kind: \"unauthorized\" };\n  }\n  return null;\n}\n"]}

package/workflows/documents/attachmentPersistence.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Attachment-slot persistence for stored documents.
+ *
+ * These are the workflow-level seams the document store writes attachment rows
+ * through: the pending-upload queue, the local blob projection, and the detach
+ * marker that keeps an unlinked slot's row alive for the next sync.
+ */
+import type { DocumentsPersistence, LocalAttachmentRecord, PendingAttachmentRecord } from "../../data/persistence/documents/documentsPersistence.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+export declare function saveLocalDocumentAttachments(input: {
+    attachments: ReadonlyArray<LocalAttachmentRecord>;
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+}): Promise<void>;
+export declare function deleteLocalDocumentAttachment(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+/**
+ * Mark a slot's local blob row detached without dropping it.
+ *
+ * Unlinking an attachment from a synced document cannot delete the row: it is
+ * also the marker `syncDetachedAttachments` needs to detach the remote binding
+ * on the next sync (and to survive a restart before that sync runs). Marking it
+ * keeps that marker while taking the slot out of the local blob read models
+ * right away, so the blob browser stops listing a reference the document no
+ * longer has.
+ */
+export declare function markLocalDocumentAttachmentDetached(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+export declare function savePendingDocumentAttachment(input: {
+    attachment: PendingAttachmentRecord;
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+}): Promise<void>;
+export declare function deletePendingDocumentAttachment(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+export declare function saveHydratedDocumentAttachment(input: {
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+    attachment: LocalAttachmentRecord;
+    expectedStorageKey: string | null;
+    expectedSnapshotEndVersion: string | null;
+    stillCurrent: () => boolean;
+}): Promise<boolean>;

package/workflows/documents/attachmentPersistence.js

@@ -0,0 +1,31 @@
+export async function saveLocalDocumentAttachments(input) {
+    for (const attachment of input.attachments) {
+        await input.persistence.saveLocalAttachment(input.execSql, attachment);
+    }
+}
+export async function deleteLocalDocumentAttachment(input) {
+    await input.persistence.deleteLocalAttachment(input.execSql, input.localId, input.slotId, input.storageKey);
+}
+/**
+ * Mark a slot's local blob row detached without dropping it.
+ *
+ * Unlinking an attachment from a synced document cannot delete the row: it is
+ * also the marker `syncDetachedAttachments` needs to detach the remote binding
+ * on the next sync (and to survive a restart before that sync runs). Marking it
+ * keeps that marker while taking the slot out of the local blob read models
+ * right away, so the blob browser stops listing a reference the document no
+ * longer has.
+ */
+export async function markLocalDocumentAttachmentDetached(input) {
+    await input.persistence.markLocalAttachmentDetached(input.execSql, input.localId, input.slotId, input.storageKey);
+}
+export async function savePendingDocumentAttachment(input) {
+    await input.persistence.savePendingAttachment(input.execSql, input.attachment);
+}
+export async function deletePendingDocumentAttachment(input) {
+    await input.persistence.deletePendingAttachment(input.execSql, input.localId, input.slotId, input.storageKey);
+}
+export function saveHydratedDocumentAttachment(input) {
+    return input.persistence.saveHydratedAttachment(input.execSql, input);
+}
+//# sourceMappingURL=attachmentPersistence.js.map

package/workflows/documents/attachmentPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentPersistence.js","sourceRoot":"","sources":["attachmentPersistence.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAC3C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,2BAA2B,CACjD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAC3C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAO9C;IACC,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/**\n * Attachment-slot persistence for stored documents.\n *\n * These are the workflow-level seams the document store writes attachment rows\n * through: the pending-upload queue, the local blob projection, and the detach\n * marker that keeps an unlinked slot's row alive for the next sync.\n */\nimport type {\n  DocumentsPersistence,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport async function saveLocalDocumentAttachments(input: {\n  attachments: ReadonlyArray<LocalAttachmentRecord>;\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n}): Promise<void> {\n  for (const attachment of input.attachments) {\n    await input.persistence.saveLocalAttachment(input.execSql, attachment);\n  }\n}\n\nexport async function deleteLocalDocumentAttachment(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.deleteLocalAttachment(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\n/**\n * Mark a slot's local blob row detached without dropping it.\n *\n * Unlinking an attachment from a synced document cannot delete the row: it is\n * also the marker `syncDetachedAttachments` needs to detach the remote binding\n * on the next sync (and to survive a restart before that sync runs). Marking it\n * keeps that marker while taking the slot out of the local blob read models\n * right away, so the blob browser stops listing a reference the document no\n * longer has.\n */\nexport async function markLocalDocumentAttachmentDetached(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.markLocalAttachmentDetached(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\nexport async function savePendingDocumentAttachment(input: {\n  attachment: PendingAttachmentRecord;\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n}): Promise<void> {\n  await input.persistence.savePendingAttachment(\n    input.execSql,\n    input.attachment,\n  );\n}\n\nexport async function deletePendingDocumentAttachment(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.deletePendingAttachment(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\nexport function saveHydratedDocumentAttachment(input: {\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n  attachment: LocalAttachmentRecord;\n  expectedStorageKey: string | null;\n  expectedSnapshotEndVersion: string | null;\n  stillCurrent: () => boolean;\n}): Promise<boolean> {\n  return input.persistence.saveHydratedAttachment(input.execSql, input);\n}\n"]}

package/workflows/documents/author.d.ts

@@ -0,0 +1,15 @@
+import type { DocumentCreateAuthor } from "../../data/documents/shared/types.js";
+interface DocumentAuthorRuntime {
+    auth: {
+        organizationId?: string | null;
+        userId?: string | null;
+    };
+    crypto: {
+        signingFingerprint?: string | null;
+        signingKeyPair?: {
+            signingPrivateKey: Uint8Array;
+        } | null | undefined;
+    };
+}
+export declare function resolveDocumentCreateAuthor(runtime: DocumentAuthorRuntime): DocumentCreateAuthor | null;
+export {};

package/workflows/documents/author.js

@@ -0,0 +1,17 @@
+import { createDocumentSignerDeviceId } from "../../data/documents/documentConstants.js";
+export function resolveDocumentCreateAuthor(runtime) {
+    if (!runtime.auth.organizationId ||
+        !runtime.crypto.signingFingerprint ||
+        !runtime.crypto.signingKeyPair ||
+        !runtime.auth.userId) {
+        return null;
+    }
+    return {
+        organizationId: runtime.auth.organizationId,
+        signerDeviceId: createDocumentSignerDeviceId(runtime.crypto.signingFingerprint),
+        signerKeyFingerprint: runtime.crypto.signingFingerprint,
+        signerPrivateKey: runtime.crypto.signingKeyPair.signingPrivateKey,
+        signerUserId: runtime.auth.userId,
+    };
+}
+//# sourceMappingURL=author.js.map

package/workflows/documents/author.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"author.js","sourceRoot":"","sources":["author.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAmBtF,MAAM,UAAU,2BAA2B,CACzC,OAA8B;IAE9B,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QAC9B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,cAAc,EAAE,4BAA4B,CAC1C,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAClC;QACD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACvD,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB;QACjE,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KAClC,CAAC;AACJ,CAAC","sourcesContent":["import { createDocumentSignerDeviceId } from \"../../data/documents/documentConstants\";\nimport type { DocumentCreateAuthor } from \"../../data/documents/shared/types\";\n\ninterface DocumentAuthorRuntime {\n  auth: {\n    organizationId?: string | null;\n    userId?: string | null;\n  };\n  crypto: {\n    signingFingerprint?: string | null;\n    signingKeyPair?:\n      | {\n          signingPrivateKey: Uint8Array;\n        }\n      | null\n      | undefined;\n  };\n}\n\nexport function resolveDocumentCreateAuthor(\n  runtime: DocumentAuthorRuntime,\n): DocumentCreateAuthor | null {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair ||\n    !runtime.auth.userId\n  ) {\n    return null;\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerDeviceId: createDocumentSignerDeviceId(\n      runtime.crypto.signingFingerprint,\n    ),\n    signerKeyFingerprint: runtime.crypto.signingFingerprint,\n    signerPrivateKey: runtime.crypto.signingKeyPair.signingPrivateKey,\n    signerUserId: runtime.auth.userId,\n  };\n}\n"]}

package/workflows/documents/authorAccessFailure.js

@@ -0,0 +1,14 @@
+import { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
+/** A verified read-only path is a local permission refusal, not tampered proof. */
+export async function recordDocumentAuthorAccessFailure(build, onFailure) {
+    try {
+        return await build();
+    }
+    catch (error) {
+        if (!(error instanceof ContainerAuthorAccessError))
+            throw error;
+        await onFailure?.({ message: error.message, status: error.status });
+        return null;
+    }
+}
+//# sourceMappingURL=authorAccessFailure.js.map

package/workflows/documents/authorAccessFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorAccessFailure.js","sourceRoot":"","sources":["authorAccessFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGvF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAuB,EACvB,SAA2D;IAE3D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport type { DocumentCreateTerminalFailureHandler } from \"./createProjectionFetch\";\n\n/** A verified read-only path is a local permission refusal, not tampered proof. */\nexport async function recordDocumentAuthorAccessFailure<T>(\n  build: () => Promise<T>,\n  onFailure: DocumentCreateTerminalFailureHandler | undefined,\n): Promise<T | null> {\n  try {\n    return await build();\n  } catch (error) {\n    if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    await onFailure?.({ message: error.message, status: error.status });\n    return null;\n  }\n}\n"]}

package/workflows/documents/blobMutationLock.d.ts

@@ -0,0 +1,8 @@
+import { type ExecSql } from "../../data/sqlite/sqlSchema.js";
+/**
+ * Serialize byte-store mutations that address the same document blob key.
+ *
+ * Lock order is blob key, then the connection-wide SQL mutation lock. Callers
+ * must not acquire this lock from inside `runSerializedSqlMutation`.
+ */
+export declare function runSerializedDocumentBlobMutation<T>(execSql: ExecSql, storageKey: string, operation: () => Promise<T> | T): Promise<T>;