npm - @tearleads/client-sdk - Versions diffs - 0.1.57 → 0.1.59 - Mend

@tearleads/client-sdk 0.1.57 → 0.1.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (414) hide show

package/workflows/container-contents/documentQueries/rows.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rows.js","sourceRoot":"","sources":["rows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAGlF,OAAO,EAEL,sCAAsC,GACvC,MAAM,cAAc,CAAC;AAGtB,MAAM,UAAU,yCAAyC,CACvD,IAAqB,EACrB,KAAsB;IAEtB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,+CAA+C,CACtD,KAAc;IAEd,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,SAAS,wCAAwC,CAC/C,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,gDAAgD,CACvD,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,wCAAwC,CAC/C,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA4B,EAC5B,iBAAyB,EACzB,kBAA0B;IAE1B,MAAM,cAAc,GAAG,gDAAgD,CACrE,GAAG,EACH,iBAAiB,CAClB,CAAC;IACF,MAAM,eAAe,GAAG,gDAAgD,CACtE,GAAG,EACH,kBAAkB,CACnB,CAAC;IAEF,OAAO,CACL,cAAc,KAAK,IAAI;QACvB,CAAC,eAAe,KAAK,IAAI,IAAI,cAAc,GAAG,eAAe,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,GAA4B,EAC5B,OAGC;IAED,OAAO,sCAAsC,CAAC;QAC5C,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,iBAAiB,CAClB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,sBAAsB,EAAE,wCAAwC,CAC9D,GAAG,EACH,0BAA0B,CAC3B;QACD,sBAAsB,EAAE,wCAAwC,CAC9D,GAAG,EACH,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAC1B,wCAAwC,CAAC,GAAG,EAAE,sBAAsB,CAAC,EACrE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA0B,EAC1B,GAA4B;IAE5B,MAAM,QAAQ,GAAG,wCAAwC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;YACD,EAAE,EAAE,wCAAwC,CAAC,GAAG,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,gDAAgD,CAAC,GAAG,EAAE,MAAM,CAAC;YACnE,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,wCAAwC,CAAC,GAAG,EAAE,MAAM,CAAC;YAC3D,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;gBACnD,SAAS,EACP,CAAC,gDAAgD,CAC/C,GAAG,EACH,mBAAmB,CACpB;oBACD,CAAC,gDAAgD,CAC/C,GAAG,EACH,sBAAsB,CACvB;gBACH,qBAAqB,EAAE,wBAAwB,CAC7C,GAAG,EACH,kBAAkB,EAClB,mBAAmB,CACpB;aACF,CAAC;YACF,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW;QACX,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,wCAAwC,CAAC,GAAG,EAAE,SAAS,CAAC;QACjE,IAAI,EAAE,wCAAwC,CAAC,GAAG,EAAE,MAAM,CAAC;QAC3D,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;YACnD,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;SACF,CAAC;QACF,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,GAA4B;IAE5B,OAAO,wCAAwC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA4B;IAE5B,OAAO;QACL,WAAW,EAAE,gDAAgD,CAC3D,GAAG,EACH,cAAc,CACf;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,OAAO,EAAE,wCAAwC,CAAC,GAAG,EAAE,UAAU,CAAC;QAClE,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;YACnD,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;SACF,CAAC;QACF,KAAK,EAAE,wCAAwC,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7D,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,GAA4B;IAE5B,MAAM,OAAO,GAAG,wCAAwC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,eAAe,EAAE,gDAAgD,CAC/D,GAAG,EACH,mBAAmB,CACpB;QACD,oBAAoB,EAAE,6BAA6B,CACjD,gDAAgD,CAC9C,GAAG,EACH,wBAAwB,CACzB,CACF;QACD,EAAE,EAAE,OAAO;QACX,WAAW,EAAE,gDAAgD,CAC3D,GAAG,EACH,cAAc,CACf;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,KAAK,EAAE,wCAAwC,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7D,SAAS,EAAE,wCAAwC,CAAC,GAAG,EAAE,YAAY,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAA4B;IAE5B,OAAO,oCAAoC,CAAC,GAAG,EAAE;QAC/C,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizeEffectiveAccessLevel } from \"../../../data/accessLevel\";\nimport { DEFAULT_DOCUMENT_KIND } from \"../../../data/documents/documentConstants\";\nimport type { StoredDocumentKind } from \"../../../data/documents/documentKinds\";\nimport type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport {\n type ContainerDocumentObjectSyncState,\n createContainerDocumentObjectSyncState,\n} from \"../syncState\";\nimport type { ContainerDocumentSidebarRow, ContainerItemRow } from \"./types\";\n\nexport function compareContainerContentsDocumentSummaries(\n left: DocumentSummary,\n right: DocumentSummary,\n): number {\n if (right.updatedAt !== left.updatedAt) {\n return right.updatedAt > left.updatedAt ? 1 : -1;\n }\n\n if (right.id !== left.id) {\n return right.id > left.id ? 1 : -1;\n }\n\n return 0;\n}\n\nfunction parseContainerContentsContainerItemDocumentKind(\n value: unknown,\n): StoredDocumentKind {\n return typeof value === \"string\" && value.trim().length > 0\n ? value\n : DEFAULT_DOCUMENT_KIND;\n}\n\nfunction readContainerContentsContainerItemString(\n row: Record<string, unknown>,\n key: string,\n): string {\n const value = row[key];\n return typeof value === \"string\" ? value : \"\";\n}\n\nfunction readContainerContentsContainerItemNullableString(\n row: Record<string, unknown>,\n key: string,\n): string \| null {\n const value = row[key];\n return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction readContainerContentsContainerItemNumber(\n row: Record<string, unknown>,\n key: string,\n): number {\n const value = row[key];\n return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction hasPendingLocalTimestamp(\n row: Record<string, unknown>,\n localUpdatedAtKey: string,\n serverUpdatedAtKey: string,\n): boolean {\n const localUpdatedAt = readContainerContentsContainerItemNullableString(\n row,\n localUpdatedAtKey,\n );\n const serverUpdatedAt = readContainerContentsContainerItemNullableString(\n row,\n serverUpdatedAtKey,\n );\n\n return (\n localUpdatedAt !== null &&\n (serverUpdatedAt === null \|\| localUpdatedAt > serverUpdatedAt)\n );\n}\n\nfunction readContainerDocumentObjectSyncState(\n row: Record<string, unknown>,\n options: {\n localOnly: boolean;\n localTimestampPending?: boolean \| undefined;\n },\n): ContainerDocumentObjectSyncState {\n return createContainerDocumentObjectSyncState({\n lastError: readContainerContentsContainerItemNullableString(\n row,\n \"sync_last_error\",\n ),\n localOnly: options.localOnly,\n pendingAttachmentBytes: readContainerContentsContainerItemNumber(\n row,\n \"pending_attachment_bytes\",\n ),\n pendingAttachmentCount: readContainerContentsContainerItemNumber(\n row,\n \"pending_attachment_count\",\n ),\n pendingUpdateCount: Math.max(\n readContainerContentsContainerItemNumber(row, \"pending_update_count\"),\n options.localTimestampPending ? 1 : 0,\n ),\n });\n}\n\nexport function mapContainerItemRow(\n containerId: string \| null,\n row: Record<string, unknown>,\n): ContainerItemRow {\n const itemKind = readContainerContentsContainerItemString(row, \"item_kind\");\n if (itemKind === \"container\") {\n return {\n createdAt: readContainerContentsContainerItemNullableString(\n row,\n \"created_at\",\n ),\n id: readContainerContentsContainerItemString(row, \"item_id\"),\n icon: readContainerContentsContainerItemNullableString(row, \"icon\"),\n itemKind: \"container\",\n name: readContainerContentsContainerItemString(row, \"name\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly:\n !readContainerContentsContainerItemNullableString(\n row,\n \"server_created_at\",\n ) \|\|\n !readContainerContentsContainerItemNullableString(\n row,\n \"metadata_document_id\",\n ),\n localTimestampPending: hasPendingLocalTimestamp(\n row,\n \"local_updated_at\",\n \"server_updated_at\",\n ),\n }),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n }\n\n return {\n containerId,\n createdAt: readContainerContentsContainerItemNullableString(\n row,\n \"created_at\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n itemKind: \"document\",\n localId: readContainerContentsContainerItemString(row, \"item_id\"),\n name: readContainerContentsContainerItemString(row, \"name\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n }),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n}\n\nexport function readContainerContentsContainerItemCount(\n row: Record<string, unknown>,\n): number {\n return readContainerContentsContainerItemNumber(row, \"total_count\");\n}\n\nexport function mapContainerDocumentSidebarRow(\n row: Record<string, unknown>,\n): ContainerDocumentSidebarRow {\n return {\n containerId: readContainerContentsContainerItemNullableString(\n row,\n \"container_id\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n localId: readContainerContentsContainerItemString(row, \"local_id\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n }),\n title: readContainerContentsContainerItemString(row, \"title\"),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n}\n\nexport function mapContainerContentsDocumentSummaryRow(\n row: Record<string, unknown>,\n): DocumentSummary \| null {\n const localId = readContainerContentsContainerItemString(row, \"local_id\");\n if (localId.length === 0) {\n return null;\n }\n\n return {\n accessStateHash: readContainerContentsContainerItemNullableString(\n row,\n \"access_state_hash\",\n ),\n effectiveAccessLevel: normalizeEffectiveAccessLevel(\n readContainerContentsContainerItemNullableString(\n row,\n \"effective_access_level\",\n ),\n ),\n id: localId,\n containerId: readContainerContentsContainerItemNullableString(\n row,\n \"container_id\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n title: readContainerContentsContainerItemString(row, \"title\"),\n updatedAt: readContainerContentsContainerItemString(row, \"updated_at\"),\n };\n}\n\nexport function mapContainerContentsDocumentSyncStateRow(\n row: Record<string, unknown>,\n): ContainerDocumentObjectSyncState {\n return readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n });\n}\n"]}
1	+ {"version":3,"file":"rows.js","sourceRoot":"","sources":["rows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAGlF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAEL,sCAAsC,GACvC,MAAM,cAAc,CAAC;AAGtB,MAAM,UAAU,yCAAyC,CACvD,IAAqB,EACrB,KAAsB;IAEtB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,+CAA+C,CACtD,KAAc;IAEd,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,SAAS,wCAAwC,CAC/C,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,gDAAgD,CACvD,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,wCAAwC,CAC/C,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA4B,EAC5B,iBAAyB,EACzB,kBAA0B;IAE1B,MAAM,cAAc,GAAG,gDAAgD,CACrE,GAAG,EACH,iBAAiB,CAClB,CAAC;IACF,MAAM,eAAe,GAAG,gDAAgD,CACtE,GAAG,EACH,kBAAkB,CACnB,CAAC;IAEF,OAAO,CACL,cAAc,KAAK,IAAI;QACvB,CAAC,eAAe,KAAK,IAAI,IAAI,cAAc,GAAG,eAAe,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,GAA4B,EAC5B,OAGC;IAED,OAAO,sCAAsC,CAAC;QAC5C,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,iBAAiB,CAClB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,sBAAsB,EAAE,wCAAwC,CAC9D,GAAG,EACH,0BAA0B,CAC3B;QACD,sBAAsB,EAAE,wCAAwC,CAC9D,GAAG,EACH,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAC1B,wCAAwC,CAAC,GAAG,EAAE,sBAAsB,CAAC,EACrE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA0B,EAC1B,GAA4B;IAE5B,MAAM,QAAQ,GAAG,wCAAwC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;YACD,EAAE,EAAE,wCAAwC,CAAC,GAAG,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,gDAAgD,CAAC,GAAG,EAAE,MAAM,CAAC;YACnE,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,wCAAwC,CAAC,GAAG,EAAE,MAAM,CAAC;YAC3D,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;gBACnD,SAAS,EACP,CAAC,gDAAgD,CAC/C,GAAG,EACH,mBAAmB,CACpB;oBACD,CAAC,gDAAgD,CAC/C,GAAG,EACH,sBAAsB,CACvB;gBACH,qBAAqB,EAAE,wBAAwB,CAC7C,GAAG,EACH,kBAAkB,EAClB,mBAAmB,CACpB;aACF,CAAC;YACF,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW;QACX,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,wCAAwC,CAAC,GAAG,EAAE,SAAS,CAAC;QACjE,IAAI,EAAE,wCAAwC,CAAC,GAAG,EAAE,MAAM,CAAC;QAC3D,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;YACnD,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;SACF,CAAC;QACF,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,GAA4B;IAE5B,OAAO,wCAAwC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA4B;IAE5B,OAAO;QACL,WAAW,EAAE,gDAAgD,CAC3D,GAAG,EACH,cAAc,CACf;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,OAAO,EAAE,wCAAwC,CAAC,GAAG,EAAE,UAAU,CAAC;QAClE,SAAS,EAAE,oCAAoC,CAAC,GAAG,EAAE;YACnD,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;SACF,CAAC;QACF,KAAK,EAAE,wCAAwC,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7D,SAAS,EAAE,gDAAgD,CACzD,GAAG,EACH,YAAY,CACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,GAA4B;IAE5B,MAAM,OAAO,GAAG,wCAAwC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,eAAe,EAAE,gDAAgD,CAC/D,GAAG,EACH,mBAAmB,CACpB;QACD,oBAAoB,EAAE,6BAA6B,CACjD,gDAAgD,CAC9C,GAAG,EACH,wBAAwB,CACzB,CACF;QACD,EAAE,EAAE,OAAO;QACX,WAAW,EAAE,gDAAgD,CAC3D,GAAG,EACH,cAAc,CACf;QACD,UAAU,EAAE,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;QACD,YAAY,EAAE,+CAA+C,CAC3D,wCAAwC,CAAC,GAAG,EAAE,eAAe,CAAC,CAC/D;QACD,KAAK,EAAE,wCAAwC,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7D,SAAS,EAAE,wCAAwC,CAAC,GAAG,EAAE,YAAY,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAA4B;IAE5B,OAAO,oCAAoC,CAAC,GAAG,EAAE;QAC/C,SAAS,EAAE,CAAC,gDAAgD,CAC1D,GAAG,EACH,aAAa,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../../data/documents/documentConstants\";\nimport type { StoredDocumentKind } from \"../../../data/documents/documentKinds\";\nimport type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { normalizeEffectiveAccessLevel } from \"../../../data/keying/accessLevel\";\nimport {\n type ContainerDocumentObjectSyncState,\n createContainerDocumentObjectSyncState,\n} from \"../syncState\";\nimport type { ContainerDocumentSidebarRow, ContainerItemRow } from \"./types\";\n\nexport function compareContainerContentsDocumentSummaries(\n left: DocumentSummary,\n right: DocumentSummary,\n): number {\n if (right.updatedAt !== left.updatedAt) {\n return right.updatedAt > left.updatedAt ? 1 : -1;\n }\n\n if (right.id !== left.id) {\n return right.id > left.id ? 1 : -1;\n }\n\n return 0;\n}\n\nfunction parseContainerContentsContainerItemDocumentKind(\n value: unknown,\n): StoredDocumentKind {\n return typeof value === \"string\" && value.trim().length > 0\n ? value\n : DEFAULT_DOCUMENT_KIND;\n}\n\nfunction readContainerContentsContainerItemString(\n row: Record<string, unknown>,\n key: string,\n): string {\n const value = row[key];\n return typeof value === \"string\" ? value : \"\";\n}\n\nfunction readContainerContentsContainerItemNullableString(\n row: Record<string, unknown>,\n key: string,\n): string \| null {\n const value = row[key];\n return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction readContainerContentsContainerItemNumber(\n row: Record<string, unknown>,\n key: string,\n): number {\n const value = row[key];\n return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction hasPendingLocalTimestamp(\n row: Record<string, unknown>,\n localUpdatedAtKey: string,\n serverUpdatedAtKey: string,\n): boolean {\n const localUpdatedAt = readContainerContentsContainerItemNullableString(\n row,\n localUpdatedAtKey,\n );\n const serverUpdatedAt = readContainerContentsContainerItemNullableString(\n row,\n serverUpdatedAtKey,\n );\n\n return (\n localUpdatedAt !== null &&\n (serverUpdatedAt === null \|\| localUpdatedAt > serverUpdatedAt)\n );\n}\n\nfunction readContainerDocumentObjectSyncState(\n row: Record<string, unknown>,\n options: {\n localOnly: boolean;\n localTimestampPending?: boolean \| undefined;\n },\n): ContainerDocumentObjectSyncState {\n return createContainerDocumentObjectSyncState({\n lastError: readContainerContentsContainerItemNullableString(\n row,\n \"sync_last_error\",\n ),\n localOnly: options.localOnly,\n pendingAttachmentBytes: readContainerContentsContainerItemNumber(\n row,\n \"pending_attachment_bytes\",\n ),\n pendingAttachmentCount: readContainerContentsContainerItemNumber(\n row,\n \"pending_attachment_count\",\n ),\n pendingUpdateCount: Math.max(\n readContainerContentsContainerItemNumber(row, \"pending_update_count\"),\n options.localTimestampPending ? 1 : 0,\n ),\n });\n}\n\nexport function mapContainerItemRow(\n containerId: string \| null,\n row: Record<string, unknown>,\n): ContainerItemRow {\n const itemKind = readContainerContentsContainerItemString(row, \"item_kind\");\n if (itemKind === \"container\") {\n return {\n createdAt: readContainerContentsContainerItemNullableString(\n row,\n \"created_at\",\n ),\n id: readContainerContentsContainerItemString(row, \"item_id\"),\n icon: readContainerContentsContainerItemNullableString(row, \"icon\"),\n itemKind: \"container\",\n name: readContainerContentsContainerItemString(row, \"name\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly:\n !readContainerContentsContainerItemNullableString(\n row,\n \"server_created_at\",\n ) \|\|\n !readContainerContentsContainerItemNullableString(\n row,\n \"metadata_document_id\",\n ),\n localTimestampPending: hasPendingLocalTimestamp(\n row,\n \"local_updated_at\",\n \"server_updated_at\",\n ),\n }),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n }\n\n return {\n containerId,\n createdAt: readContainerContentsContainerItemNullableString(\n row,\n \"created_at\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n itemKind: \"document\",\n localId: readContainerContentsContainerItemString(row, \"item_id\"),\n name: readContainerContentsContainerItemString(row, \"name\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n }),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n}\n\nexport function readContainerContentsContainerItemCount(\n row: Record<string, unknown>,\n): number {\n return readContainerContentsContainerItemNumber(row, \"total_count\");\n}\n\nexport function mapContainerDocumentSidebarRow(\n row: Record<string, unknown>,\n): ContainerDocumentSidebarRow {\n return {\n containerId: readContainerContentsContainerItemNullableString(\n row,\n \"container_id\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n localId: readContainerContentsContainerItemString(row, \"local_id\"),\n syncState: readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n }),\n title: readContainerContentsContainerItemString(row, \"title\"),\n updatedAt: readContainerContentsContainerItemNullableString(\n row,\n \"updated_at\",\n ),\n };\n}\n\nexport function mapContainerContentsDocumentSummaryRow(\n row: Record<string, unknown>,\n): DocumentSummary \| null {\n const localId = readContainerContentsContainerItemString(row, \"local_id\");\n if (localId.length === 0) {\n return null;\n }\n\n return {\n accessStateHash: readContainerContentsContainerItemNullableString(\n row,\n \"access_state_hash\",\n ),\n effectiveAccessLevel: normalizeEffectiveAccessLevel(\n readContainerContentsContainerItemNullableString(\n row,\n \"effective_access_level\",\n ),\n ),\n id: localId,\n containerId: readContainerContentsContainerItemNullableString(\n row,\n \"container_id\",\n ),\n documentId: readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n documentKind: parseContainerContentsContainerItemDocumentKind(\n readContainerContentsContainerItemString(row, \"document_kind\"),\n ),\n title: readContainerContentsContainerItemString(row, \"title\"),\n updatedAt: readContainerContentsContainerItemString(row, \"updated_at\"),\n };\n}\n\nexport function mapContainerContentsDocumentSyncStateRow(\n row: Record<string, unknown>,\n): ContainerDocumentObjectSyncState {\n return readContainerDocumentObjectSyncState(row, {\n localOnly: !readContainerContentsContainerItemNullableString(\n row,\n \"document_id\",\n ),\n });\n}\n"]}

package/workflows/container-contents/metadata.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import type { ContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
 import { type ContainerMetadataSyncAttempt, type ContainerMetadataSyncRuntime } from "./metadataRemoteSync.js";
 export { hasContainerMetadataDocumentUpdateEvent, listContainerMetadataDocumentUpdateIds, } from "./metadataEvents.js";

package/workflows/container-contents/metadataMutationPreparation.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { base64ToBytes } from "../../internal/encoding/index.js";
 import { encodeVersionVector, exportUpdatesSince, importUpdates, } from "../../internal/loro/index.js";
-import { canWriteEffectiveAccessLevel } from "../../data/accessLevel.js";
 import { getDefaultContainerName, readContainerMetadataValue, writeContainerMetadataValue, } from "../../data/containers/containerMetadataDocument.js";
 import { documentSyncPullContinuationsEqual } from "../../data/documents/shared/syncPagination.js";
+import { canWriteEffectiveAccessLevel } from "../../data/keying/accessLevel.js";
 import { metadataSyncSecurityContextMatches, replaceSupersededMetadataIdentity, sameNullableMetadataValue, } from "./metadataSyncSettlement.js";
 export function currentMetadataPullContinuation(metadataState) {
     return Object.hasOwn(metadataState, "pullContinuation")

package/workflows/container-contents/metadataMutationPreparation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"metadataMutationPreparation.js","sourceRoot":"","sources":["metadataMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAIhG,OAAO,EAEL,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AA+BlC,MAAM,UAAU,+BAA+B,CAC7C,aAAqC;IAErC,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;QACrD,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAC1C,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAAqC,EACrC,KAAsC;IAEtC,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAClE,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;IAC1E,MAAM,iBAAiB,GAAG,UAAU,KAAK,iBAAiB,CAAC;IAE3D,OAAO;QACL,WAAW;QACX,OAAO,EACL,iBAAiB,IAAI,WAAW,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW;QACvE,UAAU;QACV,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAIvC;IACC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAChE,IACE,CAAC,aAAa,EAAE,eAAe;QAC/B,aAAa,CAAC,UAAU,KAAK,aAAa,CAAC,MAAM,CAAC,UAAU;QAC5D,aAAa,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU;QACvD,aAAa,CAAC,WAAW,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW;QAC9D,aAAa,CAAC,WAAW,KAAK,eAAe,CAAC,WAAW,EACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE;QAC/B,aAAa,CAAC,aAAa,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,OAAO,MAAM,EAAE,MAAM;QACnB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,kCAAkC,CAAC,KAK3C;IACC,OAAO,CACL,KAAK,CAAC,aAAa,CAAC,iBAAiB,KAAK,SAAS;QACnD,KAAK,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS;QAC7C,4BAA4B,CAC1B,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,oBAAoB,CACjE;QACD,CAAC,4BAA4B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,oBAAoB,CACxD,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KASlD;IACC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,aAAa,CAAC,GAAG,EACjB,uBAAuB,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC/D,CAAC;IACF,2BAA2B,CAAC,aAAa,CAAC,GAAG,EAAE;QAC7C,GAAG,mBAAmB;QACtB,GAAG,KAAK,CAAC,kBAAkB;KAC5B,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG;QAC3B,GAAG,aAAa;QAChB,SAAS,EAAE,kBAAkB,CAAC,SAAS;QACvC,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;QACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,CAAC;IACF,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,MAAM;QACxC,iBAAiB,EAAE,kBAAkB,CAAC,SAAS;QAC/C,qBAAqB,EAAE,oBAAoB;QAC3C,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,kBAAkB,CACpC,aAAa,CAAC,GAAG,EACjB,kBAAkB,CACnB;QACD,0BAA0B,EAAE,KAAK;QACjC,eAAe,EAAE,8BAA8B,CAC7C,oBAAoB,EACpB,KAAK,CACN;QACD,sBAAsB,EAAE,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,iBAAiE,EACjE,aAAoC;IAEpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO;YACL,sBAAsB,EAAE,KAAK;YAC7B,0BAA0B,EAAE,KAAK;YACjC,sBAAsB,EAAE,IAAI;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,aAAa,EACb,iBAAiB,CAAC,MAAM,CACzB,CAAC;IACF,MAAM,oBAAoB,GACxB,sBAAsB;QACtB,yBAAyB,CACvB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,MAAM,CAAC,aAAa,CACvC;QACD,OAAO,CAAC,aAAa,EAAE,gCAAgC,CAAC;YACtD,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,gCAAgC,CAAC;QACpE,kCAAkC,CAChC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;IACJ,MAAM,mBAAmB,GACvB,oBAAoB;QACpB,yBAAyB,CACvB,aAAa,EAAE,eAAe,EAC9B,iBAAiB,CAAC,MAAM,CAAC,eAAe,CACzC;QACD,yBAAyB,CACvB,aAAa,EAAE,kBAAkB,EACjC,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAC5C,CAAC;IACJ,OAAO;QACL,sBAAsB,EAAE,oBAAoB,IAAI,CAAC,mBAAmB;QACpE,0BAA0B,EAAE,CAAC,oBAAoB;QACjD,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAyC,EACzC,OAAgB,EAChB,KAAsC;IAEtC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,kBAAkB,GAAG,MAAM,uCAAuC,CAAC;QACvE,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE;QACvC,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;YACL,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE,IAAI;YAChC,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IACD,IACE,kCAAkC,CAAC;QACjC,kBAAkB;QAClB,aAAa,EAAE,KAAK;KACrB,CAAC,EACF,CAAC;QACD,MAAM,iCAAiC,CAAC;YACtC,aAAa,EAAE,kBAAkB,CAAC,MAAM;YACxC,aAAa;SACd,CAAC,CAAC;QACH,OAAO;YACL,kBAAkB;YAClB,0BAA0B,EAAE,IAAI;YAChC,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAChD,MAAM,qBAAqB,GAAG,aAAa;QACzC,CAAC,CAAC;YACE,GAAG,aAAa;YAChB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,IAAI,IAAI;YACxD,MAAM,EAAE,aAAa;SACtB;QACH,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,8BAA8B,GAClC,aAAa,KAAK,IAAI;QACtB,kCAAkC,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,EACJ,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,GACvB,GAAG,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAE3E,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,CAAC,8BAA8B,EAC/B,CAAC;QACD,MAAM,iCAAiC,CAAC;YACtC,aAAa,EAAE,kBAAkB,CAAC,MAAM;YACxC,aAAa;SACd,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,kBAAkB;gBAClB,0BAA0B,EAAE,IAAI;gBAChC,sBAAsB,EAAE,KAAK;aAC9B,CAAC;QACJ,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,kBAAkB;YAClB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,aAAa;YACb,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,eAAe,GAAG,8BAA8B,CACpD,qBAAqB,EACrB,aAAa,CACd,CAAC;IACF,IACE,sBAAsB;QACtB,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,sBAAsB,CAAC,EACjE,CAAC;QACD,8BAA8B,CAAC;YAC7B,aAAa;YACb,aAAa;YACb,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,aAAa;QACb,iBAAiB,EAAE,kBAAkB,CAAC,SAAS;QAC/C,qBAAqB;QACrB,aAAa;QACb,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,0BAA0B;QAC1B,eAAe;QACf,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport {\n encodeVersionVector,\n exportUpdatesSince,\n importUpdates,\n} from \"@tearleads/loro\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/accessLevel\";\nimport {\n getDefaultContainerName,\n readContainerMetadataValue,\n writeContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport { documentSyncPullContinuationsEqual } from \"../../data/documents/shared/syncPagination\";\nimport type { ContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { ContainerDocumentRecord as DocumentRecord } from \"./containerPersistence\";\nimport {\n type ExpectedContainerMetadataSyncState,\n metadataSyncSecurityContextMatches,\n replaceSupersededMetadataIdentity,\n sameNullableMetadataValue,\n} from \"./metadataSyncSettlement\";\nimport type {\n ContainerMetadataPatch,\n ContainerMetadataState,\n} from \"./metadataTypes\";\n\nexport interface PersistContainerMetadataStateInput {\n acceptedPendingUpdateIds?: readonly string[] \| undefined;\n clearSyncFailure?: boolean \| undefined;\n execSql: ExecSql;\n expectedSyncState?: ExpectedContainerMetadataSyncState \| undefined;\n localMetadataPatch?:\n \| Partial<Pick<ContainerMetadataPatch, \"icon\" \| \"name\">>\n \| undefined;\n localUpdate?: Uint8Array \| undefined;\n metadataState: ContainerMetadataState;\n createIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"createIntentSettlement\"];\n moveIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"moveIntentSettlement\"];\n patch?: Partial<ContainerMetadataPatch> \| undefined;\n persistence: ContainerContentsPersistence;\n preserveDurableStructureWhenPending?: boolean \| undefined;\n saveOptions?:\n \| Parameters<ContainerContentsPersistence[\"saveContainer\"]>[3]\n \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n}\n\nexport function currentMetadataPullContinuation(\n metadataState: ContainerMetadataState,\n) {\n return Object.hasOwn(metadataState, \"pullContinuation\")\n ? (metadataState.pullContinuation ?? null)\n : (metadataState.record.pullContinuation ?? null);\n}\n\nexport function resolveMetadataSecurityContext(\n metadataState: ContainerMetadataState,\n patch: Partial<ContainerMetadataPatch>,\n) {\n const currentDocumentId = metadataState.record.documentId ?? null;\n const documentId =\n patch.documentId !== undefined ? patch.documentId : currentDocumentId;\n const accessEpoch = patch.accessEpoch ?? metadataState.record.accessEpoch;\n const documentIdChanged = documentId !== currentDocumentId;\n\n return {\n accessEpoch,\n changed:\n documentIdChanged \|\| accessEpoch !== metadataState.record.accessEpoch,\n documentId,\n documentIdChanged,\n };\n}\n\nfunction mergeDurableMetadataCheckpoint(input: {\n durableRecord: DocumentRecord \| null;\n metadataState: ContainerMetadataState;\n securityContext: ReturnType<typeof resolveMetadataSecurityContext>;\n}): void {\n const { durableRecord, metadataState, securityContext } = input;\n if (\n !durableRecord?.metadataUpdates \|\|\n durableRecord.documentId !== metadataState.record.documentId \|\|\n durableRecord.documentId !== securityContext.documentId \|\|\n durableRecord.accessEpoch !== metadataState.record.accessEpoch \|\|\n durableRecord.accessEpoch !== securityContext.accessEpoch\n ) {\n return;\n }\n\n importUpdates(metadataState.doc, [\n base64ToBytes(durableRecord.metadataUpdates),\n ]);\n}\n\nexport async function loadAuthoritativeContainerMetadataState(input: {\n containerId: string;\n execSql: ExecSql;\n persistence: ContainerContentsPersistence;\n}) {\n const stored = await input.persistence.loadContainerMetadataState(\n input.execSql,\n input.containerId,\n );\n return stored?.record\n ? { container: stored.container, record: stored.record }\n : null;\n}\n\nfunction localMetadataWriteAccessWasRevoked(input: {\n authoritativeState: NonNullable<\n Awaited<ReturnType<typeof loadAuthoritativeContainerMetadataState>>\n >;\n mutationInput: PersistContainerMetadataStateInput;\n}): boolean {\n return (\n input.mutationInput.expectedSyncState === undefined &&\n input.mutationInput.localUpdate !== undefined &&\n canWriteEffectiveAccessLevel(\n input.mutationInput.metadataState.container.effectiveAccessLevel,\n ) &&\n !canWriteEffectiveAccessLevel(\n input.authoritativeState.container.effectiveAccessLevel,\n )\n );\n}\n\nasync function prepareRebasedLocalMetadataMutation(input: {\n authoritativeState: NonNullable<\n Awaited<ReturnType<typeof loadAuthoritativeContainerMetadataState>>\n >;\n metadataState: ContainerMetadataState;\n localMetadataPatch:\n \| Partial<Pick<ContainerMetadataPatch, \"icon\" \| \"name\">>\n \| undefined;\n patch: Partial<ContainerMetadataPatch>;\n}) {\n const { authoritativeState, metadataState, patch } = input;\n const replacementVersion = encodeVersionVector(metadataState.doc);\n const replacementMetadata = readContainerMetadataValue(\n metadataState.doc,\n getDefaultContainerName(authoritativeState.container.parentId),\n );\n writeContainerMetadataValue(metadataState.doc, {\n ...replacementMetadata,\n ...input.localMetadataPatch,\n });\n const rebasedMetadataState = {\n ...metadataState,\n container: authoritativeState.container,\n pullContinuation: authoritativeState.record.pullContinuation ?? null,\n record: authoritativeState.record,\n };\n return {\n durableRecord: authoritativeState.record,\n mutationContainer: authoritativeState.container,\n mutationMetadataState: rebasedMetadataState,\n mutationPatch: patch,\n pendingLocalUpdate: exportUpdatesSince(\n metadataState.doc,\n replacementVersion,\n ),\n pullContinuationSuperseded: false,\n securityContext: resolveMetadataSecurityContext(\n rebasedMetadataState,\n patch,\n ),\n securityContextMatches: true,\n };\n}\n\nfunction resolveMetadataSettlementMatch(\n expectedSyncState: ExpectedContainerMetadataSyncState \| undefined,\n durableRecord: DocumentRecord \| null,\n) {\n if (!expectedSyncState) {\n return {\n contentStateSuperseded: false,\n pullContinuationSuperseded: false,\n securityContextMatches: true,\n };\n }\n const securityContextMatches = metadataSyncSecurityContextMatches(\n durableRecord,\n expectedSyncState.record,\n );\n const progressStateMatches =\n securityContextMatches &&\n sameNullableMetadataValue(\n durableRecord?.lastCommitLsn,\n expectedSyncState.record.lastCommitLsn,\n ) &&\n Boolean(durableRecord?.pullContinuationRecoveryRequired) ===\n Boolean(expectedSyncState.record.pullContinuationRecoveryRequired) &&\n documentSyncPullContinuationsEqual(\n durableRecord?.pullContinuation,\n expectedSyncState.pullContinuation,\n );\n const contentStateMatches =\n progressStateMatches &&\n sameNullableMetadataValue(\n durableRecord?.metadataUpdates,\n expectedSyncState.record.metadataUpdates,\n ) &&\n sameNullableMetadataValue(\n durableRecord?.snapshotEndVersion,\n expectedSyncState.record.snapshotEndVersion,\n );\n return {\n contentStateSuperseded: progressStateMatches && !contentStateMatches,\n pullContinuationSuperseded: !progressStateMatches,\n securityContextMatches,\n };\n}\n\nexport async function prepareContainerMetadataMutation(\n input: PersistContainerMetadataStateInput,\n execSql: ExecSql,\n patch: Partial<ContainerMetadataPatch>,\n) {\n const { metadataState, persistence } = input;\n const authoritativeState = await loadAuthoritativeContainerMetadataState({\n containerId: metadataState.container.id,\n execSql,\n persistence,\n });\n if (!authoritativeState) {\n return {\n authoritativeState: null,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n if (\n localMetadataWriteAccessWasRevoked({\n authoritativeState,\n mutationInput: input,\n })\n ) {\n await replaceSupersededMetadataIdentity({\n durableRecord: authoritativeState.record,\n metadataState,\n });\n return {\n authoritativeState,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n const durableRecord = authoritativeState.record;\n const mutationMetadataState = durableRecord\n ? {\n ...metadataState,\n pullContinuation: durableRecord.pullContinuation ?? null,\n record: durableRecord,\n }\n : metadataState;\n const capturedSecurityContextMatches =\n durableRecord !== null &&\n metadataSyncSecurityContextMatches(durableRecord, metadataState.record);\n const {\n contentStateSuperseded,\n pullContinuationSuperseded,\n securityContextMatches,\n } = resolveMetadataSettlementMatch(input.expectedSyncState, durableRecord);\n\n if (\n input.expectedSyncState === undefined &&\n !capturedSecurityContextMatches\n ) {\n await replaceSupersededMetadataIdentity({\n durableRecord: authoritativeState.record,\n metadataState,\n });\n if (input.localUpdate === undefined) {\n return {\n authoritativeState,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n return prepareRebasedLocalMetadataMutation({\n authoritativeState,\n localMetadataPatch: input.localMetadataPatch,\n metadataState,\n patch,\n });\n }\n const mutationPatch = pullContinuationSuperseded ? {} : patch;\n const securityContext = resolveMetadataSecurityContext(\n mutationMetadataState,\n mutationPatch,\n );\n if (\n securityContextMatches &&\n (input.expectedSyncState === undefined \|\| contentStateSuperseded)\n ) {\n mergeDurableMetadataCheckpoint({\n durableRecord,\n metadataState,\n securityContext,\n });\n }\n return {\n durableRecord,\n mutationContainer: authoritativeState.container,\n mutationMetadataState,\n mutationPatch,\n pendingLocalUpdate: input.localUpdate,\n pullContinuationSuperseded,\n securityContext,\n securityContextMatches,\n };\n}\n"]}
1	+ {"version":3,"file":"metadataMutationPreparation.js","sourceRoot":"","sources":["metadataMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAI7E,OAAO,EAEL,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AA+BlC,MAAM,UAAU,+BAA+B,CAC7C,aAAqC;IAErC,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;QACrD,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAC1C,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAAqC,EACrC,KAAsC;IAEtC,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAClE,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;IAC1E,MAAM,iBAAiB,GAAG,UAAU,KAAK,iBAAiB,CAAC;IAE3D,OAAO;QACL,WAAW;QACX,OAAO,EACL,iBAAiB,IAAI,WAAW,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW;QACvE,UAAU;QACV,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAIvC;IACC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAChE,IACE,CAAC,aAAa,EAAE,eAAe;QAC/B,aAAa,CAAC,UAAU,KAAK,aAAa,CAAC,MAAM,CAAC,UAAU;QAC5D,aAAa,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU;QACvD,aAAa,CAAC,WAAW,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW;QAC9D,aAAa,CAAC,WAAW,KAAK,eAAe,CAAC,WAAW,EACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE;QAC/B,aAAa,CAAC,aAAa,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,OAAO,MAAM,EAAE,MAAM;QACnB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,kCAAkC,CAAC,KAK3C;IACC,OAAO,CACL,KAAK,CAAC,aAAa,CAAC,iBAAiB,KAAK,SAAS;QACnD,KAAK,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS;QAC7C,4BAA4B,CAC1B,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,oBAAoB,CACjE;QACD,CAAC,4BAA4B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,oBAAoB,CACxD,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KASlD;IACC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,aAAa,CAAC,GAAG,EACjB,uBAAuB,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC/D,CAAC;IACF,2BAA2B,CAAC,aAAa,CAAC,GAAG,EAAE;QAC7C,GAAG,mBAAmB;QACtB,GAAG,KAAK,CAAC,kBAAkB;KAC5B,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG;QAC3B,GAAG,aAAa;QAChB,SAAS,EAAE,kBAAkB,CAAC,SAAS;QACvC,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;QACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,CAAC;IACF,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,MAAM;QACxC,iBAAiB,EAAE,kBAAkB,CAAC,SAAS;QAC/C,qBAAqB,EAAE,oBAAoB;QAC3C,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,kBAAkB,CACpC,aAAa,CAAC,GAAG,EACjB,kBAAkB,CACnB;QACD,0BAA0B,EAAE,KAAK;QACjC,eAAe,EAAE,8BAA8B,CAC7C,oBAAoB,EACpB,KAAK,CACN;QACD,sBAAsB,EAAE,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,iBAAiE,EACjE,aAAoC;IAEpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO;YACL,sBAAsB,EAAE,KAAK;YAC7B,0BAA0B,EAAE,KAAK;YACjC,sBAAsB,EAAE,IAAI;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,aAAa,EACb,iBAAiB,CAAC,MAAM,CACzB,CAAC;IACF,MAAM,oBAAoB,GACxB,sBAAsB;QACtB,yBAAyB,CACvB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,MAAM,CAAC,aAAa,CACvC;QACD,OAAO,CAAC,aAAa,EAAE,gCAAgC,CAAC;YACtD,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,gCAAgC,CAAC;QACpE,kCAAkC,CAChC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;IACJ,MAAM,mBAAmB,GACvB,oBAAoB;QACpB,yBAAyB,CACvB,aAAa,EAAE,eAAe,EAC9B,iBAAiB,CAAC,MAAM,CAAC,eAAe,CACzC;QACD,yBAAyB,CACvB,aAAa,EAAE,kBAAkB,EACjC,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAC5C,CAAC;IACJ,OAAO;QACL,sBAAsB,EAAE,oBAAoB,IAAI,CAAC,mBAAmB;QACpE,0BAA0B,EAAE,CAAC,oBAAoB;QACjD,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAyC,EACzC,OAAgB,EAChB,KAAsC;IAEtC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,kBAAkB,GAAG,MAAM,uCAAuC,CAAC;QACvE,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE;QACvC,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;YACL,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE,IAAI;YAChC,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IACD,IACE,kCAAkC,CAAC;QACjC,kBAAkB;QAClB,aAAa,EAAE,KAAK;KACrB,CAAC,EACF,CAAC;QACD,MAAM,iCAAiC,CAAC;YACtC,aAAa,EAAE,kBAAkB,CAAC,MAAM;YACxC,aAAa;SACd,CAAC,CAAC;QACH,OAAO;YACL,kBAAkB;YAClB,0BAA0B,EAAE,IAAI;YAChC,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAChD,MAAM,qBAAqB,GAAG,aAAa;QACzC,CAAC,CAAC;YACE,GAAG,aAAa;YAChB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,IAAI,IAAI;YACxD,MAAM,EAAE,aAAa;SACtB;QACH,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,8BAA8B,GAClC,aAAa,KAAK,IAAI;QACtB,kCAAkC,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,EACJ,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,GACvB,GAAG,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAE3E,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,CAAC,8BAA8B,EAC/B,CAAC;QACD,MAAM,iCAAiC,CAAC;YACtC,aAAa,EAAE,kBAAkB,CAAC,MAAM;YACxC,aAAa;SACd,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,kBAAkB;gBAClB,0BAA0B,EAAE,IAAI;gBAChC,sBAAsB,EAAE,KAAK;aAC9B,CAAC;QACJ,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,kBAAkB;YAClB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,aAAa;YACb,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,eAAe,GAAG,8BAA8B,CACpD,qBAAqB,EACrB,aAAa,CACd,CAAC;IACF,IACE,sBAAsB;QACtB,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,sBAAsB,CAAC,EACjE,CAAC;QACD,8BAA8B,CAAC;YAC7B,aAAa;YACb,aAAa;YACb,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,aAAa;QACb,iBAAiB,EAAE,kBAAkB,CAAC,SAAS;QAC/C,qBAAqB;QACrB,aAAa;QACb,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,0BAA0B;QAC1B,eAAe;QACf,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport {\n encodeVersionVector,\n exportUpdatesSince,\n importUpdates,\n} from \"@tearleads/loro\";\nimport {\n getDefaultContainerName,\n readContainerMetadataValue,\n writeContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport { documentSyncPullContinuationsEqual } from \"../../data/documents/shared/syncPagination\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/keying/accessLevel\";\nimport type { ContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { ContainerDocumentRecord as DocumentRecord } from \"./containerPersistence\";\nimport {\n type ExpectedContainerMetadataSyncState,\n metadataSyncSecurityContextMatches,\n replaceSupersededMetadataIdentity,\n sameNullableMetadataValue,\n} from \"./metadataSyncSettlement\";\nimport type {\n ContainerMetadataPatch,\n ContainerMetadataState,\n} from \"./metadataTypes\";\n\nexport interface PersistContainerMetadataStateInput {\n acceptedPendingUpdateIds?: readonly string[] \| undefined;\n clearSyncFailure?: boolean \| undefined;\n execSql: ExecSql;\n expectedSyncState?: ExpectedContainerMetadataSyncState \| undefined;\n localMetadataPatch?:\n \| Partial<Pick<ContainerMetadataPatch, \"icon\" \| \"name\">>\n \| undefined;\n localUpdate?: Uint8Array \| undefined;\n metadataState: ContainerMetadataState;\n createIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"createIntentSettlement\"];\n moveIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"moveIntentSettlement\"];\n patch?: Partial<ContainerMetadataPatch> \| undefined;\n persistence: ContainerContentsPersistence;\n preserveDurableStructureWhenPending?: boolean \| undefined;\n saveOptions?:\n \| Parameters<ContainerContentsPersistence[\"saveContainer\"]>[3]\n \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n}\n\nexport function currentMetadataPullContinuation(\n metadataState: ContainerMetadataState,\n) {\n return Object.hasOwn(metadataState, \"pullContinuation\")\n ? (metadataState.pullContinuation ?? null)\n : (metadataState.record.pullContinuation ?? null);\n}\n\nexport function resolveMetadataSecurityContext(\n metadataState: ContainerMetadataState,\n patch: Partial<ContainerMetadataPatch>,\n) {\n const currentDocumentId = metadataState.record.documentId ?? null;\n const documentId =\n patch.documentId !== undefined ? patch.documentId : currentDocumentId;\n const accessEpoch = patch.accessEpoch ?? metadataState.record.accessEpoch;\n const documentIdChanged = documentId !== currentDocumentId;\n\n return {\n accessEpoch,\n changed:\n documentIdChanged \|\| accessEpoch !== metadataState.record.accessEpoch,\n documentId,\n documentIdChanged,\n };\n}\n\nfunction mergeDurableMetadataCheckpoint(input: {\n durableRecord: DocumentRecord \| null;\n metadataState: ContainerMetadataState;\n securityContext: ReturnType<typeof resolveMetadataSecurityContext>;\n}): void {\n const { durableRecord, metadataState, securityContext } = input;\n if (\n !durableRecord?.metadataUpdates \|\|\n durableRecord.documentId !== metadataState.record.documentId \|\|\n durableRecord.documentId !== securityContext.documentId \|\|\n durableRecord.accessEpoch !== metadataState.record.accessEpoch \|\|\n durableRecord.accessEpoch !== securityContext.accessEpoch\n ) {\n return;\n }\n\n importUpdates(metadataState.doc, [\n base64ToBytes(durableRecord.metadataUpdates),\n ]);\n}\n\nexport async function loadAuthoritativeContainerMetadataState(input: {\n containerId: string;\n execSql: ExecSql;\n persistence: ContainerContentsPersistence;\n}) {\n const stored = await input.persistence.loadContainerMetadataState(\n input.execSql,\n input.containerId,\n );\n return stored?.record\n ? { container: stored.container, record: stored.record }\n : null;\n}\n\nfunction localMetadataWriteAccessWasRevoked(input: {\n authoritativeState: NonNullable<\n Awaited<ReturnType<typeof loadAuthoritativeContainerMetadataState>>\n >;\n mutationInput: PersistContainerMetadataStateInput;\n}): boolean {\n return (\n input.mutationInput.expectedSyncState === undefined &&\n input.mutationInput.localUpdate !== undefined &&\n canWriteEffectiveAccessLevel(\n input.mutationInput.metadataState.container.effectiveAccessLevel,\n ) &&\n !canWriteEffectiveAccessLevel(\n input.authoritativeState.container.effectiveAccessLevel,\n )\n );\n}\n\nasync function prepareRebasedLocalMetadataMutation(input: {\n authoritativeState: NonNullable<\n Awaited<ReturnType<typeof loadAuthoritativeContainerMetadataState>>\n >;\n metadataState: ContainerMetadataState;\n localMetadataPatch:\n \| Partial<Pick<ContainerMetadataPatch, \"icon\" \| \"name\">>\n \| undefined;\n patch: Partial<ContainerMetadataPatch>;\n}) {\n const { authoritativeState, metadataState, patch } = input;\n const replacementVersion = encodeVersionVector(metadataState.doc);\n const replacementMetadata = readContainerMetadataValue(\n metadataState.doc,\n getDefaultContainerName(authoritativeState.container.parentId),\n );\n writeContainerMetadataValue(metadataState.doc, {\n ...replacementMetadata,\n ...input.localMetadataPatch,\n });\n const rebasedMetadataState = {\n ...metadataState,\n container: authoritativeState.container,\n pullContinuation: authoritativeState.record.pullContinuation ?? null,\n record: authoritativeState.record,\n };\n return {\n durableRecord: authoritativeState.record,\n mutationContainer: authoritativeState.container,\n mutationMetadataState: rebasedMetadataState,\n mutationPatch: patch,\n pendingLocalUpdate: exportUpdatesSince(\n metadataState.doc,\n replacementVersion,\n ),\n pullContinuationSuperseded: false,\n securityContext: resolveMetadataSecurityContext(\n rebasedMetadataState,\n patch,\n ),\n securityContextMatches: true,\n };\n}\n\nfunction resolveMetadataSettlementMatch(\n expectedSyncState: ExpectedContainerMetadataSyncState \| undefined,\n durableRecord: DocumentRecord \| null,\n) {\n if (!expectedSyncState) {\n return {\n contentStateSuperseded: false,\n pullContinuationSuperseded: false,\n securityContextMatches: true,\n };\n }\n const securityContextMatches = metadataSyncSecurityContextMatches(\n durableRecord,\n expectedSyncState.record,\n );\n const progressStateMatches =\n securityContextMatches &&\n sameNullableMetadataValue(\n durableRecord?.lastCommitLsn,\n expectedSyncState.record.lastCommitLsn,\n ) &&\n Boolean(durableRecord?.pullContinuationRecoveryRequired) ===\n Boolean(expectedSyncState.record.pullContinuationRecoveryRequired) &&\n documentSyncPullContinuationsEqual(\n durableRecord?.pullContinuation,\n expectedSyncState.pullContinuation,\n );\n const contentStateMatches =\n progressStateMatches &&\n sameNullableMetadataValue(\n durableRecord?.metadataUpdates,\n expectedSyncState.record.metadataUpdates,\n ) &&\n sameNullableMetadataValue(\n durableRecord?.snapshotEndVersion,\n expectedSyncState.record.snapshotEndVersion,\n );\n return {\n contentStateSuperseded: progressStateMatches && !contentStateMatches,\n pullContinuationSuperseded: !progressStateMatches,\n securityContextMatches,\n };\n}\n\nexport async function prepareContainerMetadataMutation(\n input: PersistContainerMetadataStateInput,\n execSql: ExecSql,\n patch: Partial<ContainerMetadataPatch>,\n) {\n const { metadataState, persistence } = input;\n const authoritativeState = await loadAuthoritativeContainerMetadataState({\n containerId: metadataState.container.id,\n execSql,\n persistence,\n });\n if (!authoritativeState) {\n return {\n authoritativeState: null,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n if (\n localMetadataWriteAccessWasRevoked({\n authoritativeState,\n mutationInput: input,\n })\n ) {\n await replaceSupersededMetadataIdentity({\n durableRecord: authoritativeState.record,\n metadataState,\n });\n return {\n authoritativeState,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n const durableRecord = authoritativeState.record;\n const mutationMetadataState = durableRecord\n ? {\n ...metadataState,\n pullContinuation: durableRecord.pullContinuation ?? null,\n record: durableRecord,\n }\n : metadataState;\n const capturedSecurityContextMatches =\n durableRecord !== null &&\n metadataSyncSecurityContextMatches(durableRecord, metadataState.record);\n const {\n contentStateSuperseded,\n pullContinuationSuperseded,\n securityContextMatches,\n } = resolveMetadataSettlementMatch(input.expectedSyncState, durableRecord);\n\n if (\n input.expectedSyncState === undefined &&\n !capturedSecurityContextMatches\n ) {\n await replaceSupersededMetadataIdentity({\n durableRecord: authoritativeState.record,\n metadataState,\n });\n if (input.localUpdate === undefined) {\n return {\n authoritativeState,\n pullContinuationSuperseded: true,\n securityContextMatches: false,\n };\n }\n return prepareRebasedLocalMetadataMutation({\n authoritativeState,\n localMetadataPatch: input.localMetadataPatch,\n metadataState,\n patch,\n });\n }\n const mutationPatch = pullContinuationSuperseded ? {} : patch;\n const securityContext = resolveMetadataSecurityContext(\n mutationMetadataState,\n mutationPatch,\n );\n if (\n securityContextMatches &&\n (input.expectedSyncState === undefined \|\| contentStateSuperseded)\n ) {\n mergeDurableMetadataCheckpoint({\n durableRecord,\n metadataState,\n securityContext,\n });\n }\n return {\n durableRecord,\n mutationContainer: authoritativeState.container,\n mutationMetadataState,\n mutationPatch,\n pendingLocalUpdate: input.localUpdate,\n pullContinuationSuperseded,\n securityContext,\n securityContextMatches,\n };\n}\n"]}

package/workflows/container-contents/metadataRemoteSync.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import type { PendingUpdateRecord } from "../../data/sqlite/documentPersistence.js";
 import { type RekeyPendingUpdate, syncRemoteDocument } from "../documents/index.js";
 import type { ContainerMetadataState } from "./metadataTypes.js";

package/workflows/container-contents/metadataSyncErrors.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"metadataSyncErrors.js","sourceRoot":"","sources":["metadataSyncErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EACL,yBAAyB,EACzB,yCAAyC,GAC1C,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,qEAAqE,CAAC;AAGtH,SAAS,0CAA0C,CAAC,KAAc;IAChE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO,CACL,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE;QACD,OAAO,CAAC,UAAU,CAAC,6CAA6C,CAAC;QACjE,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC;QAC1D,OAAO,CAAC,UAAU,CAAC,iDAAiD,CAAC;QACrE,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACpD,OAAO,KAAK,oCAAoC;QAChD,OAAO,KAAK,4CAA4C,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,IAAI,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,yCAAyC,CAC7C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;SAClD,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iEAAiE,KAAK,CAAC,WAAW,kEAAkE,CACrJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,0CAA0C,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,6CAA6C,CACjH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,2DAA2D,CAC/H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { isDocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n isKeyingVerificationError,\n reportKeyingVerificationErrorInCauseChain,\n} from \"../../data/keyingProjectionVerification/error\";\nimport { isPrincipalPolicyNotCachedError } from \"../../data/keyingProjectionVerification/principalPolicyVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\n\nfunction isStaleContainerMetadataSecurityStateError(error: unknown): boolean {\n // Signed-state verification failures are terminal integrity incidents, even\n // when their diagnostic message resembles an ordinary stale-key condition.\n if (isKeyingVerificationError(error)) return false;\n const message = error instanceof Error ? error.message : \"\";\n\n return (\n message.startsWith(\n \"Document authorizing container KEK path could not be unwrapped\",\n ) \|\|\n message.startsWith(\"Document content key could not be unwrapped\") \|\|\n message.startsWith(\"Document content-key bundle is stale\") \|\|\n message.startsWith(\"Document content-key re-wrap KEK is unavailable\") \|\|\n message.startsWith(\"Document stale-bundle recovery\") \|\|\n message === \"Document sync target hash mismatch\" \|\|\n message === \"Document sync content-key targets mismatch\"\n );\n}\n\nexport async function deferRecoverableMetadataSyncError(input: {\n containerId: string;\n error: unknown;\n runtime: {\n auth: { organizationId: string \| null };\n util: {\n log: (message: string) => void;\n reportSecurityIncident: SecurityIncidentReporter;\n };\n };\n}): Promise<null> {\n if (isDocumentSyncUpdateIsolationError(input.error)) {\n await reportKeyingVerificationErrorInCauseChain(\n input.error,\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.containerId,\n objectKind: \"container\",\n operation: \"container.metadata.sync\",\n organizationId: input.runtime.auth.organizationId,\n },\n );\n input.runtime.util.log(\n `Container contents: quarantined incoming metadata updates for ${input.containerId}; deferred this container without blocking later metadata syncs.`,\n );\n return null;\n }\n\n if (isStaleContainerMetadataSecurityStateError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because its content-key targets are stale.`,\n );\n return null;\n }\n\n // A cold principal-policy cache is transient: warming already ran and failed\n // within this attempt. Keep the needing-sync state set for the next trigger.\n if (isPrincipalPolicyNotCachedError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because a referenced principal policy is not cached yet.`,\n );\n return null;\n }\n\n throw input.error;\n}\n"]}
1	+ {"version":3,"file":"metadataSyncErrors.js","sourceRoot":"","sources":["metadataSyncErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EACL,yBAAyB,EACzB,yCAAyC,GAC1C,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,qEAAqE,CAAC;AAGtH,SAAS,0CAA0C,CAAC,KAAc;IAChE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO,CACL,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE;QACD,OAAO,CAAC,UAAU,CAAC,6CAA6C,CAAC;QACjE,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC;QAC1D,OAAO,CAAC,UAAU,CAAC,iDAAiD,CAAC;QACrE,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACpD,OAAO,KAAK,oCAAoC;QAChD,OAAO,KAAK,4CAA4C,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,IAAI,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,yCAAyC,CAC7C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;SAClD,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iEAAiE,KAAK,CAAC,WAAW,kEAAkE,CACrJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,0CAA0C,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,6CAA6C,CACjH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,2DAA2D,CAC/H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { isDocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n isKeyingVerificationError,\n reportKeyingVerificationErrorInCauseChain,\n} from \"../../data/keyingProjectionVerification/error\";\nimport { isPrincipalPolicyNotCachedError } from \"../../data/keyingProjectionVerification/principalPolicyVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\n\nfunction isStaleContainerMetadataSecurityStateError(error: unknown): boolean {\n // Signed-state verification failures are terminal integrity incidents, even\n // when their diagnostic message resembles an ordinary stale-key condition.\n if (isKeyingVerificationError(error)) return false;\n const message = error instanceof Error ? error.message : \"\";\n\n return (\n message.startsWith(\n \"Document authorizing container KEK path could not be unwrapped\",\n ) \|\|\n message.startsWith(\"Document content key could not be unwrapped\") \|\|\n message.startsWith(\"Document content-key bundle is stale\") \|\|\n message.startsWith(\"Document content-key re-wrap KEK is unavailable\") \|\|\n message.startsWith(\"Document stale-bundle recovery\") \|\|\n message === \"Document sync target hash mismatch\" \|\|\n message === \"Document sync content-key targets mismatch\"\n );\n}\n\nexport async function deferRecoverableMetadataSyncError(input: {\n containerId: string;\n error: unknown;\n runtime: {\n auth: { organizationId: string \| null };\n util: {\n log: (message: string) => void;\n reportSecurityIncident: SecurityIncidentReporter;\n };\n };\n}): Promise<null> {\n if (isDocumentSyncUpdateIsolationError(input.error)) {\n await reportKeyingVerificationErrorInCauseChain(\n input.error,\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.containerId,\n objectKind: \"container\",\n operation: \"container.metadata.sync\",\n organizationId: input.runtime.auth.organizationId,\n },\n );\n input.runtime.util.log(\n `Container contents: quarantined incoming metadata updates for ${input.containerId}; deferred this container without blocking later metadata syncs.`,\n );\n return null;\n }\n\n if (isStaleContainerMetadataSecurityStateError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because its content-key targets are stale.`,\n );\n return null;\n }\n\n // A cold principal-policy cache is transient: warming already ran and failed\n // within this attempt. Keep the needing-sync state set for the next trigger.\n if (isPrincipalPolicyNotCachedError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because a referenced principal policy is not cached yet.`,\n );\n return null;\n }\n\n throw input.error;\n}\n"]}

package/workflows/container-contents/projectionKeys.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
 import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../runtimeInput.js";
 export type ContainerContentsProjectionUserKeyResolver = ProjectionUserKeyResolver;

package/workflows/container-contents/syncLane.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { DomainScope } from "../../data/domainScope.js";
+import type { DomainScope } from "../../data/shared/domainScope.js";
 import { type SyncLane } from "../../data/sync/syncCoordinator.js";
 export { sequenceUnchanged } from "../../data/sync/sequence.js";
 export { didRegainSyncPrerequisites, isDatabaseUnavailableError, } from "../../data/sync/syncCoordinator.js";

package/workflows/container-contents/syncLane.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"syncLane.js","sourceRoot":"","sources":["syncLane.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAGzC,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;AAErE,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,OAAO,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CACrE,gCAAgC,EAChC;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,YAAY;QACnB,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ,EAAE,CAAC,sCAAsC,EAAE,KAAK,CAAC;QACjE,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,iBAAiB,EAAE,0BAA0B;KAC9C,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n getOrCreateDomainSyncCoordinator,\n isDatabaseUnavailableError,\n type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\n\nexport { sequenceUnchanged } from \"../../data/sync/sequence\";\n// Facade re-exports: container-contents stores must reach these shared sync\n// helpers through this workflow boundary, not by importing data/sync directly.\nexport {\n didRegainSyncPrerequisites,\n isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\n\nexport type ContainerContentsSyncLane = SyncLane;\nexport const CONTAINER_CONTENTS_SYNC_LANE_KEY = \"container-contents\";\n\nexport function registerContainerContentsSyncLane(input: {\n readonly domainScope: DomainScope;\n /** Host diagnostics sink; bare runtimes do not structure errors. */\n readonly logError?: ((message: string, error: unknown) => void) \| undefined;\n readonly run: () => Promise<void>;\n}): ContainerContentsSyncLane {\n return getOrCreateDomainSyncCoordinator(input.domainScope).registerLane(\n CONTAINER_CONTENTS_SYNC_LANE_KEY,\n {\n label: \"Container contents\",\n phase: \"structural\",\n // Fixed literal: no container or identity id may reach a report. The\n // mapped stack identifies which lane body threw. Returning the host's\n // result hands a rejection to the lane reporter's wrapper; discarding it\n // would surface as an unhandled rejection instead.\n reportUnexpectedError: (error) =>\n input.logError?.(\"Container contents: sync lane failed\", error),\n run: input.run,\n shouldIgnoreError: isDatabaseUnavailableError,\n },\n );\n}\n"]}
1	+ {"version":3,"file":"syncLane.js","sourceRoot":"","sources":["syncLane.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAGzC,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;AAErE,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,OAAO,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CACrE,gCAAgC,EAChC;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,YAAY;QACnB,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ,EAAE,CAAC,sCAAsC,EAAE,KAAK,CAAC;QACjE,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,iBAAiB,EAAE,0BAA0B;KAC9C,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n getOrCreateDomainSyncCoordinator,\n isDatabaseUnavailableError,\n type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\n\nexport { sequenceUnchanged } from \"../../data/sync/sequence\";\n// Facade re-exports: container-contents stores must reach these shared sync\n// helpers through this workflow boundary, not by importing data/sync directly.\nexport {\n didRegainSyncPrerequisites,\n isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\n\nexport type ContainerContentsSyncLane = SyncLane;\nexport const CONTAINER_CONTENTS_SYNC_LANE_KEY = \"container-contents\";\n\nexport function registerContainerContentsSyncLane(input: {\n readonly domainScope: DomainScope;\n /** Host diagnostics sink; bare runtimes do not structure errors. */\n readonly logError?: ((message: string, error: unknown) => void) \| undefined;\n readonly run: () => Promise<void>;\n}): ContainerContentsSyncLane {\n return getOrCreateDomainSyncCoordinator(input.domainScope).registerLane(\n CONTAINER_CONTENTS_SYNC_LANE_KEY,\n {\n label: \"Container contents\",\n phase: \"structural\",\n // Fixed literal: no container or identity id may reach a report. The\n // mapped stack identifies which lane body threw. Returning the host's\n // result hands a rejection to the lane reporter's wrapper; discarding it\n // would surface as an unhandled rejection instead.\n reportUnexpectedError: (error) =>\n input.logError?.(\"Container contents: sync lane failed\", error),\n run: input.run,\n shouldIgnoreError: isDatabaseUnavailableError,\n },\n );\n}\n"]}

package/workflows/containers/child/carriedDescendantRekeys.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
-import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification.js";
+import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
 import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
 import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
 import { selectReplacementPrincipalPolicyReferences } from "./replacementPrincipalPolicyReferences.js";

package/workflows/containers/child/create.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { BuildContainerCreatePlanInput, ContainerCreatePlan, ContainerMutationAuthor, CreateRemoteContainerResult, MaterializedContainerCreatePlan } from "../../../data/containers/shared/types.js";
 import { type ProjectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import type { ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import { type RemoteContainerCreateInput } from "./createSubmission.js";
 export declare function buildContainerCreatePlan(input: BuildContainerCreatePlanInput): Promise<ContainerCreatePlan>;

package/workflows/containers/child/create.js CHANGED Viewed

@@ -7,8 +7,8 @@ import { containerManifestRef, getParentCreateContext, readContainerState, wrapC
 import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
 import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
 import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
-import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
 import { repairContainerCreateFailure, submitRemoteContainerCreate, } from "./createSubmission.js";
 import { containerMutationRequestCore } from "./mutationRequestCore.js";

package/workflows/containers/child/create.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n containerManifestRef,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifestRef: null,\n parentContainerPathRefs:\n input.parentProjection.path.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n state: repairState,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}
1	+ {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAKzE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n containerManifestRef,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifestRef: null,\n parentContainerPathRefs:\n input.parentProjection.path.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n state: repairState,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}

package/workflows/containers/child/createProjection.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { getParentCreateContext } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord, readCanonicalRecords, } from "../../../data/keyingCanonicalJson.js";
+import { readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
 export function childContainerWriterProjectionFromCreatePlan(input) {
     const { materializedPlan, parentProjection } = input;
     const { plan } = materializedPlan;

package/workflows/containers/child/createProjection.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createProjection.js","sourceRoot":"","sources":["createProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,~~mCAAmC~~,CAAC;~~AAE3C~~,MAAM,UAAU,4CAA4C,CAAC,KAG5D;IACC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC;IAE/D,OAAO;QACL,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI;YACxB;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,gBAAgB,CAAC,aAAa;YACjC;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,2BAA2B,CAC5B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,SAAS,CAAC,mBAAmB;gBACxD,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,mCAAmC,CACpC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { getParentCreateContext } from \"../../../data/containers/shared/projection\";\nimport type { MaterializedContainerCreatePlan } from \"../../../data/containers/shared/types\";\nimport {\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/~~keyingCanonicalJson~~\";\n\nexport function childContainerWriterProjectionFromCreatePlan(input: {\n materializedPlan: MaterializedContainerCreatePlan;\n parentProjection: ContainerWriterProjectionResponse;\n}): ContainerWriterProjectionResponse {\n const { materializedPlan, parentProjection } = input;\n const { plan } = materializedPlan;\n const parentKek = getParentCreateContext(parentProjection).kek;\n\n return {\n policyEvidence: parentProjection.policyEvidence,\n containerId: plan.containerId,\n organizationId: plan.state.organizationId,\n path: [\n ...parentProjection.path,\n {\n event: {\n event: readCanonicalRecord(plan.event, \"Container child event\"),\n body: readCanonicalRecord(plan.body, \"Container child body\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(\n plan.manifest,\n \"Container child manifest\",\n ),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container child state\"),\n },\n ],\n containerKeks: [\n ...parentProjection.containerKeks,\n {\n containerId: plan.containerId,\n accessManifestHash: plan.manifestHash,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n keyEpoch: readCanonicalRecord(\n plan.keyEpoch,\n \"Container child key epoch\",\n ),\n keyEpochHash: plan.keyEpochHash,\n keyTargetHash: plan.keyTargetHash,\n containerManifestHistory: [],\n parentContainerKeyEpochId: parentKek.containerKeyEpochId,\n keyring: null,\n recipientTargets: readCanonicalRecords(\n plan.recipientTargets,\n \"Container child recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container child wraps\"),\n },\n ],\n };\n}\n"]}
1	+ {"version":3,"file":"createProjection.js","sourceRoot":"","sources":["createProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,UAAU,4CAA4C,CAAC,KAG5D;IACC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC;IAE/D,OAAO;QACL,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI;YACxB;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,gBAAgB,CAAC,aAAa;YACjC;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,2BAA2B,CAC5B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,SAAS,CAAC,mBAAmB;gBACxD,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,mCAAmC,CACpC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { getParentCreateContext } from \"../../../data/containers/shared/projection\";\nimport type { MaterializedContainerCreatePlan } from \"../../../data/containers/shared/types\";\nimport {\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\n\nexport function childContainerWriterProjectionFromCreatePlan(input: {\n materializedPlan: MaterializedContainerCreatePlan;\n parentProjection: ContainerWriterProjectionResponse;\n}): ContainerWriterProjectionResponse {\n const { materializedPlan, parentProjection } = input;\n const { plan } = materializedPlan;\n const parentKek = getParentCreateContext(parentProjection).kek;\n\n return {\n policyEvidence: parentProjection.policyEvidence,\n containerId: plan.containerId,\n organizationId: plan.state.organizationId,\n path: [\n ...parentProjection.path,\n {\n event: {\n event: readCanonicalRecord(plan.event, \"Container child event\"),\n body: readCanonicalRecord(plan.body, \"Container child body\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(\n plan.manifest,\n \"Container child manifest\",\n ),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container child state\"),\n },\n ],\n containerKeks: [\n ...parentProjection.containerKeks,\n {\n containerId: plan.containerId,\n accessManifestHash: plan.manifestHash,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n keyEpoch: readCanonicalRecord(\n plan.keyEpoch,\n \"Container child key epoch\",\n ),\n keyEpochHash: plan.keyEpochHash,\n keyTargetHash: plan.keyTargetHash,\n containerManifestHistory: [],\n parentContainerKeyEpochId: parentKek.containerKeyEpochId,\n keyring: null,\n recipientTargets: readCanonicalRecords(\n plan.recipientTargets,\n \"Container child recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container child wraps\"),\n },\n ],\n };\n}\n"]}

package/workflows/containers/child/createSubmission.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerCreateApi, ContainerCreatePlan, ContainerMutationAuthor, ContainerMutationSubmitFailure } from "../../../data/containers/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
-import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
 import type { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";

package/workflows/containers/child/createSubmission.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createSubmission.js","sourceRoot":"","sources":["createSubmission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AAcrG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAoC7E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CACxD,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;QACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACtE,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACjE,CAAC,MAAM,4BAA4B,CAAC;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACxC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;YACrD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;YAChC,CAAC,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;YAEjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACzE,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n ContainerMutationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isStaleParentContainerPathFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n ContainerCreateApi,\n ContainerCreatePlan,\n ContainerMutationAuthor,\n ContainerMutationSubmitFailure,\n} from \"../../../data/containers/shared/types\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { recoverPrincipalPolicyRepair } from \"../../principals/policyRepair\";\nimport type { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\n\nexport interface ContainerCreateRepairState {\n didRepairStaleParent: boolean;\n policyRepairs: PrincipalPolicyRepairBudget;\n}\n\nexport interface RemoteContainerCreateInput {\n apiClient: ContainerCreateApi;\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql: ExecSql;\n metadataDocumentId?: string \| undefined;\n parentContainerId: string;\n parentProjection?: ContainerWriterProjectionResponse \| undefined;\n parentSecretKey: Uint8Array;\n reportSecurityIncident: SecurityIncidentReporter;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}\n\ntype ContainerCreateFailureRepair =\n \| { readonly kind: \"none\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly kind: \"retry\";\n readonly parentProjection: ContainerWriterProjectionResponse;\n };\n\nexport async function submitRemoteContainerCreate(input: {\n readonly apiClient: ContainerCreateApi;\n readonly plan: ContainerCreatePlan;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<\n \| {\n readonly ok: true;\n readonly response: ContainerMutationResponse;\n }\n \| ContainerMutationSubmitFailure\n \| null\n> {\n if (input.stillCurrent?.() === false) return null;\n const result = await input.apiClient.createContainerResult(\n input.plan.request,\n {\n expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,\n reportErrors: false,\n },\n );\n return result.ok ? { ok: true, response: result.data } : result;\n}\n\nexport async function repairContainerCreateFailure(input: {\n readonly apiClient: ContainerCreateApi;\n readonly failure: ContainerMutationSubmitFailure;\n readonly parentContainerId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly state: ContainerCreateRepairState;\n readonly warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<ContainerCreateFailureRepair> {\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n const repairedPolicy =\n input.state.policyRepairs.take(input.failure.stalePrincipalHeads) &&\n (await recoverPrincipalPolicyRepair({\n heads: input.failure.stalePrincipalHeads,\n organizationId: input.parentProjection.organizationId,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n stillCurrent: input.stillCurrent,\n }));\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n if (!repairedPolicy) {\n if (\n input.state.didRepairStaleParent \|\|\n !isStaleParentContainerPathFailure(input.failure)\n )\n return { kind: \"none\" };\n input.state.didRepairStaleParent = true;\n }\n // Recovery may select newer policies. Rebuild against a fresh public evidence\n // source so the old projection cannot conflict with newly admitted pins.\n input.apiClient.evictContainerWriterProjection(input.parentContainerId);\n const parentProjection = await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n );\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n return parentProjection\n ? { kind: \"retry\", parentProjection }\n : { kind: \"unavailable\" };\n}\n"]}
1	+ {"version":3,"file":"createSubmission.js","sourceRoot":"","sources":["createSubmission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AAcrG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAoC7E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CACxD,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;QACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACtE,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACjE,CAAC,MAAM,4BAA4B,CAAC;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACxC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;YACrD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;YAChC,CAAC,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;YAEjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACzE,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n ContainerMutationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isStaleParentContainerPathFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n ContainerCreateApi,\n ContainerCreatePlan,\n ContainerMutationAuthor,\n ContainerMutationSubmitFailure,\n} from \"../../../data/containers/shared/types\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { recoverPrincipalPolicyRepair } from \"../../principals/policyRepair\";\nimport type { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\n\nexport interface ContainerCreateRepairState {\n didRepairStaleParent: boolean;\n policyRepairs: PrincipalPolicyRepairBudget;\n}\n\nexport interface RemoteContainerCreateInput {\n apiClient: ContainerCreateApi;\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql: ExecSql;\n metadataDocumentId?: string \| undefined;\n parentContainerId: string;\n parentProjection?: ContainerWriterProjectionResponse \| undefined;\n parentSecretKey: Uint8Array;\n reportSecurityIncident: SecurityIncidentReporter;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}\n\ntype ContainerCreateFailureRepair =\n \| { readonly kind: \"none\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly kind: \"retry\";\n readonly parentProjection: ContainerWriterProjectionResponse;\n };\n\nexport async function submitRemoteContainerCreate(input: {\n readonly apiClient: ContainerCreateApi;\n readonly plan: ContainerCreatePlan;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<\n \| {\n readonly ok: true;\n readonly response: ContainerMutationResponse;\n }\n \| ContainerMutationSubmitFailure\n \| null\n> {\n if (input.stillCurrent?.() === false) return null;\n const result = await input.apiClient.createContainerResult(\n input.plan.request,\n {\n expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,\n reportErrors: false,\n },\n );\n return result.ok ? { ok: true, response: result.data } : result;\n}\n\nexport async function repairContainerCreateFailure(input: {\n readonly apiClient: ContainerCreateApi;\n readonly failure: ContainerMutationSubmitFailure;\n readonly parentContainerId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly state: ContainerCreateRepairState;\n readonly warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<ContainerCreateFailureRepair> {\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n const repairedPolicy =\n input.state.policyRepairs.take(input.failure.stalePrincipalHeads) &&\n (await recoverPrincipalPolicyRepair({\n heads: input.failure.stalePrincipalHeads,\n organizationId: input.parentProjection.organizationId,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n stillCurrent: input.stillCurrent,\n }));\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n if (!repairedPolicy) {\n if (\n input.state.didRepairStaleParent \|\|\n !isStaleParentContainerPathFailure(input.failure)\n )\n return { kind: \"none\" };\n input.state.didRepairStaleParent = true;\n }\n // Recovery may select newer policies. Rebuild against a fresh public evidence\n // source so the old projection cannot conflict with newly admitted pins.\n input.apiClient.evictContainerWriterProjection(input.parentContainerId);\n const parentProjection = await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n );\n if (input.stillCurrent?.() === false) {\n return { kind: \"unavailable\" };\n }\n return parentProjection\n ? { kind: \"retry\", parentProjection }\n : { kind: \"unavailable\" };\n}\n"]}

package/workflows/containers/child/move.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../data/containers/shared/types.js";
-import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
-import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 export declare function moveRemoteContainer(input: {
     reportSecurityIncident: SecurityIncidentReporter;

package/workflows/containers/child/move.js CHANGED Viewed

@@ -3,8 +3,8 @@ import { assertContainerChildPathFits } from "../../../data/containers/shared/co
 import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
 import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
 import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
-import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { buildMoveRotationWithBody, deriveMoveManifestArtifacts, } from "./moveArtifacts.js";
 import { buildContainerMoveWraps, collectContainerMovePrincipalPolicies, } from "./moveWraps.js";
 import { containerMutationRequestCore, previousPathRequestFields, } from "./mutationRequestCore.js";