@tearleads/client-sdk 0.1.103 → 0.1.105
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/data/keyingProjectionVerification/checkpoints/checkpointContext.js +4 -1
- package/data/keyingProjectionVerification/checkpoints/checkpointContext.js.map +1 -1
- package/data/keyingProjectionVerification/checkpoints/verifiedBundleBytes.js +27 -0
- package/data/keyingProjectionVerification/checkpoints/verifiedBundleBytes.js.map +1 -0
- package/data/keyingProjectionVerification/container/containerManifestVerification.js +2 -0
- package/data/keyingProjectionVerification/container/containerManifestVerification.js.map +1 -1
- package/data/keyingProjectionVerification/document/documentManifestVerification.js +2 -0
- package/data/keyingProjectionVerification/document/documentManifestVerification.js.map +1 -1
- package/data/persistence/container-contents/containerContentsPersistence.js +3 -1
- package/data/persistence/container-contents/containerContentsPersistence.js.map +1 -1
- package/data/persistence/container-contents/containerMetadataRows.js +9 -0
- package/data/persistence/container-contents/containerMetadataRows.js.map +1 -1
- package/data/principals/principalPolicyAdminSigners.js +50 -0
- package/data/principals/principalPolicyAdminSigners.js.map +1 -1
- package/internal/validators/operation/containerMutations.d.ts +16 -16
- package/internal/validators/operation/principals.d.ts +24 -0
- package/internal/validators/response/containerMutationError.d.ts +3 -3
- package/internal/validators/response/containerMutationError.js +2 -1
- package/internal/validators/response/containerMutationError.js.map +1 -1
- package/internal/validators/response/containerMutationStateStaleError.js +3 -0
- package/internal/validators/response/containerMutationStateStaleError.js.map +1 -0
- package/internal/validators/response/principal.d.ts +12 -0
- package/internal/validators/response/principal.js +5 -0
- package/internal/validators/response/principal.js.map +1 -1
- package/package.json +1 -1
- package/workflows/containers/rematerialization/acknowledgePrincipalContainerRematerialization.js +45 -0
- package/workflows/containers/rematerialization/acknowledgePrincipalContainerRematerialization.js.map +1 -0
- package/workflows/containers/rematerialization/principalContainerRematerialization.js +17 -47
- package/workflows/containers/rematerialization/principalContainerRematerialization.js.map +1 -1
- package/workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js +3 -0
- package/workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js.map +1 -1
- package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.d.ts +6 -11
- package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.js +58 -45
- package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.js.map +1 -1
- package/workflows/principals/policyCache/principalPolicyCacheValidation.js +20 -2
- package/workflows/principals/policyCache/principalPolicyCacheValidation.js.map +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAA2D;IAE3D,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmD;IAEnD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type KeyingVerificationResult,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyExternalAuthority,\n type PrincipalPolicySignerPublicKey,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicy,\n verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n bundle: Pick<PrincipalPolicyBundleResponse, \"currentState\">,\n): ReferencedPrincipalHead {\n return {\n principalType: bundle.currentState.principalType,\n principalId: bundle.currentState.principalId,\n version: bundle.currentState.version,\n keyEpoch: bundle.currentState.keyEpoch,\n stateHash: bundle.currentState.stateHash,\n keyFingerprint: bundle.currentState.keyFingerprint,\n };\n}\n\nexport function organizationAdminSignerUserIds(\n policy: Pick<VerifiedPrincipalPolicy, \"projection\">,\n): string[] {\n return [\n ...new Set(\n policy.projection\n .filter((member) => member.role === \"admin\")\n .map((member) => member.userId),\n ),\n ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n const history = policy.history ?? [\n {\n state: policy.state,\n projection: policy.projection,\n grants: policy.grants,\n },\n ];\n const toHead = (state: (typeof history)[number][\"state\"]) => ({\n principalType: \"group\" as const,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: state.stateHash,\n keyFingerprint: state.keyFingerprint,\n });\n return {\n currentHead: toHead(policy.state),\n states: history.map((entry) => ({\n head: toHead(entry.state),\n projection: entry.projection,\n })),\n };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n readonly organizationId: string;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n if (\n input.bundle.currentState.principalType !== \"organization\" ||\n input.bundle.currentState.principalId !== input.organizationId\n ) {\n return {\n ok: false,\n error: new KeyingVerificationError(\n \"object_mismatch\",\n \"organization policy does not match the expected organization\",\n ),\n };\n }\n\n return verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly expectedReference: ReferencedPrincipalHead;\n readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n const verified = await verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n expectedReference: input.expectedReference,\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n if (verified.ok || verified.error.code !== \"unauthorized\") {\n return verified;\n }\n\n const externalAuthority = await input.loadExternalAuthority();\n if (!externalAuthority) {\n return verified;\n }\n\n const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n externalAuthority,\n expectedReference: input.expectedReference,\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n\n return verifiedWithExternalAdmins;\n}\n"]}
|
|
1
|
+
{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAA2D;IAE3D,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmD;IAEnD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAKrD;IACC,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,MAAM,CAAC,YAAY;QACzB,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KAC3D,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,OAAO;YACZ,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,cAAc;SACpB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,IAAI;YACJ,UAAU,EAAE,UAAU,CAAC,IAAI,CACzB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACjD;gBACC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,iBAAiB,EAAE;YACjB,WAAW,EAAE,KAAK,CAAC,IAAI;YACvB,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SACjC;QACD,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type KeyingVerificationResult,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyExternalAuthority,\n type PrincipalPolicySignerPublicKey,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicy,\n verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n bundle: Pick<PrincipalPolicyBundleResponse, \"currentState\">,\n): ReferencedPrincipalHead {\n return {\n principalType: bundle.currentState.principalType,\n principalId: bundle.currentState.principalId,\n version: bundle.currentState.version,\n keyEpoch: bundle.currentState.keyEpoch,\n stateHash: bundle.currentState.stateHash,\n keyFingerprint: bundle.currentState.keyFingerprint,\n };\n}\n\nexport function organizationAdminSignerUserIds(\n policy: Pick<VerifiedPrincipalPolicy, \"projection\">,\n): string[] {\n return [\n ...new Set(\n policy.projection\n .filter((member) => member.role === \"admin\")\n .map((member) => member.userId),\n ),\n ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n const history = policy.history ?? [\n {\n state: policy.state,\n projection: policy.projection,\n grants: policy.grants,\n },\n ];\n const toHead = (state: (typeof history)[number][\"state\"]) => ({\n principalType: \"group\" as const,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: state.stateHash,\n keyFingerprint: state.keyFingerprint,\n });\n return {\n currentHead: toHead(policy.state),\n states: history.map((entry) => ({\n head: toHead(entry.state),\n projection: entry.projection,\n })),\n };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n readonly organizationId: string;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n if (\n input.bundle.currentState.principalType !== \"organization\" ||\n input.bundle.currentState.principalId !== input.organizationId\n ) {\n return {\n ok: false,\n error: new KeyingVerificationError(\n \"object_mismatch\",\n \"organization policy does not match the expected organization\",\n ),\n };\n }\n\n return verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly expectedReference: ReferencedPrincipalHead;\n readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n const verified = await verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n expectedReference: input.expectedReference,\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n if (verified.ok || verified.error.code !== \"unauthorized\") {\n return verified;\n }\n\n const externalAuthority = await input.loadExternalAuthority();\n if (!externalAuthority) {\n return verified;\n }\n\n const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n externalAuthority,\n expectedReference: input.expectedReference,\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n\n return verifiedWithExternalAdmins;\n}\n\n/**\n * Whether served Admins evidence could make this bundle verify. It re-runs\n * the verifier with an optimistic authority in which every Admins head the\n * chain cites lists its citing signer as an admin. A bundle that still fails\n * cannot be authorized by any evidence (for example a non-admin signer with\n * no external citation), so its refusal is a real verification failure\n * rather than missing evidence. The optimistic authority is never trusted\n * for anything else: the caller caches nothing either way.\n */\nexport async function externalAuthorityCouldAuthorize(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly expectedReference: ReferencedPrincipalHead;\n readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<boolean> {\n const states = [\n input.bundle.currentState,\n ...input.bundle.previousStates.map((entry) => entry.state),\n ];\n const optimistic = new Map<\n string,\n PrincipalPolicyExternalAuthority[\"states\"][number]\n >();\n for (const state of states) {\n const head = state.externalAuthority;\n if (!head) continue;\n const key = JSON.stringify([\n head.principalType,\n head.principalId,\n head.version,\n head.keyEpoch,\n head.stateHash,\n head.keyFingerprint,\n ]);\n const projection = optimistic.get(key)?.projection ?? [];\n optimistic.set(key, {\n head,\n projection: projection.some(\n (member) => member.userId === state.signerUserId,\n )\n ? projection\n : [...projection, { userId: state.signerUserId, role: \"admin\" }],\n });\n }\n const [first] = optimistic.values();\n if (!first) return false;\n const verified = await verifyPrincipalPolicyBundle({\n bundle: input.bundle,\n expectedReference: input.expectedReference,\n externalAuthority: {\n currentHead: first.head,\n states: [...optimistic.values()],\n },\n localCheckpoint: input.localCheckpoint ?? null,\n signerPublicKeys: input.signerPublicKeys,\n });\n return verified.ok;\n}\n"]}
|
|
@@ -215,7 +215,7 @@ export declare const createContainerOperation: Omit<{
|
|
|
215
215
|
error: string;
|
|
216
216
|
}>>;
|
|
217
217
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
218
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
218
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
219
219
|
error: z.ZodString;
|
|
220
220
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
221
221
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -581,7 +581,7 @@ export declare const createContainerOperation: Omit<{
|
|
|
581
581
|
error: string;
|
|
582
582
|
}>>;
|
|
583
583
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
584
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
584
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
585
585
|
error: z.ZodString;
|
|
586
586
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
587
587
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -1442,7 +1442,7 @@ export declare const createContainerWithMetadataDocumentOperation: Omit<{
|
|
|
1442
1442
|
error: string;
|
|
1443
1443
|
}>>;
|
|
1444
1444
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
1445
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
1445
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
1446
1446
|
error: z.ZodString;
|
|
1447
1447
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
1448
1448
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -2016,7 +2016,7 @@ export declare const createContainerWithMetadataDocumentOperation: Omit<{
|
|
|
2016
2016
|
error: string;
|
|
2017
2017
|
}>>;
|
|
2018
2018
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
2019
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
2019
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
2020
2020
|
error: z.ZodString;
|
|
2021
2021
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
2022
2022
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -2288,7 +2288,7 @@ export declare const shareContainerOperation: Omit<{
|
|
|
2288
2288
|
error: string;
|
|
2289
2289
|
}>>;
|
|
2290
2290
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
2291
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
2291
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
2292
2292
|
error: z.ZodString;
|
|
2293
2293
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
2294
2294
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -2656,7 +2656,7 @@ export declare const shareContainerOperation: Omit<{
|
|
|
2656
2656
|
error: string;
|
|
2657
2657
|
}>>;
|
|
2658
2658
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
2659
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
2659
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
2660
2660
|
error: z.ZodString;
|
|
2661
2661
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
2662
2662
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -2856,7 +2856,7 @@ export declare const reciteContainerOperation: Omit<{
|
|
|
2856
2856
|
error: string;
|
|
2857
2857
|
}>>;
|
|
2858
2858
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
2859
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
2859
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
2860
2860
|
error: z.ZodString;
|
|
2861
2861
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
2862
2862
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -3100,7 +3100,7 @@ export declare const reciteContainerOperation: Omit<{
|
|
|
3100
3100
|
error: string;
|
|
3101
3101
|
}>>;
|
|
3102
3102
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
3103
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
3103
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
3104
3104
|
error: z.ZodString;
|
|
3105
3105
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
3106
3106
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -3524,7 +3524,7 @@ export declare const revokeContainerOperation: Omit<{
|
|
|
3524
3524
|
error: string;
|
|
3525
3525
|
}>>;
|
|
3526
3526
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
3527
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
3527
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
3528
3528
|
error: z.ZodString;
|
|
3529
3529
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
3530
3530
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -4132,7 +4132,7 @@ export declare const revokeContainerOperation: Omit<{
|
|
|
4132
4132
|
error: string;
|
|
4133
4133
|
}>>;
|
|
4134
4134
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
4135
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
4135
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
4136
4136
|
error: z.ZodString;
|
|
4137
4137
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
4138
4138
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -4556,7 +4556,7 @@ export declare const rekeyContainerOperation: Omit<{
|
|
|
4556
4556
|
error: string;
|
|
4557
4557
|
}>>;
|
|
4558
4558
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
4559
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
4559
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
4560
4560
|
error: z.ZodString;
|
|
4561
4561
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
4562
4562
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -5164,7 +5164,7 @@ export declare const rekeyContainerOperation: Omit<{
|
|
|
5164
5164
|
error: string;
|
|
5165
5165
|
}>>;
|
|
5166
5166
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
5167
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
5167
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
5168
5168
|
error: z.ZodString;
|
|
5169
5169
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
5170
5170
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -5588,7 +5588,7 @@ export declare const moveContainerOperation: Omit<{
|
|
|
5588
5588
|
error: string;
|
|
5589
5589
|
}>>;
|
|
5590
5590
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
5591
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
5591
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
5592
5592
|
error: z.ZodString;
|
|
5593
5593
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
5594
5594
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -6196,7 +6196,7 @@ export declare const moveContainerOperation: Omit<{
|
|
|
6196
6196
|
error: string;
|
|
6197
6197
|
}>>;
|
|
6198
6198
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
6199
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
6199
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
6200
6200
|
error: z.ZodString;
|
|
6201
6201
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
6202
6202
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -6314,7 +6314,7 @@ export declare const deleteContainerOperation: Omit<{
|
|
|
6314
6314
|
error: string;
|
|
6315
6315
|
}>>;
|
|
6316
6316
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
6317
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
6317
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
6318
6318
|
error: z.ZodString;
|
|
6319
6319
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
6320
6320
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -6452,7 +6452,7 @@ export declare const deleteContainerOperation: Omit<{
|
|
|
6452
6452
|
error: string;
|
|
6453
6453
|
}>>;
|
|
6454
6454
|
readonly 409: z.ZodUnion<readonly [z.ZodObject<{
|
|
6455
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
6455
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
6456
6456
|
error: z.ZodString;
|
|
6457
6457
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
6458
6458
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -2814,6 +2814,18 @@ export declare const commitOrganizationGroupPolicyOperation: Omit<{
|
|
|
2814
2814
|
code: "container_descendant_rekeys_required";
|
|
2815
2815
|
error: string;
|
|
2816
2816
|
requiredContainerIds: string[];
|
|
2817
|
+
}>>, z.ZodType<{
|
|
2818
|
+
code: "container_mutation_state_stale";
|
|
2819
|
+
error: string;
|
|
2820
|
+
}, {
|
|
2821
|
+
code: "container_mutation_state_stale";
|
|
2822
|
+
error: string;
|
|
2823
|
+
}, z.core.$ZodTypeInternals<{
|
|
2824
|
+
code: "container_mutation_state_stale";
|
|
2825
|
+
error: string;
|
|
2826
|
+
}, {
|
|
2827
|
+
code: "container_mutation_state_stale";
|
|
2828
|
+
error: string;
|
|
2817
2829
|
}>>]>;
|
|
2818
2830
|
readonly 500: z.ZodType<{
|
|
2819
2831
|
error: string;
|
|
@@ -4435,6 +4447,18 @@ export declare const commitOrganizationGroupPolicyOperation: Omit<{
|
|
|
4435
4447
|
code: "container_descendant_rekeys_required";
|
|
4436
4448
|
error: string;
|
|
4437
4449
|
requiredContainerIds: string[];
|
|
4450
|
+
}>>, z.ZodType<{
|
|
4451
|
+
code: "container_mutation_state_stale";
|
|
4452
|
+
error: string;
|
|
4453
|
+
}, {
|
|
4454
|
+
code: "container_mutation_state_stale";
|
|
4455
|
+
error: string;
|
|
4456
|
+
}, z.core.$ZodTypeInternals<{
|
|
4457
|
+
code: "container_mutation_state_stale";
|
|
4458
|
+
error: string;
|
|
4459
|
+
}, {
|
|
4460
|
+
code: "container_mutation_state_stale";
|
|
4461
|
+
error: string;
|
|
4438
4462
|
}>>]>;
|
|
4439
4463
|
readonly 500: z.ZodType<{
|
|
4440
4464
|
error: string;
|
|
@@ -8,11 +8,11 @@ export declare const CONTAINER_MUTATION_ERROR_CODES: {
|
|
|
8
8
|
readonly pathTooDeep: "container_path_too_deep";
|
|
9
9
|
readonly stateStale: "container_mutation_state_stale";
|
|
10
10
|
};
|
|
11
|
-
export declare const ContainerMutationBehaviorErrorCodeSchema: z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
12
|
-
export declare const ContainerMutationErrorCodeSchema: z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
11
|
+
export declare const ContainerMutationBehaviorErrorCodeSchema: z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">;
|
|
12
|
+
export declare const ContainerMutationErrorCodeSchema: z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>;
|
|
13
13
|
export type ContainerMutationErrorCode = z.infer<typeof ContainerMutationErrorCodeSchema>;
|
|
14
14
|
export declare const ContainerMutationFailureResponseSchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
15
|
-
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep"
|
|
15
|
+
code: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"container_mutation_state_stale" | "container_descendant_rekeys_required" | "container_ancestor_rekeys_required" | "container_descendant_rekeys_inaccessible" | "container_manifest_already_exists" | "container_path_too_deep">, z.ZodUnion<readonly [z.ZodLiteral<"document_manifest_already_exists">, z.ZodLiteral<"document_sync_checkpoint_coverage_conflict" | "document_sync_conflict" | "document_sync_descendant_rekeys_required" | "document_sync_state_stale" | "document_sync_update_id_conflict">, z.ZodLiteral<"document_not_found">, z.ZodLiteral<"container_unavailable">]>]>>;
|
|
16
16
|
error: z.ZodString;
|
|
17
17
|
requiredContainerIds: z.ZodOptional<z.ZodCustom<string[], string[]>>;
|
|
18
18
|
}, z.core.$loose>, z.ZodType<{
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
2
|
import { arraySchema, nonEmptyStringSchema } from "../schema.js";
|
|
3
3
|
import { MAX_ROTATION_CONTAINER_REKEYS } from "../util/index.js";
|
|
4
|
+
import { CONTAINER_MUTATION_STATE_STALE_ERROR_CODE } from "./containerMutationStateStaleError.js";
|
|
4
5
|
import { CONTAINER_UNAVAILABLE_ERROR_CODE } from "./containerUnavailableError.js";
|
|
5
6
|
import { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from "./descendantRekeysRequiredError.js";
|
|
6
7
|
import { DocumentMutationErrorCodeSchema } from "./documentMutationError.js";
|
|
@@ -25,7 +26,7 @@ export const CONTAINER_MUTATION_ERROR_CODES = {
|
|
|
25
26
|
// request never succeeds: a queued move is abandoned, while a queued create
|
|
26
27
|
// keeps its intent (a later local move can re-arm it).
|
|
27
28
|
pathTooDeep: "container_path_too_deep",
|
|
28
|
-
stateStale:
|
|
29
|
+
stateStale: CONTAINER_MUTATION_STATE_STALE_ERROR_CODE,
|
|
29
30
|
};
|
|
30
31
|
export const ContainerMutationBehaviorErrorCodeSchema = z.literal([
|
|
31
32
|
CONTAINER_MUTATION_ERROR_CODES.ancestorRekeysRequired,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"containerMutationError.js","sourceRoot":"","sources":["containerMutationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,8EAA8E;IAC9E,2CAA2C;IAC3C,sBAAsB,EAAE,oCAAoC;IAC5D,oBAAoB,EAAE,gCAAgC;IACtD,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,wBAAwB,EAAE,+CAA+C;IACzE,4EAA4E;IAC5E,+EAA+E;IAC/E,4BAA4B,EAAE,0CAA0C;IACxE,qBAAqB,EAAE,mCAAmC;IAC1D,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,WAAW,EAAE,yBAAyB;IACtC,UAAU,EAAE,
|
|
1
|
+
{"version":3,"file":"containerMutationError.js","sourceRoot":"","sources":["containerMutationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,yCAAyC,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,8EAA8E;IAC9E,2CAA2C;IAC3C,sBAAsB,EAAE,oCAAoC;IAC5D,oBAAoB,EAAE,gCAAgC;IACtD,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,wBAAwB,EAAE,+CAA+C;IACzE,4EAA4E;IAC5E,+EAA+E;IAC/E,4BAA4B,EAAE,0CAA0C;IACxE,qBAAqB,EAAE,mCAAmC;IAC1D,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,WAAW,EAAE,yBAAyB;IACtC,UAAU,EAAE,yCAAyC;CAC7C,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,OAAO,CAAC;IAChE,8BAA8B,CAAC,sBAAsB;IACrD,8BAA8B,CAAC,wBAAwB;IACvD,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,qBAAqB;IACpD,8BAA8B,CAAC,WAAW;IAC1C,8BAA8B,CAAC,UAAU;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC;IACtD,wCAAwC;IACxC,0EAA0E;IAC1E,2EAA2E;IAC3E,+BAA+B;CAChC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC,CAAC,WAAW,CAAC;QACZ,IAAI,EAAE,gCAAgC,CAAC,QAAQ,EAAE;QACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,iFAAiF;QACjF,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B,CAAC,QAAQ,EAAE;KACb,CAAC;IACF,uCAAuC;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { CONTAINER_MUTATION_STATE_STALE_ERROR_CODE } from \"./containerMutationStateStaleError\";\nimport { CONTAINER_UNAVAILABLE_ERROR_CODE } from \"./containerUnavailableError\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { DocumentMutationErrorCodeSchema } from \"./documentMutationError\";\nimport { PrincipalPolicyStaleErrorResponseSchema } from \"./principal\";\n\nexport const CONTAINER_MUTATION_ERROR_CODES = {\n // Same literal as DOCUMENT_MUTATION_ERROR_CODES.containerUnavailable; the\n // envelope schema below already admits it through the document union.\n // A first direct grant sits below a chain pinned to a retired epoch, which\n // its grantee could never re-key. Not `stateStale`: refetching will not help,\n // the sharer must re-key that chain first.\n ancestorRekeysRequired: \"container_ancestor_rekeys_required\",\n containerUnavailable: CONTAINER_UNAVAILABLE_ERROR_CODE,\n // A rotation left a descendant above a granted container pinned to a retired\n // epoch. Not `stateStale`: refetching will not help, the client must sign and\n // carry the re-keys `requiredContainerIds` names.\n descendantRekeysRequired: CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE,\n // The revoke removes the caller's write access on owed descendants. Another\n // authorized member must perform it; retrying with carried rekeys cannot help.\n descendantRekeysInaccessible: \"container_descendant_rekeys_inaccessible\",\n manifestAlreadyExists: \"container_manifest_already_exists\",\n // A create or move would leave a path longer than readers accept. The same\n // request never succeeds: a queued move is abandoned, while a queued create\n // keeps its intent (a later local move can re-arm it).\n pathTooDeep: \"container_path_too_deep\",\n stateStale: CONTAINER_MUTATION_STATE_STALE_ERROR_CODE,\n} as const;\n\nexport const ContainerMutationBehaviorErrorCodeSchema = z.literal([\n CONTAINER_MUTATION_ERROR_CODES.ancestorRekeysRequired,\n CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired,\n CONTAINER_MUTATION_ERROR_CODES.descendantRekeysInaccessible,\n CONTAINER_MUTATION_ERROR_CODES.manifestAlreadyExists,\n CONTAINER_MUTATION_ERROR_CODES.pathTooDeep,\n CONTAINER_MUTATION_ERROR_CODES.stateStale,\n]);\n\nexport const ContainerMutationErrorCodeSchema = z.union([\n ContainerMutationBehaviorErrorCodeSchema,\n // The compound container-plus-metadata-document create can fail in either\n // half of its transaction, so its envelope preserves document-domain tags.\n DocumentMutationErrorCodeSchema,\n]);\n\nexport type ContainerMutationErrorCode = z.infer<\n typeof ContainerMutationErrorCodeSchema\n>;\n\nexport const ContainerMutationFailureResponseSchema = z.union([\n z.looseObject({\n code: ContainerMutationErrorCodeSchema.optional(),\n error: z.string().min(1),\n /** Parent-first; owed levels, or the inaccessible subset on a refused revoke. */\n requiredContainerIds: arraySchema(\n nonEmptyStringSchema,\n MAX_ROTATION_CONTAINER_REKEYS,\n ).optional(),\n }),\n PrincipalPolicyStaleErrorResponseSchema,\n]);\n\nexport type ContainerMutationFailureResponse = z.infer<\n typeof ContainerMutationFailureResponseSchema\n>;\n"]}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"containerMutationStateStaleError.js","sourceRoot":"","sources":["containerMutationStateStaleError.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GACpD,gCAAgC,CAAC","sourcesContent":["/** A refused container mutation can be replanned against fresh served heads. */\nexport const CONTAINER_MUTATION_STATE_STALE_ERROR_CODE =\n \"container_mutation_state_stale\";\n"]}
|
|
@@ -2628,6 +2628,18 @@ export declare const CommitOrganizationGroupPolicyConflictResponseSchema: z.ZodU
|
|
|
2628
2628
|
code: "container_descendant_rekeys_required";
|
|
2629
2629
|
error: string;
|
|
2630
2630
|
requiredContainerIds: string[];
|
|
2631
|
+
}>>, z.ZodType<{
|
|
2632
|
+
code: "container_mutation_state_stale";
|
|
2633
|
+
error: string;
|
|
2634
|
+
}, {
|
|
2635
|
+
code: "container_mutation_state_stale";
|
|
2636
|
+
error: string;
|
|
2637
|
+
}, z.core.$ZodTypeInternals<{
|
|
2638
|
+
code: "container_mutation_state_stale";
|
|
2639
|
+
error: string;
|
|
2640
|
+
}, {
|
|
2641
|
+
code: "container_mutation_state_stale";
|
|
2642
|
+
error: string;
|
|
2631
2643
|
}>>]>;
|
|
2632
2644
|
export declare const PrincipalPolicyStaleErrorResponseSchema: z.ZodType<{
|
|
2633
2645
|
code: "principal_policy_stale";
|
|
@@ -3,6 +3,7 @@ import { arraySchema, loosePlainObject, nonEmptyStringSchema } from "../schema.j
|
|
|
3
3
|
import { MAX_ROTATION_CONTAINER_REKEYS } from "../util/index.js";
|
|
4
4
|
import { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from "../util/principalHistoryWire.js";
|
|
5
5
|
import { ContainerMutationResponseSchema } from "./container.js";
|
|
6
|
+
import { CONTAINER_MUTATION_STATE_STALE_ERROR_CODE } from "./containerMutationStateStaleError.js";
|
|
6
7
|
import { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from "./descendantRekeysRequiredError.js";
|
|
7
8
|
import { BillingErrorResponseSchema } from "./organizationBilling.js";
|
|
8
9
|
import { ReferencedPrincipalStateResponseSchema } from "./principalReference.js";
|
|
@@ -48,6 +49,10 @@ const PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({
|
|
|
48
49
|
export const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([
|
|
49
50
|
PrincipalPolicyErrorResponseSchema,
|
|
50
51
|
PrincipalPolicyDescendantRekeysRequiredResponseSchema,
|
|
52
|
+
loosePlainObject({
|
|
53
|
+
code: z.literal(CONTAINER_MUTATION_STATE_STALE_ERROR_CODE),
|
|
54
|
+
error: z.string().min(1),
|
|
55
|
+
}),
|
|
51
56
|
]);
|
|
52
57
|
export const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({
|
|
53
58
|
code: z.literal("principal_policy_stale"),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,YAAY,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;
|
|
1
|
+
{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,yCAAyC,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,YAAY,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;IACrD,gBAAgB,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,gBAAgB,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,WAAW,CACzB,sCAAsC,EACtC,kCAAkC,CACnC;CACF,CAAC,CAAC;AAMH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,OAAO,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, loosePlainObject, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from \"../util/principalHistoryWire\";\nimport { ContainerMutationResponseSchema } from \"./container\";\nimport { CONTAINER_MUTATION_STATE_STALE_ERROR_CODE } from \"./containerMutationStateStaleError\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { BillingErrorResponseSchema } from \"./organizationBilling\";\nimport { ReferencedPrincipalStateResponseSchema } from \"./principalReference\";\n\nimport {\n CurrentPrincipalMemberEnvelopesResponseSchema,\n PrincipalContainerGrantResponseSchema,\n PrincipalPolicyStateChainEntryResponseSchema,\n PrincipalProjectionMemberResponseSchema,\n PrincipalStatePayloadResponseSchema,\n PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport {\n type CurrentPrincipalMemberEnvelopesResponse,\n CurrentPrincipalMemberEnvelopesResponseSchema,\n isCurrentPrincipalMemberEnvelopesResponse,\n isPrincipalPolicyStateChainEntryResponse,\n isPrincipalStatePayloadResponse,\n isPrincipalStateResponse,\n type PrincipalContainerGrantResponse,\n PrincipalContainerGrantResponseSchema,\n type PrincipalMemberEnvelopeResponse,\n PrincipalMemberEnvelopeResponseSchema,\n type PrincipalPolicySnapshotResponse,\n PrincipalPolicySnapshotResponseSchema,\n type PrincipalPolicyStateChainEntryResponse,\n PrincipalPolicyStateChainEntryResponseSchema,\n type PrincipalProjectionMemberResponse,\n PrincipalProjectionMemberResponseSchema,\n type PrincipalStateExternalAuthorityResponse,\n PrincipalStateExternalAuthorityResponseSchema,\n type PrincipalStatePayloadResponse,\n PrincipalStatePayloadResponseSchema,\n type PrincipalStateResponse,\n PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport const principalPolicyCurrentResponseShape = {\n currentGrants: arraySchema(PrincipalContainerGrantResponseSchema),\n currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponseSchema,\n currentPayload: PrincipalStatePayloadResponseSchema,\n currentProjection: arraySchema(PrincipalProjectionMemberResponseSchema),\n currentState: PrincipalStateResponseSchema,\n};\n\nexport const PrincipalPolicyBundleResponseSchema = loosePlainObject({\n ...principalPolicyCurrentResponseShape,\n previousStates: arraySchema(PrincipalPolicyStateChainEntryResponseSchema),\n});\n\nexport type PrincipalPolicyBundleResponse = z.infer<\n typeof PrincipalPolicyBundleResponseSchema\n>;\n\nexport const PrincipalPolicyMutationResponseSchema = loosePlainObject({\n ...principalPolicyCurrentResponseShape,\n containerMutations: arraySchema(ContainerMutationResponseSchema),\n});\n\nexport type PrincipalPolicyMutationResponse = z.infer<\n typeof PrincipalPolicyMutationResponseSchema\n>;\n\nexport const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({\n groupPolicy: PrincipalPolicyMutationResponseSchema,\n memberPolicy: PrincipalPolicyMutationResponseSchema.optional(),\n organizationPolicy: PrincipalPolicyMutationResponseSchema,\n});\n\nexport type CommitOrganizationGroupPolicyResponse = z.infer<\n typeof CommitOrganizationGroupPolicyResponseSchema\n>;\n\nexport const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;\n\nexport type PrincipalPolicyErrorResponse = z.infer<\n typeof PrincipalPolicyErrorResponseSchema\n>;\n\n/**\n * A group policy change rematerializes its granted containers, and a rekey or\n * revoke among them is a rotation like any other: one that would leave a level\n * above a directly granted container pinned to a retired epoch is refused, and\n * this names the descendant rekeys the batch must carry, parent-first.\n */\nconst PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({\n code: z.literal(CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE),\n error: z.string().min(1),\n requiredContainerIds: arraySchema(\n nonEmptyStringSchema,\n MAX_ROTATION_CONTAINER_REKEYS,\n ),\n});\n\n/**\n * The commit's conflict envelope alone: only a group commit carries container\n * mutations, so only it can be refused for what they strand. The principal\n * policy read and the organization policy write keep the plain envelope.\n */\nexport const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([\n PrincipalPolicyErrorResponseSchema,\n PrincipalPolicyDescendantRekeysRequiredResponseSchema,\n loosePlainObject({\n code: z.literal(CONTAINER_MUTATION_STATE_STALE_ERROR_CODE),\n error: z.string().min(1),\n }),\n]);\n\nexport const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({\n code: z.literal(\"principal_policy_stale\"),\n error: z.string().min(1),\n principalHeads: arraySchema(\n ReferencedPrincipalStateResponseSchema,\n PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT,\n ),\n});\n\nexport type PrincipalPolicyStaleErrorResponse = z.infer<\n typeof PrincipalPolicyStaleErrorResponseSchema\n>;\n\nexport function isPrincipalPolicyBundleResponse(\n value: unknown,\n): value is PrincipalPolicyBundleResponse {\n return PrincipalPolicyBundleResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyMutationResponse(\n value: unknown,\n): value is PrincipalPolicyMutationResponse {\n return PrincipalPolicyMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyResponse(\n value: unknown,\n): value is CommitOrganizationGroupPolicyResponse {\n return CommitOrganizationGroupPolicyResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyStaleErrorResponse(\n value: unknown,\n): value is PrincipalPolicyStaleErrorResponse {\n return PrincipalPolicyStaleErrorResponseSchema.safeParse(value).success;\n}\n"]}
|
package/package.json
CHANGED
package/workflows/containers/rematerialization/acknowledgePrincipalContainerRematerialization.js
ADDED
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
import { rememberVerifiedContainerHeads } from "../../../data/containers/shared/heldContainerHeads.js";
|
|
2
|
+
import { acknowledgeContainerMutationBatch } from "../../../data/containers/shared/mutationAcknowledgement.js";
|
|
3
|
+
import { scheduleHeldDescendantRecitations } from "../child/recite.js";
|
|
4
|
+
export async function acknowledgePrincipalContainerRematerialization(input, entries, responses, stillCurrent) {
|
|
5
|
+
const isCurrent = () => input.stillCurrent?.() !== false && stillCurrent?.() !== false;
|
|
6
|
+
const heads = entries.map((entry) => entry.planned.plan);
|
|
7
|
+
const acknowledged = await acknowledgeContainerMutationBatch({
|
|
8
|
+
execSql: input.execSql,
|
|
9
|
+
plans: heads,
|
|
10
|
+
responses,
|
|
11
|
+
stillCurrent: isCurrent,
|
|
12
|
+
});
|
|
13
|
+
if (!acknowledged || !isCurrent())
|
|
14
|
+
return;
|
|
15
|
+
const plansByOrganization = new Map();
|
|
16
|
+
for (const head of heads) {
|
|
17
|
+
const organizationId = head.state.organizationId;
|
|
18
|
+
const group = plansByOrganization.get(organizationId) ?? [];
|
|
19
|
+
group.push(head);
|
|
20
|
+
plansByOrganization.set(organizationId, group);
|
|
21
|
+
}
|
|
22
|
+
for (const [organizationId, organizationPlans] of plansByOrganization) {
|
|
23
|
+
try {
|
|
24
|
+
rememberVerifiedContainerHeads({
|
|
25
|
+
organizationId,
|
|
26
|
+
execSql: input.execSql,
|
|
27
|
+
heads: [],
|
|
28
|
+
policies: [input.nextPolicy],
|
|
29
|
+
});
|
|
30
|
+
}
|
|
31
|
+
catch {
|
|
32
|
+
// Cache failure must not invalidate the durably acknowledged batch.
|
|
33
|
+
continue;
|
|
34
|
+
}
|
|
35
|
+
scheduleHeldDescendantRecitations({
|
|
36
|
+
apiClient: input.apiClient,
|
|
37
|
+
author: { ...input.author, organizationId },
|
|
38
|
+
execSql: input.execSql,
|
|
39
|
+
plans: organizationPlans,
|
|
40
|
+
stillCurrent: input.recitationStillCurrent ?? isCurrent,
|
|
41
|
+
reportSecurityIncident: input.reportSecurityIncident,
|
|
42
|
+
});
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
//# sourceMappingURL=acknowledgePrincipalContainerRematerialization.js.map
|
package/workflows/containers/rematerialization/acknowledgePrincipalContainerRematerialization.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"acknowledgePrincipalContainerRematerialization.js","sourceRoot":"","sources":["acknowledgePrincipalContainerRematerialization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,yDAAyD,CAAC;AAC5G,OAAO,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AAIpE,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,KAA+C,EAC/C,OAA4C,EAC5C,SAA+C,EAC/C,YAA0C;IAE1C,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;QAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,SAAS;QACT,YAAY,EAAE,SAAS;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,mBAAmB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,8BAA8B,CAAC;gBAC7B,cAAc;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,iCAAiC,CAAC;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,iBAAiB;YACxB,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,SAAS;YACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import type { ContainerMutationResponse } from \"@tearleads/validators/response\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { acknowledgeContainerMutationBatch } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { scheduleHeldDescendantRecitations } from \"../child/recite\";\nimport type { PrincipalContainerRematerializationInput } from \"./principalContainerRematerializationPlanning\";\nimport type { PlannedRematerialization } from \"./principalContainerRematerializationTargets\";\n\nexport async function acknowledgePrincipalContainerRematerialization(\n input: PrincipalContainerRematerializationInput,\n entries: readonly PlannedRematerialization[],\n responses: readonly ContainerMutationResponse[],\n stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n const isCurrent = () =>\n input.stillCurrent?.() !== false && stillCurrent?.() !== false;\n const heads = entries.map((entry) => entry.planned.plan);\n const acknowledged = await acknowledgeContainerMutationBatch({\n execSql: input.execSql,\n plans: heads,\n responses,\n stillCurrent: isCurrent,\n });\n if (!acknowledged || !isCurrent()) return;\n const plansByOrganization = new Map<\n string,\n AuthoredContainerMutationHead[]\n >();\n for (const head of heads) {\n const organizationId = head.state.organizationId;\n const group = plansByOrganization.get(organizationId) ?? [];\n group.push(head);\n plansByOrganization.set(organizationId, group);\n }\n for (const [organizationId, organizationPlans] of plansByOrganization) {\n try {\n rememberVerifiedContainerHeads({\n organizationId,\n execSql: input.execSql,\n heads: [],\n policies: [input.nextPolicy],\n });\n } catch {\n // Cache failure must not invalidate the durably acknowledged batch.\n continue;\n }\n scheduleHeldDescendantRecitations({\n apiClient: input.apiClient,\n author: { ...input.author, organizationId },\n execSql: input.execSql,\n plans: organizationPlans,\n stillCurrent: input.recitationStillCurrent ?? isCurrent,\n reportSecurityIncident: input.reportSecurityIncident,\n });\n }\n}\n"]}
|
|
@@ -1,15 +1,14 @@
|
|
|
1
|
-
import { rememberVerifiedContainerHeads } from "../../../data/containers/shared/heldContainerHeads.js";
|
|
2
|
-
import { acknowledgeContainerMutationBatch } from "../../../data/containers/shared/mutationAcknowledgement.js";
|
|
3
1
|
import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
|
|
4
2
|
import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
|
|
3
|
+
import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
|
|
5
4
|
import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
|
|
6
|
-
import { scheduleHeldDescendantRecitations } from "../child/recite.js";
|
|
7
5
|
import { buildMaterializedContainerRekeyPlan } from "../child/rekey/index.js";
|
|
8
6
|
import { rebaseOnDeepestAncestor } from "../child/rekey/carriedDescendantRekeys.js";
|
|
9
7
|
import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../child/rekey/rekeyProjection.js";
|
|
10
8
|
import { buildMaterializedContainerRevokePlan } from "../child/revoke.js";
|
|
11
9
|
import { selectReplacementPrincipalPolicyReferences } from "../child/rotation/replacementPrincipalPolicyReferences.js";
|
|
12
10
|
import { buildMaterializedContainerSharePlan } from "../child/share/shareMaterialization.js";
|
|
11
|
+
import { acknowledgePrincipalContainerRematerialization } from "./acknowledgePrincipalContainerRematerialization.js";
|
|
13
12
|
import { withPrecedingRematerialization } from "./precedingPrincipalRematerialization.js";
|
|
14
13
|
import { addPlan, assertNamedContainersRotated, carryLevel, planOnceMoreAfterRollback, rerootOnAuthoredPaths, staleLevelsAbove, } from "./principalContainerRematerializationPlanning.js";
|
|
15
14
|
import { loadRematerializationTargets, loadServedProjection, seededPrincipalPolicyCache, } from "./principalContainerRematerializationTargets.js";
|
|
@@ -57,9 +56,6 @@ async function loadGrantedContainerContext(input, grantRow, projection, principa
|
|
|
57
56
|
export async function buildPrincipalContainerRematerializationBatch(input) {
|
|
58
57
|
return (await buildPrincipalContainerRematerializationPlans(input)).entries.map((entry) => entry.planned.plan.request);
|
|
59
58
|
}
|
|
60
|
-
function authoredMutationHead(planned) {
|
|
61
|
-
return planned.plan;
|
|
62
|
-
}
|
|
63
59
|
async function buildPrincipalContainerRematerializationPlan(input) {
|
|
64
60
|
const { grantRow } = input;
|
|
65
61
|
const rematerialization = {
|
|
@@ -249,6 +245,20 @@ export async function preparePrincipalContainerRematerializationBatch(input) {
|
|
|
249
245
|
get requests() {
|
|
250
246
|
return requests();
|
|
251
247
|
},
|
|
248
|
+
refreshAfterConflict: async () => {
|
|
249
|
+
assertProjectionVerificationCurrent(input.stillCurrent);
|
|
250
|
+
for (const containerId of new Set([
|
|
251
|
+
...input.grants.map((grant) => grant.containerId),
|
|
252
|
+
...entries.map((entry) => entry.planned.plan.containerId),
|
|
253
|
+
])) {
|
|
254
|
+
input.apiClient.evictContainerWriterProjection?.(containerId);
|
|
255
|
+
}
|
|
256
|
+
const replanned = await buildPrincipalContainerRematerializationPlans(input);
|
|
257
|
+
entries = replanned.entries;
|
|
258
|
+
retiredContainerIds = replanned.retiredContainerIds;
|
|
259
|
+
preceding = replanned.preceding;
|
|
260
|
+
return requests();
|
|
261
|
+
},
|
|
252
262
|
carry: async (requiredContainerIds) => {
|
|
253
263
|
// The refused attempt rolled back whole, so every served head still
|
|
254
264
|
// stands; the batch is signed again from them with the named levels in.
|
|
@@ -259,47 +269,7 @@ export async function preparePrincipalContainerRematerializationBatch(input) {
|
|
|
259
269
|
preceding = replanned.preceding;
|
|
260
270
|
return requests();
|
|
261
271
|
},
|
|
262
|
-
acknowledge:
|
|
263
|
-
const isCurrent = () => input.stillCurrent?.() !== false && stillCurrent?.() !== false;
|
|
264
|
-
const heads = entries.map((entry) => authoredMutationHead(entry.planned));
|
|
265
|
-
const acknowledged = await acknowledgeContainerMutationBatch({
|
|
266
|
-
execSql: input.execSql,
|
|
267
|
-
plans: heads,
|
|
268
|
-
responses,
|
|
269
|
-
stillCurrent: isCurrent,
|
|
270
|
-
});
|
|
271
|
-
if (!acknowledged || !isCurrent())
|
|
272
|
-
return;
|
|
273
|
-
const plansByOrganization = new Map();
|
|
274
|
-
for (const head of heads) {
|
|
275
|
-
const organizationId = head.state.organizationId;
|
|
276
|
-
const group = plansByOrganization.get(organizationId) ?? [];
|
|
277
|
-
group.push(head);
|
|
278
|
-
plansByOrganization.set(organizationId, group);
|
|
279
|
-
}
|
|
280
|
-
for (const [organizationId, organizationPlans] of plansByOrganization) {
|
|
281
|
-
try {
|
|
282
|
-
rememberVerifiedContainerHeads({
|
|
283
|
-
organizationId,
|
|
284
|
-
execSql: input.execSql,
|
|
285
|
-
heads: [],
|
|
286
|
-
policies: [input.nextPolicy],
|
|
287
|
-
});
|
|
288
|
-
}
|
|
289
|
-
catch {
|
|
290
|
-
// Cache failure must not invalidate the durably acknowledged batch.
|
|
291
|
-
continue;
|
|
292
|
-
}
|
|
293
|
-
scheduleHeldDescendantRecitations({
|
|
294
|
-
apiClient: input.apiClient,
|
|
295
|
-
author: { ...input.author, organizationId },
|
|
296
|
-
execSql: input.execSql,
|
|
297
|
-
plans: organizationPlans,
|
|
298
|
-
stillCurrent: input.recitationStillCurrent ?? isCurrent,
|
|
299
|
-
reportSecurityIncident: input.reportSecurityIncident,
|
|
300
|
-
});
|
|
301
|
-
}
|
|
302
|
-
},
|
|
272
|
+
acknowledge: (responses, stillCurrent) => acknowledgePrincipalContainerRematerialization(input, entries, responses, stillCurrent),
|
|
303
273
|
};
|
|
304
274
|
}
|
|
305
275
|
//# sourceMappingURL=principalContainerRematerialization.js.map
|