@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/container-contents/remoteHydration/remoteContainerState.js

@@ -0,0 +1,263 @@
+import { heldContainerBinding, listingRepeatsHeldOrdinaryBinding, } from "../../../data/containers/containerBinding.js";
+import { isKeyingVerificationError, runWithSecurityIncidentReporting, } from "../../../data/keyingProjectionVerification/error.js";
+import { isProjectionVerificationCancelledError } from "../../../data/keyingProjectionVerification/types.js";
+import { installContainerMetadataRecord } from "../metadata/metadataPersistence.js";
+import { projectionGeneration } from "../projectionGeneration.js";
+import { moveIndexedContainerChild, removeIndexedContainerChild, } from "./childIndex.js";
+import { rebindReHomedContainer } from "./heldContainerRebind.js";
+import { insertRemoteContainerState } from "./insertRemoteContainer.js";
+import { reconcileLocalOnlyRootContainers, reconcileLocalOnlySystemContainers, } from "./reconciliation.js";
+import { applyRemoteContainerTimestamps, remoteContainerHydrationSaveOptions, resolveRemoteContainerHydrationLocalUpdatedAt, } from "./remoteContainerTimestamps.js";
+import { verifyRemoteContainerDestination } from "./verifiedDestination.js";
+// Container ids (restricted to the inbound page) that carry an unsynced local
+// create or move intent. Such a container's parent and local-edit timestamp are
+// owned by its structural-intent lane until that lane reconciles, so inbound
+// hydration must not revert parentId to the server value nor collapse
+// localUpdatedAt — doing so silently undoes a queued move and falsely reads
+// "synced". Move intents are read via listUnsyncedMoveIntents so a blocked
+// move — one whose destination parent has not synced yet, the common boot-time
+// case — is protected too. Pending *metadata*
+// updates are handled separately (listRemoteContainerIdsWithPendingMetadataUpdates);
+// structural intents live in the local outbox's container lanes, which that
+// query does not cover.
+export async function listRemoteContainerIdsWithPendingStructuralIntents(input) {
+    if (input.remoteContainers.length === 0) {
+        return new Set();
+    }
+    const remoteContainerIds = new Set(input.remoteContainers.map((remoteContainer) => remoteContainer.id));
+    const execSql = input.state.runtime.infra.execSql;
+    const [pendingCreateIntents, unsyncedMoveIntents] = await Promise.all([
+        input.state.persistence.listPendingCreateIntents(execSql),
+        input.state.persistence.listUnsyncedMoveIntents(execSql),
+    ]);
+    const containerIdsWithPendingStructuralIntents = new Set();
+    for (const intent of pendingCreateIntents) {
+        if (remoteContainerIds.has(intent.containerId)) {
+            containerIdsWithPendingStructuralIntents.add(intent.containerId);
+        }
+    }
+    for (const intent of unsyncedMoveIntents) {
+        if (remoteContainerIds.has(intent.containerId)) {
+            containerIdsWithPendingStructuralIntents.add(intent.containerId);
+        }
+    }
+    return containerIdsWithPendingStructuralIntents;
+}
+export async function listRemoteContainerIdsWithPendingMetadataUpdates(input) {
+    const containerIds = input.remoteContainers.flatMap((remoteContainer) => {
+        const previousLocalUpdatedAt = input.state.containersById.get(remoteContainer.id)?.container.localUpdatedAt;
+        return previousLocalUpdatedAt &&
+            previousLocalUpdatedAt.localeCompare(remoteContainer.updatedAt) > 0
+            ? [remoteContainer.id]
+            : [];
+    });
+    if (containerIds.length === 0) {
+        return new Set();
+    }
+    const execSql = input.state.runtime.infra.execSql;
+    return new Set(await input.state.persistence.listContainerIdsWithPendingUpdates(execSql, containerIds));
+}
+function removeMissingHydratedContainer(input) {
+    const { existingState, remoteContainer, state } = input;
+    if (state.containersById.get(remoteContainer.id) !== existingState) {
+        return;
+    }
+    state.containersById.delete(remoteContainer.id);
+    if (input.childIdsByParentId) {
+        removeIndexedContainerChild(input.childIdsByParentId, remoteContainer.id, input.previousParentId);
+        input.childIdsByParentId.delete(remoteContainer.id);
+    }
+    input.host.updateSnapshot();
+}
+function createUpdatedRemoteContainerState(existingState, remoteContainer) {
+    return {
+        ...existingState,
+        container: applyRemoteContainerTimestamps(existingState.container, remoteContainer),
+        containerWriterProjection: null,
+        metadataReferencedPrincipals: remoteContainer.metadataReferencedPrincipals,
+    };
+}
+function installUpdatedRemoteContainerState(existingState, nextState, host) {
+    const wasLocalOnly = existingState.container.serverCreatedAt == null;
+    existingState.container = nextState.container;
+    existingState.containerWriterProjection = nextState.containerWriterProjection;
+    existingState.metadataReferencedPrincipals =
+        nextState.metadataReferencedPrincipals;
+    // The snapshot copied the live generation when it was taken; a hint that
+    // landed during the persist leaves the live metadata projection dropped.
+    if (projectionGeneration(existingState) === projectionGeneration(nextState))
+        existingState.metadataWriterProjection = nextState.metadataWriterProjection;
+    installContainerMetadataRecord(existingState, nextState.record);
+    // A document pass may have deferred while this root was awaiting proof.
+    // The first durable remote acknowledgement makes its pending creates runnable.
+    if (wasLocalOnly && existingState.container.serverCreatedAt != null)
+        host.requestDocumentPriming?.();
+}
+async function updateExistingRemoteContainerState(input) {
+    const { childIdsByParentId, existingState, host, remoteContainer, state } = input;
+    const previousParentId = existingState.container.parentId;
+    const previousLocalUpdatedAt = existingState.container.localUpdatedAt;
+    // A queued, not-yet-synced local move/create owns this container's parent
+    // until its intent lane reconciles. Omit the remote parent when the page scan
+    // saw one; persistence also rechecks the intent transactionally so a move
+    // created after that scan wins. Both paths preserve the durable local clock.
+    const hasPendingStructuralIntent = input.containerIdsWithPendingStructuralIntents.has(remoteContainer.id);
+    const nextParentId = hasPendingStructuralIntent
+        ? undefined
+        : remoteContainer.parentId;
+    const localUpdatedAt = resolveRemoteContainerHydrationLocalUpdatedAt({
+        containerIdsWithPendingMetadataUpdates: input.containerIdsWithPendingMetadataUpdates,
+        hasPendingStructuralIntent,
+        previousLocalUpdatedAt,
+        remoteContainer,
+    });
+    const nextState = createUpdatedRemoteContainerState(existingState, remoteContainer);
+    const persistenceResult = await host.persistContainerState(nextState, {
+        accessEpoch: remoteContainer.metadataAccessEpoch,
+        accessStateHash: remoteContainer.metadataAccessStateHash,
+        documentId: remoteContainer.metadataDocumentId,
+        effectiveAccessLevel: remoteContainer.effectiveAccessLevel,
+        metadataDocumentId: remoteContainer.metadataDocumentId,
+        systemSlot: remoteContainer.systemSlot ?? null,
+        organizationId: remoteContainer.organizationId,
+        ...(nextParentId !== undefined ? { parentId: nextParentId } : {}),
+    }, false, remoteContainerHydrationSaveOptions({
+        localUpdatedAt,
+        remoteContainer,
+    }), {
+        preserveDurableStructureWhenPending: true,
+    });
+    if (persistenceResult.status === "missing") {
+        // Hydration persists a detached candidate so an in-flight response cannot
+        // mutate mapped state before its guards settle. Retire the exact state this
+        // hydration read because store-level reference cleanup cannot see the clone.
+        removeMissingHydratedContainer({
+            childIdsByParentId,
+            existingState,
+            host,
+            previousParentId,
+            remoteContainer,
+            state,
+        });
+        return null;
+    }
+    if (persistenceResult.status !== "persisted")
+        return null;
+    const { record: nextRecord } = persistenceResult;
+    installContainerMetadataRecord(nextState, nextRecord);
+    if (input.isCurrent?.() === false) {
+        return existingState;
+    }
+    nextState.container = {
+        ...nextState.container,
+        metadataDocumentId: remoteContainer.metadataDocumentId,
+        organizationId: remoteContainer.organizationId,
+        parentId: nextState.container.parentId,
+    };
+    installUpdatedRemoteContainerState(existingState, nextState, host);
+    moveIndexedContainerChild(childIdsByParentId, remoteContainer.id, previousParentId, existingState.container.parentId);
+    await reconcileLocalOnlyRootContainers({
+        childIdsByParentId,
+        isCurrent: input.isCurrent,
+        remoteRootState: existingState,
+        requestDocumentPriming: host.requestDocumentPriming,
+        state,
+    });
+    return existingState;
+}
+export async function upsertRemoteContainerState(input) {
+    let expectedPlacementCheckpoint;
+    const heldState = input.state.containersById.get(input.remoteContainer.id);
+    const heldBinding = heldState
+        ? heldContainerBinding(heldState)
+        : await input.state.persistence.loadHeldContainerBinding(input.state.runtime.infra.execSql, input.remoteContainer.id);
+    const listed = input.remoteContainer;
+    // A folder re-homed away from the listed organization never returns there,
+    // whatever binding (possibly none, after a reset) the device holds now.
+    const supersededListing = !listingRepeatsHeldOrdinaryBinding(heldBinding, listed) &&
+        (await input.state.persistence.isSupersededContainerBinding(input.state.runtime.infra.execSql, { containerId: listed.id, organizationId: listed.organizationId }));
+    if (input.isCurrent?.() === false)
+        return null;
+    const verified = await verifyRemoteContainerDestination({
+        ...input,
+        heldBinding,
+        supersededListing,
+        refresh: !!input.expectedHydrationTombstone,
+        onVerifiedCheckpoint: (checkpoint) => {
+            expectedPlacementCheckpoint = checkpoint;
+        },
+    });
+    if (!verified || input.isCurrent?.() === false)
+        return null;
+    input = { ...input, remoteContainer: verified };
+    const existingState = input.state.containersById.get(input.remoteContainer.id);
+    const remoteState = await runWithSecurityIncidentReporting(input.state.runtime.util.reportSecurityIncident, {
+        objectId: verified.id,
+        objectKind: "container",
+        operation: "container.binding.persist",
+        organizationId: verified.organizationId,
+    }, async () => (await rebindReHomedContainer({
+        existingState,
+        heldBinding,
+        isCurrent: input.isCurrent,
+        state: input.state,
+        verified,
+    }))
+        ? persistVerifiedRemoteContainer({
+            ...input,
+            existingState,
+            expectedPlacementCheckpoint,
+        })
+        : null);
+    if (!remoteState) {
+        return null;
+    }
+    await reconcileLocalOnlySystemContainers({
+        childIdsByParentId: input.childIdsByParentId,
+        isCurrent: input.isCurrent,
+        requestDocumentPriming: input.host.requestDocumentPriming,
+        remoteSystemState: remoteState,
+        state: input.state,
+    });
+    return remoteState;
+}
+/**
+ * Upsert one listed folder, isolating a rejected proof or binding. The refusal
+ * was already reported; returning no state leaves the item unapplied without
+ * blocking independent folders.
+ */
+export async function upsertIsolatedRemoteContainerState(input) {
+    try {
+        return await upsertRemoteContainerState(input);
+    }
+    catch (error) {
+        if (!isKeyingVerificationError(error) &&
+            !isProjectionVerificationCancelledError(error))
+            throw error;
+        return null;
+    }
+}
+function persistVerifiedRemoteContainer(input) {
+    const { existingState, expectedPlacementCheckpoint } = input;
+    return existingState
+        ? updateExistingRemoteContainerState({
+            childIdsByParentId: input.childIdsByParentId,
+            containerIdsWithPendingMetadataUpdates: input.containerIdsWithPendingMetadataUpdates,
+            containerIdsWithPendingStructuralIntents: input.containerIdsWithPendingStructuralIntents,
+            existingState,
+            host: input.host,
+            isCurrent: input.isCurrent,
+            remoteContainer: input.remoteContainer,
+            state: input.state,
+        })
+        : insertRemoteContainerState({
+            childIdsByParentId: input.childIdsByParentId,
+            host: input.host,
+            expectedHydrationTombstone: input.expectedHydrationTombstone ?? null,
+            expectedPlacementCheckpoint,
+            isCurrent: input.isCurrent,
+            remoteContainer: input.remoteContainer,
+            state: input.state,
+        });
+}
+//# sourceMappingURL=remoteContainerState.js.map

package/workflows/container-contents/remoteHydration/remoteContainerState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteContainerState.js","sourceRoot":"","sources":["remoteContainerState.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAE1G,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,6CAA6C,GAC9C,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAEzE,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,8CAA8C;AAC9C,qFAAqF;AACrF,4EAA4E;AAC5E,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,KAGxE;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACzD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,wCAAwC,GAAG,IAAI,GAAG,EAAU,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,wCAAwC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAGtE;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;QACtE,MAAM,sBAAsB,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAC3D,eAAe,CAAC,EAAE,CACnB,EAAE,SAAS,CAAC,cAAc,CAAC;QAE5B,OAAO,sBAAsB;YAC3B,sBAAsB,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC;YACnE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,OAAO,IAAI,GAAG,CACZ,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAC9D,OAAO,EACP,YAAY,CACb,CACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAOvC;IACC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;QACnE,OAAO;IACT,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,2BAA2B,CACzB,KAAK,CAAC,kBAAkB,EACxB,eAAe,CAAC,EAAE,EAClB,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,aAA6B,EAC7B,eAAgC;IAEhC,OAAO;QACL,GAAG,aAAa;QAChB,SAAS,EAAE,8BAA8B,CACvC,aAAa,CAAC,SAAS,EACvB,eAAe,CAChB;QACD,yBAAyB,EAAE,IAAI;QAC/B,4BAA4B,EAAE,eAAe,CAAC,4BAA4B;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,aAA6B,EAC7B,SAAyB,EACzB,IAAkC;IAElC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC;IACrE,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC9C,aAAa,CAAC,yBAAyB,GAAG,SAAS,CAAC,yBAAyB,CAAC;IAC9E,aAAa,CAAC,4BAA4B;QACxC,SAAS,CAAC,4BAA4B,CAAC;IACzC,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,oBAAoB,CAAC,aAAa,CAAC,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACzE,aAAa,CAAC,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;IAC9E,8BAA8B,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,IAAI,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI;QACjE,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KASjD;IACC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GACvE,KAAK,CAAC;IACR,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC1D,MAAM,sBAAsB,GAAG,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC;IACtE,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,0BAA0B,GAC9B,KAAK,CAAC,wCAAwC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,0BAA0B;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;IAC7B,MAAM,cAAc,GAAG,6CAA6C,CAAC;QACnE,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;QAC9C,0BAA0B;QAC1B,sBAAsB;QACtB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,iCAAiC,CACjD,aAAa,EACb,eAAe,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACxD,SAAS,EACT;QACE,WAAW,EAAE,eAAe,CAAC,mBAAmB;QAChD,eAAe,EAAE,eAAe,CAAC,uBAAuB;QACxD,UAAU,EAAE,eAAe,CAAC,kBAAkB;QAC9C,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,UAAU,EAAE,eAAe,CAAC,UAAU,IAAI,IAAI;QAC9C,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,EACD,KAAK,EACL,mCAAmC,CAAC;QAClC,cAAc;QACd,eAAe;KAChB,CAAC,EACF;QACE,mCAAmC,EAAE,IAAI;KAC1C,CACF,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,8BAA8B,CAAC;YAC7B,kBAAkB;YAClB,aAAa;YACb,IAAI;YACJ,gBAAgB;YAChB,eAAe;YACf,KAAK;SACN,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;IACjD,8BAA8B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,SAAS,CAAC,SAAS,GAAG;QACpB,GAAG,SAAS,CAAC,SAAS;QACtB,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;KACvC,CAAC;IAEF,kCAAkC,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,yBAAyB,CACvB,kBAAkB,EAClB,eAAe,CAAC,EAAE,EAClB,gBAAgB,EAChB,aAAa,CAAC,SAAS,CAAC,QAAQ,CACjC,CAAC;IACF,MAAM,gCAAgC,CAAC;QACrC,kBAAkB;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,aAAa;QAC9B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,KAAK;KACN,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAsC;IAEtC,IAAI,2BAAiE,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACpD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACN,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC;IACrC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,iBAAiB,GACrB,CAAC,iCAAiC,CAAC,WAAW,EAAE,MAAM,CAAC;QACvD,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,4BAA4B,CACzD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAClE,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;QACtD,GAAG,KAAK;QACR,WAAW;QACX,iBAAiB;QACjB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B;QAC3C,oBAAoB,EAAE,CAAC,UAAU,EAAE,EAAE;YACnC,2BAA2B,GAAG,UAAU,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAClD,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,gCAAgC,CACxD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAC/C;QACE,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,2BAA2B;QACtC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,EACD,KAAK,IAAI,EAAE,CACT,CAAC,MAAM,sBAAsB,CAAC;QAC5B,aAAa;QACb,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;KACT,CAAC,CAAC;QACD,CAAC,CAAC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,aAAa;YACb,2BAA2B;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CACX,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAsC;IAEtC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,yBAAyB,CAAC,KAAK,CAAC;YACjC,CAAC,sCAAsC,CAAC,KAAK,CAAC;YAE9C,MAAM,KAAK,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAGC;IAED,MAAM,EAAE,aAAa,EAAE,2BAA2B,EAAE,GAAG,KAAK,CAAC;IAC7D,OAAO,aAAa;QAClB,CAAC,CAAC,kCAAkC,CAAC;YACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;YAC9C,wCAAwC,EACtC,KAAK,CAAC,wCAAwC;YAChD,aAAa;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACJ,CAAC,CAAC,0BAA0B,CAAC;YACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,IAAI,IAAI;YACpE,2BAA2B;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type { AccessManifestCheckpoint } from \"@tearleads/crypto\";\nimport {\n  heldContainerBinding,\n  listingRepeatsHeldOrdinaryBinding,\n} from \"../../../data/containers/containerBinding\";\nimport {\n  isKeyingVerificationError,\n  runWithSecurityIncidentReporting,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { isProjectionVerificationCancelledError } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ContainerHydrationTombstone } from \"../containerPersistence\";\nimport { installContainerMetadataRecord } from \"../metadata/metadataPersistence\";\nimport { projectionGeneration } from \"../projectionGeneration\";\nimport {\n  moveIndexedContainerChild,\n  removeIndexedContainerChild,\n} from \"./childIndex\";\nimport type { PrefetchedDestinationProjection } from \"./destinationPrefetch\";\nimport { rebindReHomedContainer } from \"./heldContainerRebind\";\nimport { insertRemoteContainerState } from \"./insertRemoteContainer\";\nimport {\n  reconcileLocalOnlyRootContainers,\n  reconcileLocalOnlySystemContainers,\n} from \"./reconciliation\";\nimport {\n  applyRemoteContainerTimestamps,\n  remoteContainerHydrationSaveOptions,\n  resolveRemoteContainerHydrationLocalUpdatedAt,\n} from \"./remoteContainerTimestamps\";\nimport type {\n  ContainerChildIndex,\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationHost,\n  RemoteContainerHydrationState,\n} from \"./types\";\nimport { verifyRemoteContainerDestination } from \"./verifiedDestination\";\n\n// Container ids (restricted to the inbound page) that carry an unsynced local\n// create or move intent. Such a container's parent and local-edit timestamp are\n// owned by its structural-intent lane until that lane reconciles, so inbound\n// hydration must not revert parentId to the server value nor collapse\n// localUpdatedAt — doing so silently undoes a queued move and falsely reads\n// \"synced\". Move intents are read via listUnsyncedMoveIntents so a blocked\n// move — one whose destination parent has not synced yet, the common boot-time\n// case — is protected too. Pending *metadata*\n// updates are handled separately (listRemoteContainerIdsWithPendingMetadataUpdates);\n// structural intents live in the local outbox's container lanes, which that\n// query does not cover.\nexport async function listRemoteContainerIdsWithPendingStructuralIntents(input: {\n  remoteContainers: ReadonlyArray<RemoteContainer>;\n  state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n  if (input.remoteContainers.length === 0) {\n    return new Set();\n  }\n  const remoteContainerIds = new Set(\n    input.remoteContainers.map((remoteContainer) => remoteContainer.id),\n  );\n\n  const execSql = input.state.runtime.infra.execSql;\n  const [pendingCreateIntents, unsyncedMoveIntents] = await Promise.all([\n    input.state.persistence.listPendingCreateIntents(execSql),\n    input.state.persistence.listUnsyncedMoveIntents(execSql),\n  ]);\n  const containerIdsWithPendingStructuralIntents = new Set<string>();\n  for (const intent of pendingCreateIntents) {\n    if (remoteContainerIds.has(intent.containerId)) {\n      containerIdsWithPendingStructuralIntents.add(intent.containerId);\n    }\n  }\n  for (const intent of unsyncedMoveIntents) {\n    if (remoteContainerIds.has(intent.containerId)) {\n      containerIdsWithPendingStructuralIntents.add(intent.containerId);\n    }\n  }\n  return containerIdsWithPendingStructuralIntents;\n}\n\nexport async function listRemoteContainerIdsWithPendingMetadataUpdates(input: {\n  remoteContainers: ReadonlyArray<RemoteContainer>;\n  state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n  const containerIds = input.remoteContainers.flatMap((remoteContainer) => {\n    const previousLocalUpdatedAt = input.state.containersById.get(\n      remoteContainer.id,\n    )?.container.localUpdatedAt;\n\n    return previousLocalUpdatedAt &&\n      previousLocalUpdatedAt.localeCompare(remoteContainer.updatedAt) > 0\n      ? [remoteContainer.id]\n      : [];\n  });\n  if (containerIds.length === 0) {\n    return new Set();\n  }\n\n  const execSql = input.state.runtime.infra.execSql;\n  return new Set(\n    await input.state.persistence.listContainerIdsWithPendingUpdates(\n      execSql,\n      containerIds,\n    ),\n  );\n}\n\nfunction removeMissingHydratedContainer(input: {\n  childIdsByParentId?: ContainerChildIndex | undefined;\n  existingState: ContainerState;\n  host: RemoteContainerHydrationHost;\n  previousParentId: string | null;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n}): void {\n  const { existingState, remoteContainer, state } = input;\n  if (state.containersById.get(remoteContainer.id) !== existingState) {\n    return;\n  }\n\n  state.containersById.delete(remoteContainer.id);\n  if (input.childIdsByParentId) {\n    removeIndexedContainerChild(\n      input.childIdsByParentId,\n      remoteContainer.id,\n      input.previousParentId,\n    );\n    input.childIdsByParentId.delete(remoteContainer.id);\n  }\n  input.host.updateSnapshot();\n}\n\nfunction createUpdatedRemoteContainerState(\n  existingState: ContainerState,\n  remoteContainer: RemoteContainer,\n): ContainerState {\n  return {\n    ...existingState,\n    container: applyRemoteContainerTimestamps(\n      existingState.container,\n      remoteContainer,\n    ),\n    containerWriterProjection: null,\n    metadataReferencedPrincipals: remoteContainer.metadataReferencedPrincipals,\n  };\n}\n\nfunction installUpdatedRemoteContainerState(\n  existingState: ContainerState,\n  nextState: ContainerState,\n  host: RemoteContainerHydrationHost,\n): void {\n  const wasLocalOnly = existingState.container.serverCreatedAt == null;\n  existingState.container = nextState.container;\n  existingState.containerWriterProjection = nextState.containerWriterProjection;\n  existingState.metadataReferencedPrincipals =\n    nextState.metadataReferencedPrincipals;\n  // The snapshot copied the live generation when it was taken; a hint that\n  // landed during the persist leaves the live metadata projection dropped.\n  if (projectionGeneration(existingState) === projectionGeneration(nextState))\n    existingState.metadataWriterProjection = nextState.metadataWriterProjection;\n  installContainerMetadataRecord(existingState, nextState.record);\n  // A document pass may have deferred while this root was awaiting proof.\n  // The first durable remote acknowledgement makes its pending creates runnable.\n  if (wasLocalOnly && existingState.container.serverCreatedAt != null)\n    host.requestDocumentPriming?.();\n}\n\nasync function updateExistingRemoteContainerState(input: {\n  childIdsByParentId?: ContainerChildIndex | undefined;\n  containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n  containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n  host: RemoteContainerHydrationHost;\n  isCurrent?: (() => boolean) | undefined;\n  existingState: ContainerState;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n}): Promise<ContainerState | null> {\n  const { childIdsByParentId, existingState, host, remoteContainer, state } =\n    input;\n  const previousParentId = existingState.container.parentId;\n  const previousLocalUpdatedAt = existingState.container.localUpdatedAt;\n  // A queued, not-yet-synced local move/create owns this container's parent\n  // until its intent lane reconciles. Omit the remote parent when the page scan\n  // saw one; persistence also rechecks the intent transactionally so a move\n  // created after that scan wins. Both paths preserve the durable local clock.\n  const hasPendingStructuralIntent =\n    input.containerIdsWithPendingStructuralIntents.has(remoteContainer.id);\n  const nextParentId = hasPendingStructuralIntent\n    ? undefined\n    : remoteContainer.parentId;\n  const localUpdatedAt = resolveRemoteContainerHydrationLocalUpdatedAt({\n    containerIdsWithPendingMetadataUpdates:\n      input.containerIdsWithPendingMetadataUpdates,\n    hasPendingStructuralIntent,\n    previousLocalUpdatedAt,\n    remoteContainer,\n  });\n  const nextState = createUpdatedRemoteContainerState(\n    existingState,\n    remoteContainer,\n  );\n  const persistenceResult = await host.persistContainerState(\n    nextState,\n    {\n      accessEpoch: remoteContainer.metadataAccessEpoch,\n      accessStateHash: remoteContainer.metadataAccessStateHash,\n      documentId: remoteContainer.metadataDocumentId,\n      effectiveAccessLevel: remoteContainer.effectiveAccessLevel,\n      metadataDocumentId: remoteContainer.metadataDocumentId,\n      systemSlot: remoteContainer.systemSlot ?? null,\n      organizationId: remoteContainer.organizationId,\n      ...(nextParentId !== undefined ? { parentId: nextParentId } : {}),\n    },\n    false,\n    remoteContainerHydrationSaveOptions({\n      localUpdatedAt,\n      remoteContainer,\n    }),\n    {\n      preserveDurableStructureWhenPending: true,\n    },\n  );\n  if (persistenceResult.status === \"missing\") {\n    // Hydration persists a detached candidate so an in-flight response cannot\n    // mutate mapped state before its guards settle. Retire the exact state this\n    // hydration read because store-level reference cleanup cannot see the clone.\n    removeMissingHydratedContainer({\n      childIdsByParentId,\n      existingState,\n      host,\n      previousParentId,\n      remoteContainer,\n      state,\n    });\n    return null;\n  }\n  if (persistenceResult.status !== \"persisted\") return null;\n  const { record: nextRecord } = persistenceResult;\n  installContainerMetadataRecord(nextState, nextRecord);\n  if (input.isCurrent?.() === false) {\n    return existingState;\n  }\n  nextState.container = {\n    ...nextState.container,\n    metadataDocumentId: remoteContainer.metadataDocumentId,\n    organizationId: remoteContainer.organizationId,\n    parentId: nextState.container.parentId,\n  };\n\n  installUpdatedRemoteContainerState(existingState, nextState, host);\n  moveIndexedContainerChild(\n    childIdsByParentId,\n    remoteContainer.id,\n    previousParentId,\n    existingState.container.parentId,\n  );\n  await reconcileLocalOnlyRootContainers({\n    childIdsByParentId,\n    isCurrent: input.isCurrent,\n    remoteRootState: existingState,\n    requestDocumentPriming: host.requestDocumentPriming,\n    state,\n  });\n  return existingState;\n}\n\ninterface UpsertRemoteContainerStateInput {\n  childIdsByParentId?: ContainerChildIndex | undefined;\n  containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n  containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n  host: RemoteContainerHydrationHost;\n  expectedHydrationTombstone?: ContainerHydrationTombstone | null | undefined;\n  isCurrent?: (() => boolean) | undefined;\n  prefetchedProjection?: PrefetchedDestinationProjection | undefined;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n}\n\nexport async function upsertRemoteContainerState(\n  input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState | null> {\n  let expectedPlacementCheckpoint: AccessManifestCheckpoint | undefined;\n  const heldState = input.state.containersById.get(input.remoteContainer.id);\n  const heldBinding = heldState\n    ? heldContainerBinding(heldState)\n    : await input.state.persistence.loadHeldContainerBinding(\n        input.state.runtime.infra.execSql,\n        input.remoteContainer.id,\n      );\n  const listed = input.remoteContainer;\n  // A folder re-homed away from the listed organization never returns there,\n  // whatever binding (possibly none, after a reset) the device holds now.\n  const supersededListing =\n    !listingRepeatsHeldOrdinaryBinding(heldBinding, listed) &&\n    (await input.state.persistence.isSupersededContainerBinding(\n      input.state.runtime.infra.execSql,\n      { containerId: listed.id, organizationId: listed.organizationId },\n    ));\n  if (input.isCurrent?.() === false) return null;\n  const verified = await verifyRemoteContainerDestination({\n    ...input,\n    heldBinding,\n    supersededListing,\n    refresh: !!input.expectedHydrationTombstone,\n    onVerifiedCheckpoint: (checkpoint) => {\n      expectedPlacementCheckpoint = checkpoint;\n    },\n  });\n  if (!verified || input.isCurrent?.() === false) return null;\n  input = { ...input, remoteContainer: verified };\n  const existingState = input.state.containersById.get(\n    input.remoteContainer.id,\n  );\n  const remoteState = await runWithSecurityIncidentReporting(\n    input.state.runtime.util.reportSecurityIncident,\n    {\n      objectId: verified.id,\n      objectKind: \"container\",\n      operation: \"container.binding.persist\",\n      organizationId: verified.organizationId,\n    },\n    async () =>\n      (await rebindReHomedContainer({\n        existingState,\n        heldBinding,\n        isCurrent: input.isCurrent,\n        state: input.state,\n        verified,\n      }))\n        ? persistVerifiedRemoteContainer({\n            ...input,\n            existingState,\n            expectedPlacementCheckpoint,\n          })\n        : null,\n  );\n  if (!remoteState) {\n    return null;\n  }\n  await reconcileLocalOnlySystemContainers({\n    childIdsByParentId: input.childIdsByParentId,\n    isCurrent: input.isCurrent,\n    requestDocumentPriming: input.host.requestDocumentPriming,\n    remoteSystemState: remoteState,\n    state: input.state,\n  });\n  return remoteState;\n}\n\n/**\n * Upsert one listed folder, isolating a rejected proof or binding. The refusal\n * was already reported; returning no state leaves the item unapplied without\n * blocking independent folders.\n */\nexport async function upsertIsolatedRemoteContainerState(\n  input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState | null> {\n  try {\n    return await upsertRemoteContainerState(input);\n  } catch (error) {\n    if (\n      !isKeyingVerificationError(error) &&\n      !isProjectionVerificationCancelledError(error)\n    )\n      throw error;\n    return null;\n  }\n}\n\nfunction persistVerifiedRemoteContainer(\n  input: UpsertRemoteContainerStateInput & {\n    existingState: ContainerState | undefined;\n    expectedPlacementCheckpoint: AccessManifestCheckpoint | undefined;\n  },\n): Promise<ContainerState | null> {\n  const { existingState, expectedPlacementCheckpoint } = input;\n  return existingState\n    ? updateExistingRemoteContainerState({\n        childIdsByParentId: input.childIdsByParentId,\n        containerIdsWithPendingMetadataUpdates:\n          input.containerIdsWithPendingMetadataUpdates,\n        containerIdsWithPendingStructuralIntents:\n          input.containerIdsWithPendingStructuralIntents,\n        existingState,\n        host: input.host,\n        isCurrent: input.isCurrent,\n        remoteContainer: input.remoteContainer,\n        state: input.state,\n      })\n    : insertRemoteContainerState({\n        childIdsByParentId: input.childIdsByParentId,\n        host: input.host,\n        expectedHydrationTombstone: input.expectedHydrationTombstone ?? null,\n        expectedPlacementCheckpoint,\n        isCurrent: input.isCurrent,\n        remoteContainer: input.remoteContainer,\n        state: input.state,\n      });\n}\n"]}

package/workflows/container-contents/remoteHydration/types.d.ts

@@ -6,7 +6,7 @@ import type { createContainerMetadataDocument } from "../../../data/containers/c
 import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
 import type { PrincipalPolicyHistoryReader } from "../../principals/principalPolicyHistoryReader.js";
 import type { ContainerContentsPersistence, ContainerDocumentRecord, ContainerHydrationTombstone, ContainerRecord, createContainerParentSyncLane } from "../containerPersistence.js";
-import type { ContainerMetadataPatch } from "../metadata.js";
+import type { ContainerMetadataPatch } from "../metadata/index.js";
 import type { ContainerContentsWorkflowRuntime } from "../runtime.js";
 export type ListedRemoteContainerPageItem = ListContainersResponse["items"][number];
 export type ContainerChildIndex = Map<string, Set<string>>;

package/workflows/container-contents/remoteHydration/verifiedDestination.js

@@ -5,7 +5,7 @@ import { verifiedContainerCreateManifest } from "../../../data/keyingProjectionV
 import { verifyContainerDestinationProjection } from "../../../data/keyingProjectionVerification/containerDestinationVerification.js";
 import { verifyContainerWriterProjection } from "../../../data/keyingProjectionVerification/containerProjectionVerification.js";
 import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, runWithSecurityIncidentReporting, } from "../../../data/keyingProjectionVerification/error.js";
-import { verifyRuntimeGroupMetadataAuthority } from "../../organizations/runtimeGroupMetadataAuthority.js";
+import { verifyRuntimeGroupMetadataAuthority } from "../../organizations/groupMetadata/runtimeGroupMetadataAuthority.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
 import { cachedDestinationRole, rememberDestinationRole, } from "./destinationRoleCache.js";
 import { resolveWithMetadataRootReload } from "./destinationRootReload.js";

package/workflows/container-contents/remoteHydration/verifiedDestination.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifiedDestination.js","sourceRoot":"","sources":["verifiedDestination.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAC1G,OAAO,EAEL,iCAAiC,GAClC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAC;AACrH,OAAO,EAAE,oCAAoC,EAAE,MAAM,6EAA6E,CAAC;AACnI,OAAO,EAAE,+BAA+B,EAAE,MAAM,4EAA4E,CAAC;AAC7H,OAAO,EACL,yBAAyB,EACzB,yCAAyC,EACzC,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EACL,qBAAqB,EAErB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAUzE,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6CAA6C,CAAC;QACvE,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,+BAA+B,CAAC;QAClD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QACtC,IAAI,EAAE;YACJ,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;YACpD,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW;YAC9C,sBAAsB,EAAE,WAAW,CAAC,YAAY;YAChD,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,kBAAkB;YAC5D,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;gBACzC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CACrC,IAAqB,EACrB,OAAiD;IAEjD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IACE,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,0BAA0B;QAClD,YAAY,EAAE,SAAS;QACvB,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAC5B,MAAM,oCAAoC,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,MAAM;QACN,IAAI;QACJ,cAAc;KACf,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;IAC7B,uEAAuE;IACvE,MAAM,iCAAiC,CAAC;QACtC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,MAAM,mCAAmC,CAAC;YACxC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,8EAA8E;QAC9E,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC;YACxD,GAAG,iBAAiB;YACpB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,KAAK,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAiBD,iFAAiF;AACjF,KAAK,UAAU,sBAAsB,CACnC,KAA4C;IAM5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB;QAClE,SAAS;QACT,MAAM;QACN,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EACN,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,8BAA8B;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,EACD,KAAK,IAAI,EAAE;QACT,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,IACE,CAAC,KAAK,CAAC,OAAO;YACd,iCAAiC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAC5D,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YACf,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,sBAAsB,EACtB,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAClE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,+DAA+D;YAC/D,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QACpC,qEAAqE;QACrE,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC3B,MAAM,iCAAiC,CAAC;gBACtC,YAAY,EAAE,SAAS;gBACvB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM;gBACN,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,QAAQ,CAAC,eAAe;YAC1B,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,GAAG,MAAM;YACT,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC7D,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAChC,eAA+B,EAC/B,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,OAAO,CACL,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,CAAC,SAAS,CAAC,UAAU;QACrB,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe;QACrC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAG7D;IACC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,0BAA0B;YACrC,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CACF,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport {\n  type HeldContainerBinding,\n  listingRepeatsHeldOrdinaryBinding,\n} from \"../../../data/containers/containerBinding\";\nimport { verifiedContainerCreateManifest } from \"../../../data/keyingProjectionVerification/containerCreateManifest\";\nimport { verifyContainerDestinationProjection } from \"../../../data/keyingProjectionVerification/containerDestinationVerification\";\nimport { verifyContainerWriterProjection } from \"../../../data/keyingProjectionVerification/containerProjectionVerification\";\nimport {\n  isKeyingVerificationError,\n  reportKeyingVerificationErrorInCauseChain,\n  runWithSecurityIncidentReporting,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { verifyRuntimeGroupMetadataAuthority } from \"../../organizations/runtimeGroupMetadataAuthority\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { PrefetchedDestinationProjection } from \"./destinationPrefetch\";\nimport {\n  cachedDestinationRole,\n  type DestinationRole,\n  rememberDestinationRole,\n} from \"./destinationRoleCache\";\nimport { resolveWithMetadataRootReload } from \"./destinationRootReload\";\nimport { assertPermittedDestinationBinding } from \"./replacementBinding\";\nimport type {\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\n/** The identity a role is verified and cached under. */\ntype DestinationIdentity = Pick<RemoteContainer, \"id\" | \"organizationId\">;\n\nasync function destinationRoleFromPath(input: {\n  listed: DestinationIdentity;\n  path: readonly VerifiedContainerAccessManifest[];\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<{ role: DestinationRole; parentId: string | null }> {\n  const { listed, path } = input;\n  const head = path.at(-1);\n  if (\n    !head ||\n    head.state.containerId !== listed.id ||\n    head.state.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination manifest has the wrong identity\",\n    );\n  }\n  const metadataSlot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: listed.organizationId,\n  });\n  if (\n    head.state.systemSlot !== null &&\n    path.length !== (head.state.systemSlot === metadataSlot ? 1 : 2)\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"system destination has the wrong signed topology\",\n    );\n  }\n  // The head may be a later grant signed by any admin; only the epoch-1\n  // create names the creator, and roots are always created by the org owner.\n  const created = verifiedContainerCreateManifest({\n    head,\n    label: \"Container destination\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  const root = path[0];\n  if (!root) throw new Error(\"Destination root is unavailable\");\n  const rootCreated = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Destination root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  return {\n    parentId: head.state.parentContainerId,\n    role: {\n      createSignerUserId: created.event.event.signerUserId,\n      rootContainerId: rootCreated.state.containerId,\n      rootCreateManifestHash: rootCreated.manifestHash,\n      rootMetadataDocumentId: rootCreated.state.metadataDocumentId,\n      metadataDocumentId: head.state.metadataDocumentId,\n      ...(head.state.parentContainerId === null ||\n      head.state.systemSlot !== null\n        ? { parentId: head.state.parentContainerId }\n        : {}),\n      systemSlot: head.state.systemSlot,\n    },\n  };\n}\n\n/**\n * The session's root id arrives in an unsigned login response, so the root it\n * names must prove it belongs to this user: every acknowledged organization was\n * created by the session user, whose device signed the root's `container.create`.\n * A verified root created by anyone else is a substitution, never the merge\n * target for pre-login local content, whatever grants it carries. The check\n * runs on cache reuse too, since the cache is not scoped to the session user.\n */\nfunction assertRootCreatedBySessionUser(\n  role: DestinationRole,\n  runtime: RemoteContainerHydrationState[\"runtime\"],\n): void {\n  if (role.systemSlot !== null) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"acknowledged session root cannot be a system container\",\n    );\n  }\n  if (role.createSignerUserId !== runtime.auth.userId) {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"acknowledged session root was not created by the session user\",\n    );\n  }\n}\n\nfunction assertAcknowledgedRootSigner(input: {\n  listed: DestinationIdentity;\n  role: DestinationRole;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): void {\n  const { listed, role, runtime } = input;\n  if (role.parentId !== null || listed.id !== runtime.auth.rootContainerId) {\n    return;\n  }\n  assertRootCreatedBySessionUser(role, runtime);\n}\n\n/**\n * Authenticate destination roles before admitting a binding or advancing any\n * placement pin. Shared rehomes additionally require signed replacement evidence.\n */\nasync function verifyDestinationRole(input: {\n  heldBinding: HeldContainerBinding | null;\n  prefetched: PrefetchedDestinationProjection | undefined;\n  verifyCurrentPlacement: boolean;\n  onVerifiedCheckpoint:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  isCurrent?: (() => boolean) | undefined;\n  listed: DestinationIdentity;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): Promise<{ role: DestinationRole; parentId: string | null } | null> {\n  const { isCurrent, listed, runtime } = input;\n  const projection = input.prefetched\n    ? input.prefetched.projection\n    : await runtime.apiClient.getContainerWriterProjection(listed.id);\n  if (!projection || isCurrent?.() === false) return null;\n  if (\n    projection.containerId !== listed.id ||\n    projection.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination projection has the wrong identity\",\n    );\n  }\n  const verificationInput = {\n    execSql: runtime.infra.execSql,\n    projection,\n    resolveUserKey: runtime.resolveTrustedUserIdentity,\n    stillCurrent: isCurrent,\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  };\n  const { path, verifiedByHash } =\n    await verifyContainerDestinationProjection(verificationInput);\n  if (isCurrent?.() === false) return null;\n  const destination = await destinationRoleFromPath({\n    listed,\n    path,\n    verifiedByHash,\n  });\n  const { role } = destination;\n  // Refuse a rebinding before group checks or placement pins run for it.\n  await assertPermittedDestinationBinding({\n    stillCurrent: isCurrent,\n    heldBinding: input.heldBinding,\n    listed,\n    role,\n    runtime,\n  });\n  if (isCurrent?.() === false) return null;\n  if (role.parentId === null && role.systemSlot !== null) {\n    const head = path.at(-1);\n    if (!head) throw new Error(\"Metadata root manifest is unavailable\");\n    await verifyRuntimeGroupMetadataAuthority({\n      runtime,\n      organizationId: listed.organizationId,\n      organizationReference: projection.policyEvidence.organization?.head,\n      state: head.state,\n      stillCurrent: isCurrent ?? (() => true),\n    });\n  }\n  if (isCurrent?.() === false) return null;\n  if (input.verifyCurrentPlacement) {\n    // Check the immutable role before allowing current placement to advance pins.\n    assertAcknowledgedRootSigner({ listed, role, runtime });\n    const currentPath = await verifyContainerWriterProjection({\n      ...verificationInput,\n      stillCurrent: isCurrent,\n    });\n    const currentHead = currentPath.at(-1);\n    if (!currentHead)\n      throw new Error(\"Recovery placement manifest is unavailable\");\n    input.onVerifiedCheckpoint?.(currentHead.checkpoint);\n  }\n  if (isCurrent?.() === false) return null;\n  return destination;\n}\n\ntype VerifyRemoteContainerDestinationInput = {\n  heldBinding: HeldContainerBinding | null;\n  /** The held folder was re-homed away from the listed organization. */\n  supersededListing?: boolean | undefined;\n  /** Fetched ahead by page hydration; ignored when placement is refreshed. */\n  prefetchedProjection?: PrefetchedDestinationProjection | undefined;\n  refresh?: boolean;\n  onVerifiedCheckpoint?:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n  isCurrent?: (() => boolean) | undefined;\n};\n\n/** A cached immutable role, or a freshly verified one with its signed parent. */\nasync function resolveDestinationRole(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<{\n  freshlyVerified: boolean;\n  parentId: string | null | undefined;\n  role: DestinationRole;\n} | null> {\n  const { remoteContainer: listed, isCurrent } = input;\n  const runtime = input.state.runtime;\n  const cached = input.refresh\n    ? undefined\n    : cachedDestinationRole(runtime.infra.execSql, listed);\n  // Ordinary parent edges are not immutable. A refresh authenticates current\n  // placement; a forged root hint must also be corrected from a signed path.\n  if (cached && !(cached.parentId === undefined && listed.parentId === null)) {\n    return { freshlyVerified: false, parentId: cached.parentId, role: cached };\n  }\n  const verified = await verifyDestinationRole({\n    heldBinding: input.heldBinding,\n    prefetched: input.refresh ? undefined : input.prefetchedProjection,\n    isCurrent,\n    listed,\n    runtime,\n    verifyCurrentPlacement: input.refresh === true,\n    onVerifiedCheckpoint: input.onVerifiedCheckpoint,\n  });\n  if (!verified) return null;\n  return {\n    freshlyVerified: true,\n    parentId:\n      input.refresh || listed.parentId === null\n        ? verified.parentId\n        : verified.role.parentId,\n    role: verified.role,\n  };\n}\n\n/**\n * Listing hints never establish a metadata target or a system/root role, and a\n * held folder keeps its organization and metadata target unless its own user\n * re-created it or its pinned founder authorized a verified replacement.\n * A conflicting proof is refused before placement pins\n * advance or its role is cached.\n */\nexport async function verifyRemoteContainerDestination(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<RemoteContainer | null> {\n  const { remoteContainer: listed, state, isCurrent } = input;\n  const runtime = state.runtime;\n  return runWithSecurityIncidentReporting(\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: listed.id,\n      objectKind: \"container\",\n      operation: \"container.destination.verify\",\n      organizationId: listed.organizationId,\n    },\n    async () => {\n      if (input.supersededListing) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"container was re-homed away from the listed organization\",\n        );\n      }\n      // A held ordinary binding was verified (or signed by this device) when\n      // it was stored; a listing that repeats it needs no second proof.\n      if (\n        !input.refresh &&\n        listingRepeatsHeldOrdinaryBinding(input.heldBinding, listed)\n      ) {\n        return { ...listed, systemSlot: null };\n      }\n      if (input.refresh)\n        runtime.apiClient.evictContainerWriterProjection(listed.id);\n      // A metadata root read before a reserved-group commit is reloaded once.\n      const resolved = await resolveWithMetadataRootReload(\n        input,\n        resolveDestinationRole,\n        () => runtime.apiClient.evictContainerWriterProjection(listed.id),\n      ).catch((error: unknown) => {\n        // Never re-serve a cached projection that failed verification.\n        if (isKeyingVerificationError(error))\n          runtime.apiClient.evictContainerWriterProjection(listed.id);\n        throw error;\n      });\n      if (!resolved || isCurrent?.() === false) return null;\n      const { role, parentId } = resolved;\n      // Fresh verification checked this binding before any placement pins.\n      // A cached role still needs the held binding and replacement proof checked.\n      if (!resolved.freshlyVerified)\n        await assertPermittedDestinationBinding({\n          stillCurrent: isCurrent,\n          heldBinding: input.heldBinding,\n          listed,\n          role,\n          runtime,\n        });\n      if (isCurrent?.() === false) return null;\n      if (resolved.freshlyVerified)\n        rememberDestinationRole(runtime.infra.execSql, listed, role);\n      assertAcknowledgedRootSigner({ listed, role, runtime });\n      return {\n        ...listed,\n        metadataDocumentId: role.metadataDocumentId,\n        parentId: parentId === undefined ? listed.parentId : parentId,\n        systemSlot: role.systemSlot,\n      };\n    },\n  );\n}\n\n/** The root the unsigned login answer named, in the expected organization. */\nexport function isSessionRootState(\n  remoteRootState: ContainerState,\n  state: RemoteContainerHydrationState,\n): boolean {\n  const { container } = remoteRootState;\n  const { auth } = state.runtime;\n  return (\n    container.parentId === null &&\n    !container.systemSlot &&\n    container.id === auth.rootContainerId &&\n    container.organizationId === auth.organizationId\n  );\n}\n\n/**\n * Whether the session root may absorb the pre-login local roots. The unsigned\n * login answer only names the root; the merge target must also be the verified\n * root whose epoch-1 `container.create` the session user signed. A row persisted\n * earlier as an ordinary shared container (another user's root this device once\n * hydrated) never passed that check for this session, so the creator is checked\n * here, at the reconciliation boundary itself, before any local content is\n * re-parented. The role comes only from the cache remote hydration fills when\n * it verifies the destination: this gate never fetches, so a local refresh stays\n * independent of the network. Without a cached role the merge is left pending\n * (no incident) until hydration verifies the root and reconciles from the\n * cache. A different creator is a `signer_mismatch` incident and never a merge;\n * the refusal is the \"no merge\" outcome, so the refresh that carried it\n * completes with the local content left in place.\n */\nexport async function isVerifiedLocalRootReconciliationTarget(input: {\n  remoteRootState: ContainerState;\n  state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n  const { remoteRootState, state } = input;\n  const { container } = remoteRootState;\n  const runtime = state.runtime;\n  if (!isSessionRootState(remoteRootState, state)) return false;\n  const role = cachedDestinationRole(runtime.infra.execSql, container);\n  if (!role) return false;\n  try {\n    if (role.parentId !== null) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"session root reconciliation target is not a verified root\",\n      );\n    }\n    assertRootCreatedBySessionUser(role, runtime);\n    return true;\n  } catch (error) {\n    const reported = await reportKeyingVerificationErrorInCauseChain(\n      error,\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: container.id,\n        objectKind: \"container\",\n        operation: \"container.root.reconcile\",\n        organizationId: container.organizationId,\n      },\n    );\n    if (!reported) throw error;\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"verifiedDestination.js","sourceRoot":"","sources":["verifiedDestination.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAC1G,OAAO,EAEL,iCAAiC,GAClC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAC;AACrH,OAAO,EAAE,oCAAoC,EAAE,MAAM,6EAA6E,CAAC;AACnI,OAAO,EAAE,+BAA+B,EAAE,MAAM,4EAA4E,CAAC;AAC7H,OAAO,EACL,yBAAyB,EACzB,yCAAyC,EACzC,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,iEAAiE,CAAC;AACtH,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EACL,qBAAqB,EAErB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAUzE,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6CAA6C,CAAC;QACvE,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,+BAA+B,CAAC;QAClD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QACtC,IAAI,EAAE;YACJ,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;YACpD,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW;YAC9C,sBAAsB,EAAE,WAAW,CAAC,YAAY;YAChD,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,kBAAkB;YAC5D,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;gBACzC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CACrC,IAAqB,EACrB,OAAiD;IAEjD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IACE,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,0BAA0B;QAClD,YAAY,EAAE,SAAS;QACvB,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAC5B,MAAM,oCAAoC,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,MAAM;QACN,IAAI;QACJ,cAAc;KACf,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;IAC7B,uEAAuE;IACvE,MAAM,iCAAiC,CAAC;QACtC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,MAAM,mCAAmC,CAAC;YACxC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,8EAA8E;QAC9E,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC;YACxD,GAAG,iBAAiB;YACpB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,KAAK,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAiBD,iFAAiF;AACjF,KAAK,UAAU,sBAAsB,CACnC,KAA4C;IAM5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB;QAClE,SAAS;QACT,MAAM;QACN,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EACN,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,8BAA8B;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,EACD,KAAK,IAAI,EAAE;QACT,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,IACE,CAAC,KAAK,CAAC,OAAO;YACd,iCAAiC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAC5D,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YACf,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,sBAAsB,EACtB,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAClE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,+DAA+D;YAC/D,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QACpC,qEAAqE;QACrE,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC3B,MAAM,iCAAiC,CAAC;gBACtC,YAAY,EAAE,SAAS;gBACvB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM;gBACN,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,QAAQ,CAAC,eAAe;YAC1B,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,GAAG,MAAM;YACT,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC7D,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAChC,eAA+B,EAC/B,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,OAAO,CACL,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,CAAC,SAAS,CAAC,UAAU;QACrB,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe;QACrC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAG7D;IACC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,0BAA0B;YACrC,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CACF,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport {\n  type HeldContainerBinding,\n  listingRepeatsHeldOrdinaryBinding,\n} from \"../../../data/containers/containerBinding\";\nimport { verifiedContainerCreateManifest } from \"../../../data/keyingProjectionVerification/containerCreateManifest\";\nimport { verifyContainerDestinationProjection } from \"../../../data/keyingProjectionVerification/containerDestinationVerification\";\nimport { verifyContainerWriterProjection } from \"../../../data/keyingProjectionVerification/containerProjectionVerification\";\nimport {\n  isKeyingVerificationError,\n  reportKeyingVerificationErrorInCauseChain,\n  runWithSecurityIncidentReporting,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { verifyRuntimeGroupMetadataAuthority } from \"../../organizations/groupMetadata/runtimeGroupMetadataAuthority\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { PrefetchedDestinationProjection } from \"./destinationPrefetch\";\nimport {\n  cachedDestinationRole,\n  type DestinationRole,\n  rememberDestinationRole,\n} from \"./destinationRoleCache\";\nimport { resolveWithMetadataRootReload } from \"./destinationRootReload\";\nimport { assertPermittedDestinationBinding } from \"./replacementBinding\";\nimport type {\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\n/** The identity a role is verified and cached under. */\ntype DestinationIdentity = Pick<RemoteContainer, \"id\" | \"organizationId\">;\n\nasync function destinationRoleFromPath(input: {\n  listed: DestinationIdentity;\n  path: readonly VerifiedContainerAccessManifest[];\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<{ role: DestinationRole; parentId: string | null }> {\n  const { listed, path } = input;\n  const head = path.at(-1);\n  if (\n    !head ||\n    head.state.containerId !== listed.id ||\n    head.state.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination manifest has the wrong identity\",\n    );\n  }\n  const metadataSlot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: listed.organizationId,\n  });\n  if (\n    head.state.systemSlot !== null &&\n    path.length !== (head.state.systemSlot === metadataSlot ? 1 : 2)\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"system destination has the wrong signed topology\",\n    );\n  }\n  // The head may be a later grant signed by any admin; only the epoch-1\n  // create names the creator, and roots are always created by the org owner.\n  const created = verifiedContainerCreateManifest({\n    head,\n    label: \"Container destination\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  const root = path[0];\n  if (!root) throw new Error(\"Destination root is unavailable\");\n  const rootCreated = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Destination root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  return {\n    parentId: head.state.parentContainerId,\n    role: {\n      createSignerUserId: created.event.event.signerUserId,\n      rootContainerId: rootCreated.state.containerId,\n      rootCreateManifestHash: rootCreated.manifestHash,\n      rootMetadataDocumentId: rootCreated.state.metadataDocumentId,\n      metadataDocumentId: head.state.metadataDocumentId,\n      ...(head.state.parentContainerId === null ||\n      head.state.systemSlot !== null\n        ? { parentId: head.state.parentContainerId }\n        : {}),\n      systemSlot: head.state.systemSlot,\n    },\n  };\n}\n\n/**\n * The session's root id arrives in an unsigned login response, so the root it\n * names must prove it belongs to this user: every acknowledged organization was\n * created by the session user, whose device signed the root's `container.create`.\n * A verified root created by anyone else is a substitution, never the merge\n * target for pre-login local content, whatever grants it carries. The check\n * runs on cache reuse too, since the cache is not scoped to the session user.\n */\nfunction assertRootCreatedBySessionUser(\n  role: DestinationRole,\n  runtime: RemoteContainerHydrationState[\"runtime\"],\n): void {\n  if (role.systemSlot !== null) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"acknowledged session root cannot be a system container\",\n    );\n  }\n  if (role.createSignerUserId !== runtime.auth.userId) {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"acknowledged session root was not created by the session user\",\n    );\n  }\n}\n\nfunction assertAcknowledgedRootSigner(input: {\n  listed: DestinationIdentity;\n  role: DestinationRole;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): void {\n  const { listed, role, runtime } = input;\n  if (role.parentId !== null || listed.id !== runtime.auth.rootContainerId) {\n    return;\n  }\n  assertRootCreatedBySessionUser(role, runtime);\n}\n\n/**\n * Authenticate destination roles before admitting a binding or advancing any\n * placement pin. Shared rehomes additionally require signed replacement evidence.\n */\nasync function verifyDestinationRole(input: {\n  heldBinding: HeldContainerBinding | null;\n  prefetched: PrefetchedDestinationProjection | undefined;\n  verifyCurrentPlacement: boolean;\n  onVerifiedCheckpoint:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  isCurrent?: (() => boolean) | undefined;\n  listed: DestinationIdentity;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): Promise<{ role: DestinationRole; parentId: string | null } | null> {\n  const { isCurrent, listed, runtime } = input;\n  const projection = input.prefetched\n    ? input.prefetched.projection\n    : await runtime.apiClient.getContainerWriterProjection(listed.id);\n  if (!projection || isCurrent?.() === false) return null;\n  if (\n    projection.containerId !== listed.id ||\n    projection.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination projection has the wrong identity\",\n    );\n  }\n  const verificationInput = {\n    execSql: runtime.infra.execSql,\n    projection,\n    resolveUserKey: runtime.resolveTrustedUserIdentity,\n    stillCurrent: isCurrent,\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  };\n  const { path, verifiedByHash } =\n    await verifyContainerDestinationProjection(verificationInput);\n  if (isCurrent?.() === false) return null;\n  const destination = await destinationRoleFromPath({\n    listed,\n    path,\n    verifiedByHash,\n  });\n  const { role } = destination;\n  // Refuse a rebinding before group checks or placement pins run for it.\n  await assertPermittedDestinationBinding({\n    stillCurrent: isCurrent,\n    heldBinding: input.heldBinding,\n    listed,\n    role,\n    runtime,\n  });\n  if (isCurrent?.() === false) return null;\n  if (role.parentId === null && role.systemSlot !== null) {\n    const head = path.at(-1);\n    if (!head) throw new Error(\"Metadata root manifest is unavailable\");\n    await verifyRuntimeGroupMetadataAuthority({\n      runtime,\n      organizationId: listed.organizationId,\n      organizationReference: projection.policyEvidence.organization?.head,\n      state: head.state,\n      stillCurrent: isCurrent ?? (() => true),\n    });\n  }\n  if (isCurrent?.() === false) return null;\n  if (input.verifyCurrentPlacement) {\n    // Check the immutable role before allowing current placement to advance pins.\n    assertAcknowledgedRootSigner({ listed, role, runtime });\n    const currentPath = await verifyContainerWriterProjection({\n      ...verificationInput,\n      stillCurrent: isCurrent,\n    });\n    const currentHead = currentPath.at(-1);\n    if (!currentHead)\n      throw new Error(\"Recovery placement manifest is unavailable\");\n    input.onVerifiedCheckpoint?.(currentHead.checkpoint);\n  }\n  if (isCurrent?.() === false) return null;\n  return destination;\n}\n\ntype VerifyRemoteContainerDestinationInput = {\n  heldBinding: HeldContainerBinding | null;\n  /** The held folder was re-homed away from the listed organization. */\n  supersededListing?: boolean | undefined;\n  /** Fetched ahead by page hydration; ignored when placement is refreshed. */\n  prefetchedProjection?: PrefetchedDestinationProjection | undefined;\n  refresh?: boolean;\n  onVerifiedCheckpoint?:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n  isCurrent?: (() => boolean) | undefined;\n};\n\n/** A cached immutable role, or a freshly verified one with its signed parent. */\nasync function resolveDestinationRole(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<{\n  freshlyVerified: boolean;\n  parentId: string | null | undefined;\n  role: DestinationRole;\n} | null> {\n  const { remoteContainer: listed, isCurrent } = input;\n  const runtime = input.state.runtime;\n  const cached = input.refresh\n    ? undefined\n    : cachedDestinationRole(runtime.infra.execSql, listed);\n  // Ordinary parent edges are not immutable. A refresh authenticates current\n  // placement; a forged root hint must also be corrected from a signed path.\n  if (cached && !(cached.parentId === undefined && listed.parentId === null)) {\n    return { freshlyVerified: false, parentId: cached.parentId, role: cached };\n  }\n  const verified = await verifyDestinationRole({\n    heldBinding: input.heldBinding,\n    prefetched: input.refresh ? undefined : input.prefetchedProjection,\n    isCurrent,\n    listed,\n    runtime,\n    verifyCurrentPlacement: input.refresh === true,\n    onVerifiedCheckpoint: input.onVerifiedCheckpoint,\n  });\n  if (!verified) return null;\n  return {\n    freshlyVerified: true,\n    parentId:\n      input.refresh || listed.parentId === null\n        ? verified.parentId\n        : verified.role.parentId,\n    role: verified.role,\n  };\n}\n\n/**\n * Listing hints never establish a metadata target or a system/root role, and a\n * held folder keeps its organization and metadata target unless its own user\n * re-created it or its pinned founder authorized a verified replacement.\n * A conflicting proof is refused before placement pins\n * advance or its role is cached.\n */\nexport async function verifyRemoteContainerDestination(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<RemoteContainer | null> {\n  const { remoteContainer: listed, state, isCurrent } = input;\n  const runtime = state.runtime;\n  return runWithSecurityIncidentReporting(\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: listed.id,\n      objectKind: \"container\",\n      operation: \"container.destination.verify\",\n      organizationId: listed.organizationId,\n    },\n    async () => {\n      if (input.supersededListing) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"container was re-homed away from the listed organization\",\n        );\n      }\n      // A held ordinary binding was verified (or signed by this device) when\n      // it was stored; a listing that repeats it needs no second proof.\n      if (\n        !input.refresh &&\n        listingRepeatsHeldOrdinaryBinding(input.heldBinding, listed)\n      ) {\n        return { ...listed, systemSlot: null };\n      }\n      if (input.refresh)\n        runtime.apiClient.evictContainerWriterProjection(listed.id);\n      // A metadata root read before a reserved-group commit is reloaded once.\n      const resolved = await resolveWithMetadataRootReload(\n        input,\n        resolveDestinationRole,\n        () => runtime.apiClient.evictContainerWriterProjection(listed.id),\n      ).catch((error: unknown) => {\n        // Never re-serve a cached projection that failed verification.\n        if (isKeyingVerificationError(error))\n          runtime.apiClient.evictContainerWriterProjection(listed.id);\n        throw error;\n      });\n      if (!resolved || isCurrent?.() === false) return null;\n      const { role, parentId } = resolved;\n      // Fresh verification checked this binding before any placement pins.\n      // A cached role still needs the held binding and replacement proof checked.\n      if (!resolved.freshlyVerified)\n        await assertPermittedDestinationBinding({\n          stillCurrent: isCurrent,\n          heldBinding: input.heldBinding,\n          listed,\n          role,\n          runtime,\n        });\n      if (isCurrent?.() === false) return null;\n      if (resolved.freshlyVerified)\n        rememberDestinationRole(runtime.infra.execSql, listed, role);\n      assertAcknowledgedRootSigner({ listed, role, runtime });\n      return {\n        ...listed,\n        metadataDocumentId: role.metadataDocumentId,\n        parentId: parentId === undefined ? listed.parentId : parentId,\n        systemSlot: role.systemSlot,\n      };\n    },\n  );\n}\n\n/** The root the unsigned login answer named, in the expected organization. */\nexport function isSessionRootState(\n  remoteRootState: ContainerState,\n  state: RemoteContainerHydrationState,\n): boolean {\n  const { container } = remoteRootState;\n  const { auth } = state.runtime;\n  return (\n    container.parentId === null &&\n    !container.systemSlot &&\n    container.id === auth.rootContainerId &&\n    container.organizationId === auth.organizationId\n  );\n}\n\n/**\n * Whether the session root may absorb the pre-login local roots. The unsigned\n * login answer only names the root; the merge target must also be the verified\n * root whose epoch-1 `container.create` the session user signed. A row persisted\n * earlier as an ordinary shared container (another user's root this device once\n * hydrated) never passed that check for this session, so the creator is checked\n * here, at the reconciliation boundary itself, before any local content is\n * re-parented. The role comes only from the cache remote hydration fills when\n * it verifies the destination: this gate never fetches, so a local refresh stays\n * independent of the network. Without a cached role the merge is left pending\n * (no incident) until hydration verifies the root and reconciles from the\n * cache. A different creator is a `signer_mismatch` incident and never a merge;\n * the refusal is the \"no merge\" outcome, so the refresh that carried it\n * completes with the local content left in place.\n */\nexport async function isVerifiedLocalRootReconciliationTarget(input: {\n  remoteRootState: ContainerState;\n  state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n  const { remoteRootState, state } = input;\n  const { container } = remoteRootState;\n  const runtime = state.runtime;\n  if (!isSessionRootState(remoteRootState, state)) return false;\n  const role = cachedDestinationRole(runtime.infra.execSql, container);\n  if (!role) return false;\n  try {\n    if (role.parentId !== null) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"session root reconciliation target is not a verified root\",\n      );\n    }\n    assertRootCreatedBySessionUser(role, runtime);\n    return true;\n  } catch (error) {\n    const reported = await reportKeyingVerificationErrorInCauseChain(\n      error,\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: container.id,\n        objectKind: \"container\",\n        operation: \"container.root.reconcile\",\n        organizationId: container.organizationId,\n      },\n    );\n    if (!reported) throw error;\n    return false;\n  }\n}\n"]}

package/workflows/container-contents/tombstones/documentPurge.d.ts

@@ -0,0 +1,37 @@
+import type { DocumentPurgeResponse } from "../../../internal/validators/response/index.js";
+import type { StoredDocumentKind } from "../../../data/documents/documentKinds.js";
+import type { ProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/index.js";
+import { type DocumentsPersistence, deletePersistedDocument } from "../../documents/index.js";
+import type { SubtreePurgeRoot } from "../../documents/purge/subtreePurgeScope.js";
+import type { ContainerContentsWorkflowRuntime } from "../runtime.js";
+type ContainerDocumentPurgeApi = Pick<ContainerContentsWorkflowRuntime["apiClient"], "getPrincipalPolicyPages" | "getProjectionPolicyHistoryPages" | "getDocumentPurgeProof" | "getDocumentWriterProjectionResult" | "purgeDocument">;
+type DocumentPurgeResult = DocumentPurgeResponse | {
+    readonly documentId: string;
+    readonly purgedAt: string;
+    readonly reclaimedBlobStorageKeys: readonly string[];
+} | null;
+interface ContainerDocumentPurgeRuntime extends Pick<ContainerContentsWorkflowRuntime, "auth" | "crypto" | "infra" | "resolveTrustedUserIdentity" | "state" | "util"> {
+    apiClient: ContainerDocumentPurgeApi;
+}
+interface PurgeRemoteContainerDocumentInput {
+    beforeSubmit?: (() => Promise<boolean>) | undefined;
+    documentId: string;
+    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    documentKind: StoredDocumentKind;
+    noteId: string;
+    persistence?: DocumentsPersistence | undefined;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    runtime: ContainerDocumentPurgeRuntime;
+}
+export declare function purgeRemoteContainerDocument(input: PurgeRemoteContainerDocumentInput): Promise<DocumentPurgeResult>;
+interface ContainerDocumentLocalPurgeRuntime extends Pick<ContainerContentsWorkflowRuntime, "infra" | "util"> {
+}
+export declare function purgeLocalContainerDocument(input: {
+    beforeDeleteInTransaction?: Parameters<typeof deletePersistedDocument>[0]["beforeDeleteInTransaction"];
+    noteId: string;
+    expectedContainerId?: string | null | undefined;
+    persistence?: DocumentsPersistence | undefined;
+    runtime: ContainerDocumentLocalPurgeRuntime;
+}): Promise<DocumentPurgeResult>;
+export {};

package/workflows/container-contents/tombstones/documentPurge.js

@@ -0,0 +1,136 @@
+import { reportAndRethrowKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
+import { rethrowProjectionVerificationCancelled } from "../../../data/keyingProjectionVerification/types.js";
+import { errorMessage } from "../../../data/shared/errorMessage.js";
+import { defaultDocumentsPersistence, deletePersistedDocument, purgeRemoteDocument, reclaimDocumentOrphanBlobs, resolveDocumentCreateAuthor, } from "../../documents/index.js";
+import { ensureDocumentClientProjectionTables } from "../../documents/persistence.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+async function deleteAbsentDocumentState(input) {
+    return input.persistence.deleteDocumentSideRowsIfAbsent(input.runtime.infra.execSql, input.noteId, input.documentId, async (transactionExecSql) => {
+        await input.runtime.infra.documentProjectors.deleteStoredDocumentClientProjection({
+            documentKind: input.documentKind,
+            execSql: transactionExecSql,
+            localId: input.noteId,
+        });
+        await input.commitPurgeProof(transactionExecSql);
+    });
+}
+async function commitVerifiedDocumentPurge(input) {
+    await input.persistence.ensureSchema(input.runtime.infra.execSql);
+    await ensureDocumentClientProjectionTables({
+        documentProjectors: input.runtime.infra.documentProjectors,
+        execSql: input.runtime.infra.execSql,
+    });
+    const expectedRecord = await input.persistence.loadDocument(input.runtime.infra.execSql, input.noteId);
+    if (expectedRecord && expectedRecord.documentId !== input.documentId) {
+        throw new Error("Local document identity changed while its remote purge was committing");
+    }
+    const deleted = expectedRecord
+        ? await deletePersistedDocument({
+            beforeDeleteInTransaction: input.commitPurgeProof,
+            documentProjectors: input.runtime.infra.documentProjectors,
+            execSql: input.runtime.infra.execSql,
+            expectedRecord,
+            localId: input.noteId,
+            persistence: input.persistence,
+        })
+        : await deleteAbsentDocumentState(input);
+    if (!deleted) {
+        throw new Error("Local document state changed while its remote purge was committing");
+    }
+    return true;
+}
+export async function purgeRemoteContainerDocument(input) {
+    const { documentId, noteId, runtime } = input;
+    const persistence = input.persistence ?? defaultDocumentsPersistence;
+    try {
+        const author = resolveDocumentCreateAuthor(runtime);
+        if (!author) {
+            runtime.util.log(`Container contents: failed to purge note ${noteId} because the local signing context is unavailable`);
+            return null;
+        }
+        let deleted = false;
+        const response = await purgeRemoteDocument({
+            apiClient: runtime.apiClient,
+            beforeSubmit: input.beforeSubmit,
+            author,
+            documentId,
+            expectedSubtreeRoot: input.expectedSubtreeRoot,
+            stillCurrent: input.stillCurrent,
+            execSql: runtime.infra.execSql,
+            onVerifiedPurge: async ({ commitPurgeProof }) => {
+                deleted = await commitVerifiedDocumentPurge({
+                    commitPurgeProof,
+                    documentId,
+                    documentKind: input.documentKind,
+                    noteId,
+                    persistence,
+                    runtime,
+                });
+            },
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+        });
+        if (!response) {
+            runtime.util.log(`Container contents: failed to purge note ${noteId} (document ${documentId})`);
+            return null;
+        }
+        if (deleted) {
+            void reclaimDocumentOrphanBlobs(runtime, persistence);
+        }
+        runtime.util.log(`Container contents: purged note ${noteId} (document ${documentId})`);
+        return response;
+    }
+    catch (error) {
+        // A cancelled verification is neither a failure nor a completed purge; the
+        // caller that owns the generation decides what to do with it.
+        rethrowProjectionVerificationCancelled(error);
+        await reportAndRethrowKeyingVerificationError(error, runtime.util.reportSecurityIncident, {
+            objectId: documentId,
+            objectKind: "document",
+            operation: "document.purge",
+        });
+        runtime.util.log(`Container contents: failed to purge note ${noteId} (document ${documentId}): ${errorMessage(error)}`);
+        return null;
+    }
+}
+export async function purgeLocalContainerDocument(input) {
+    const { noteId, runtime } = input;
+    const persistence = input.persistence ?? defaultDocumentsPersistence;
+    try {
+        await persistence.ensureSchema(runtime.infra.execSql);
+        const expectedRecord = await persistence.loadDocument(runtime.infra.execSql, noteId);
+        if (!expectedRecord ||
+            expectedRecord.documentId !== null ||
+            (input.expectedContainerId !== undefined &&
+                expectedRecord.containerId !== input.expectedContainerId)) {
+            runtime.util.log(`Container contents: local-only purge refused for note ${noteId} because it is absent or remote-backed`);
+            return null;
+        }
+        const deleted = await deletePersistedDocument({
+            beforeDeleteInTransaction: input.beforeDeleteInTransaction,
+            documentProjectors: runtime.infra.documentProjectors,
+            execSql: runtime.infra.execSql,
+            expectedRecord,
+            localId: noteId,
+            persistence,
+        });
+        if (!deleted) {
+            runtime.util.log(`Container contents: local-only purge refused for note ${noteId} because its identity changed`);
+            return null;
+        }
+        if (deleted) {
+            void reclaimDocumentOrphanBlobs(runtime, persistence);
+        }
+        runtime.util.log(`Container contents: purged local-only note ${noteId}`);
+        return {
+            documentId: noteId,
+            purgedAt: new Date().toISOString(),
+            reclaimedBlobStorageKeys: [],
+        };
+    }
+    catch (error) {
+        runtime.util.log(`Container contents: failed to purge local-only note ${noteId}: ${errorMessage(error)}`);
+        return null;
+    }
+}
+//# sourceMappingURL=documentPurge.js.map