@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/organizationReplacementVerification.js

@@ -1,26 +0,0 @@
-import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../internal/crypto/index.js";
-import { persistOrganizationReplacementCheckpoints } from "../../data/persistence/organizationReplacementCheckpointPersistence.js";
-/** The API's user/organization echoes are not authority to rehome local data. */
-export function verifyOrganizationReplacementResponse(input) {
-    const { response } = input;
-    const authorization = verifyOrganizationReplacementAuthorization(response.replacementAuthorization, input.signingPublicKey);
-    if (authorization.replacesOrganizationId !== input.replacesOrganizationId ||
-        authorization.userId !== input.userId ||
-        response.userId !== input.userId ||
-        authorization.organizationId !== response.organizationId ||
-        authorization.rootContainerId !== response.rootContainerId ||
-        authorization.rootManifestHash !== response.rootMetadataAccessStateHash ||
-        authorization.rootMetadataDocumentId !== response.rootMetadataDocumentId ||
-        response.rootMetadataAccessEpoch !== 1) {
-        throw new KeyingVerificationError("object_mismatch", "Organization replacement response does not match its signed authorization");
-    }
-    return authorization;
-}
-export async function pinOrganizationReplacementResponse(input) {
-    return persistOrganizationReplacementCheckpoints({
-        authorization: verifyOrganizationReplacementResponse(input),
-        execSql: input.execSql,
-        stillCurrent: input.stillCurrent,
-    });
-}
-//# sourceMappingURL=organizationReplacementVerification.js.map

package/workflows/organizations/organizationReplacementVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationReplacementVerification.js","sourceRoot":"","sources":["organizationReplacementVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,qEAAqE,CAAC;AAGhI,iFAAiF;AACjF,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,aAAa,GAAG,0CAA0C,CAC9D,QAAQ,CAAC,wBAAwB,EACjC,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IACE,aAAa,CAAC,sBAAsB,KAAK,KAAK,CAAC,sBAAsB;QACrE,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACrC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAChC,aAAa,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACxD,aAAa,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QAC1D,aAAa,CAAC,gBAAgB,KAAK,QAAQ,CAAC,2BAA2B;QACvE,aAAa,CAAC,sBAAsB,KAAK,QAAQ,CAAC,sBAAsB;QACxE,QAAQ,CAAC,uBAAuB,KAAK,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,OAAO,yCAAyC,CAAC;QAC/C,aAAa,EAAE,qCAAqC,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../data/persistence/organizationReplacementCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n/** The API's user/organization echoes are not authority to rehome local data. */\nexport function verifyOrganizationReplacementResponse(input: {\n  readonly replacesOrganizationId: string;\n  readonly response: CreateOrganizationResponse;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}): VerifiedOrganizationReplacementAuthorization {\n  const { response } = input;\n  const authorization = verifyOrganizationReplacementAuthorization(\n    response.replacementAuthorization,\n    input.signingPublicKey,\n  );\n  if (\n    authorization.replacesOrganizationId !== input.replacesOrganizationId ||\n    authorization.userId !== input.userId ||\n    response.userId !== input.userId ||\n    authorization.organizationId !== response.organizationId ||\n    authorization.rootContainerId !== response.rootContainerId ||\n    authorization.rootManifestHash !== response.rootMetadataAccessStateHash ||\n    authorization.rootMetadataDocumentId !== response.rootMetadataDocumentId ||\n    response.rootMetadataAccessEpoch !== 1\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization replacement response does not match its signed authorization\",\n    );\n  }\n  return authorization;\n}\n\nexport async function pinOrganizationReplacementResponse(\n  input: Parameters<typeof verifyOrganizationReplacementResponse>[0] & {\n    readonly execSql: ExecSql;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<boolean> {\n  return persistOrganizationReplacementCheckpoints({\n    authorization: verifyOrganizationReplacementResponse(input),\n    execSql: input.execSql,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/workflows/organizations/policyHistoryAccessDenial.js

@@ -1,19 +0,0 @@
-import { purgeOrganizationAccessProjection } from "../../data/persistence/organizations/organizationAccessRevocationPersistence.js";
-import { recordOrganizationPresentationDenials } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
-import { denyOrganizationPresentationAccess, runOrganizationPresentationMutation, } from "./organizationPresentationAccessState.js";
-export async function denyPolicyHistoryAccess(input) {
-    denyOrganizationPresentationAccess(input, ["readModel", "usage"]);
-    try {
-        await runOrganizationPresentationMutation(input.execSql, () => recordOrganizationPresentationDenials(input, ["readModel", "usage"]));
-    }
-    catch (error) {
-        input.logError("Failed to record denied organization policy history", error);
-    }
-    try {
-        await runOrganizationPresentationMutation(input.execSql, () => purgeOrganizationAccessProjection(input));
-    }
-    catch (error) {
-        input.logError("Failed to purge denied organization policy history", error);
-    }
-}
-//# sourceMappingURL=policyHistoryAccessDenial.js.map

package/workflows/organizations/policyHistoryAccessDenial.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policyHistoryAccessDenial.js","sourceRoot":"","sources":["policyHistoryAccessDenial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,8EAA8E,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,gFAAgF,CAAC;AAEvI,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,kCAAkC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,qCAAqC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,QAAQ,CACZ,qDAAqD,EACrD,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,iCAAiC,CAAC,KAAK,CAAC,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,QAAQ,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC","sourcesContent":["import { purgeOrganizationAccessProjection } from \"../../data/persistence/organizations/organizationAccessRevocationPersistence\";\nimport { recordOrganizationPresentationDenials } from \"../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  denyOrganizationPresentationAccess,\n  runOrganizationPresentationMutation,\n} from \"./organizationPresentationAccessState\";\n\nexport async function denyPolicyHistoryAccess(input: {\n  execSql: ExecSql;\n  organizationId: string;\n  requesterUserId: string;\n  logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<void> {\n  denyOrganizationPresentationAccess(input, [\"readModel\", \"usage\"]);\n  try {\n    await runOrganizationPresentationMutation(input.execSql, () =>\n      recordOrganizationPresentationDenials(input, [\"readModel\", \"usage\"]),\n    );\n  } catch (error) {\n    input.logError(\n      \"Failed to record denied organization policy history\",\n      error,\n    );\n  }\n  try {\n    await runOrganizationPresentationMutation(input.execSql, () =>\n      purgeOrganizationAccessProjection(input),\n    );\n  } catch (error) {\n    input.logError(\"Failed to purge denied organization policy history\", error);\n  }\n}\n"]}

package/workflows/organizations/policyHistoryCache.js

@@ -1,42 +0,0 @@
-import { isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, organizationAccessScopeKey, } from "./organizationPresentationAccessState.js";
-// Only one verified page per account/org is retained. Names and wire
-// evidence never enter this cache, and nothing here is written to a database.
-const histories = new WeakMap();
-export function loadCachedPolicyHistory(input) {
-    const byKey = histories.get(input.domainScope);
-    const key = organizationAccessScopeKey(input.access.organizationId, input.access.requesterUserId);
-    const cached = byKey?.get(key);
-    if (!cached)
-        return null;
-    if (cached.access.execSql !== input.access.execSql ||
-        cached.stateHash !== input.stateHash ||
-        cached.beforeVersion !== input.beforeVersion ||
-        !isOrganizationPresentationAccessAttemptCurrent(input.access, cached.attempt) ||
-        !isOrganizationPresentationAccessReadable(input.access, "readModel")) {
-        byKey?.delete(key);
-        return null;
-    }
-    return structuredClone(cached.history);
-}
-export function cachePolicyHistory(input) {
-    if (!isOrganizationPresentationAccessAttemptCurrent(input.access, input.attempt) ||
-        !isOrganizationPresentationAccessReadable(input.access, "readModel"))
-        return;
-    let byKey = histories.get(input.domainScope);
-    if (!byKey) {
-        byKey = new Map();
-        histories.set(input.domainScope, byKey);
-    }
-    byKey.set(organizationAccessScopeKey(input.access.organizationId, input.access.requesterUserId), {
-        access: {
-            execSql: input.access.execSql,
-            organizationId: input.access.organizationId,
-            requesterUserId: input.access.requesterUserId,
-        },
-        attempt: input.attempt,
-        history: structuredClone(input.history),
-        stateHash: input.stateHash,
-        beforeVersion: input.beforeVersion,
-    });
-}
-//# sourceMappingURL=policyHistoryCache.js.map

package/workflows/organizations/policyHistoryCache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policyHistoryCache.js","sourceRoot":"","sources":["policyHistoryCache.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8CAA8C,EAC9C,wCAAwC,EAGxC,0BAA0B,GAC3B,MAAM,uCAAuC,CAAC;AAW/C,qEAAqE;AACrE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,OAAO,EAA2C,CAAC;AAEzE,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,0BAA0B,CACpC,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,MAAM,CAAC,eAAe,CAC7B,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACpC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC5C,CAAC,8CAA8C,CAC7C,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,OAAO,CACf;QACD,CAAC,wCAAwC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,EACpE,CAAC;QACD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAOlC;IACC,IACE,CAAC,8CAA8C,CAC7C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,CACd;QACD,CAAC,wCAAwC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;QAEpE,OAAO;IACT,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,GAAG,CACP,0BAA0B,CACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,MAAM,CAAC,eAAe,CAC7B,EACD;QACE,MAAM,EAAE;YACN,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;SAC9C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n  type OrganizationPresentationAccessAttempt,\n  type OrganizationPresentationAccessInput,\n  organizationAccessScopeKey,\n} from \"./organizationPresentationAccessState\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\ninterface CachedHistory {\n  readonly access: OrganizationPresentationAccessInput;\n  readonly attempt: OrganizationPresentationAccessAttempt;\n  readonly history: OrganizationPolicyHistory;\n  readonly stateHash: string;\n  readonly beforeVersion: number;\n}\n\n// Only one verified page per account/org is retained. Names and wire\n// evidence never enter this cache, and nothing here is written to a database.\nconst histories = new WeakMap<DomainScope, Map<string, CachedHistory>>();\n\nexport function loadCachedPolicyHistory(input: {\n  domainScope: DomainScope;\n  access: OrganizationPresentationAccessInput;\n  stateHash: string;\n  beforeVersion: number;\n}): OrganizationPolicyHistory | null {\n  const byKey = histories.get(input.domainScope);\n  const key = organizationAccessScopeKey(\n    input.access.organizationId,\n    input.access.requesterUserId,\n  );\n  const cached = byKey?.get(key);\n  if (!cached) return null;\n  if (\n    cached.access.execSql !== input.access.execSql ||\n    cached.stateHash !== input.stateHash ||\n    cached.beforeVersion !== input.beforeVersion ||\n    !isOrganizationPresentationAccessAttemptCurrent(\n      input.access,\n      cached.attempt,\n    ) ||\n    !isOrganizationPresentationAccessReadable(input.access, \"readModel\")\n  ) {\n    byKey?.delete(key);\n    return null;\n  }\n  return structuredClone(cached.history);\n}\n\nexport function cachePolicyHistory(input: {\n  domainScope: DomainScope;\n  access: OrganizationPresentationAccessInput;\n  attempt: OrganizationPresentationAccessAttempt;\n  history: OrganizationPolicyHistory;\n  stateHash: string;\n  beforeVersion: number;\n}): void {\n  if (\n    !isOrganizationPresentationAccessAttemptCurrent(\n      input.access,\n      input.attempt,\n    ) ||\n    !isOrganizationPresentationAccessReadable(input.access, \"readModel\")\n  )\n    return;\n  let byKey = histories.get(input.domainScope);\n  if (!byKey) {\n    byKey = new Map();\n    histories.set(input.domainScope, byKey);\n  }\n  byKey.set(\n    organizationAccessScopeKey(\n      input.access.organizationId,\n      input.access.requesterUserId,\n    ),\n    {\n      access: {\n        execSql: input.access.execSql,\n        organizationId: input.access.organizationId,\n        requesterUserId: input.access.requesterUserId,\n      },\n      attempt: input.attempt,\n      history: structuredClone(input.history),\n      stateHash: input.stateHash,\n      beforeVersion: input.beforeVersion,\n    },\n  );\n}\n"]}

package/workflows/organizations/policyHistoryReadModel.d.ts

@@ -1,9 +0,0 @@
-import type { PrincipalPolicyBundleResponse, PrincipalProjectionMemberResponse } from "../../internal/validators/response/index.js";
-import type { OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationPrincipalMemberChange } from "./policyHistoryTypes.js";
-export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "./policyHistoryTypes.js";
-export declare function diffPrincipalProjectionMembers(input: {
-    readonly current: ReadonlyArray<PrincipalProjectionMemberResponse>;
-    readonly previous: ReadonlyArray<PrincipalProjectionMemberResponse>;
-}): OrganizationPrincipalMemberChange[];
-export declare function buildOrganizationGroupPolicyHistory(bundle: PrincipalPolicyBundleResponse, organizationId: string): OrganizationGroupPolicyHistory;
-export declare function buildOrganizationPolicyHistory(bundle: PrincipalPolicyBundleResponse): OrganizationPolicyHistory;

package/workflows/organizations/policyHistoryTypes.d.ts

@@ -1,58 +0,0 @@
-import type { PrincipalContainerGrantResponse, PrincipalProjectionMemberResponse, PrincipalStateResponse } from "../../internal/validators/response/index.js";
-export type OrganizationPrincipalMemberChangeType = "added" | "removed" | "role_changed";
-export interface OrganizationPrincipalMemberChange {
-    readonly changeType: OrganizationPrincipalMemberChangeType;
-    readonly userId: string;
-    readonly nextRole: PrincipalProjectionMemberResponse["role"] | null;
-    readonly previousRole: PrincipalProjectionMemberResponse["role"] | null;
-}
-export interface OrganizationPrincipalPolicyHistoryEntry {
-    readonly changes: OrganizationPrincipalMemberChange[];
-    readonly createdAt: string;
-    readonly keyEpoch: number;
-    readonly memberCount: number;
-    readonly signedAt: string;
-    readonly signerUserId: string;
-    readonly signerUserKeyFingerprint: string;
-    readonly stateHash: string;
-    readonly version: number;
-}
-export type OrganizationGroupPolicyHistoryEntry = OrganizationPrincipalPolicyHistoryEntry;
-export interface OrganizationPrincipalPolicyHistory {
-    readonly entries: OrganizationPrincipalPolicyHistoryEntry[];
-    readonly principalId: string;
-    readonly principalType: PrincipalStateResponse["principalType"];
-}
-export interface OrganizationGroupPolicyHistory extends OrganizationPrincipalPolicyHistory {
-    /** Exclusive cursor for older entries; null once the oldest is loaded. */
-    readonly nextBeforeVersion: number | null;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly principalType: "group";
-}
-export interface OrganizationPolicyHistory extends OrganizationPrincipalPolicyHistory {
-    /** Exclusive cursor for older entries; null once the oldest is loaded. */
-    readonly nextBeforeVersion: number | null;
-    readonly entries: OrganizationPolicyHistoryEntry[];
-    readonly organizationId: string;
-    readonly principalType: "organization";
-}
-export interface OrganizationPolicyHistoryEntry extends OrganizationPrincipalPolicyHistoryEntry {
-    /** Null when the additional signed evidence has not been loaded. */
-    readonly groupChanges: OrganizationPolicyGroupChange[] | null;
-}
-export interface OrganizationPolicyGrantChange {
-    readonly containerId: string;
-    readonly previousAccess: PrincipalContainerGrantResponse["accessLevel"] | null;
-    readonly nextAccess: PrincipalContainerGrantResponse["accessLevel"] | null;
-}
-export interface OrganizationPolicyGroupChange {
-    readonly groupId: string;
-    readonly changeType: "created" | "updated" | "deleted";
-    readonly previousVersion: number | null;
-    readonly version: number;
-    readonly previousKeyEpoch: number | null;
-    readonly keyEpoch: number;
-    readonly changes: OrganizationPrincipalMemberChange[];
-    readonly grantChanges: OrganizationPolicyGrantChange[];
-}

package/workflows/organizations/precedingPrincipalRematerialization.js

@@ -1,31 +0,0 @@
-import { rebaseOnDeepestAncestor } from "../containers/child/carriedDescendantRekeys.js";
-import { withAuthoredPrincipalPolicies } from "./authoredPrincipalPolicyWarmer.js";
-/** Plan the next group against container heads authored earlier in the same transaction. */
-export function withPrecedingRematerialization(input) {
-    const preceding = input.preceding;
-    if (!preceding)
-        return input;
-    const rebase = (served) => {
-        const own = preceding.projections.findLast((projection) => projection.containerId === served.containerId);
-        const projection = own ?? served;
-        return (rebaseOnDeepestAncestor(projection, preceding.projections)?.projection ??
-            projection);
-    };
-    return {
-        ...input,
-        warmReferencedPrincipalPolicies: withAuthoredPrincipalPolicies(input.warmReferencedPrincipalPolicies, preceding.authored ?? []),
-        apiClient: {
-            ...input.apiClient,
-            reciteContainer: input.apiClient.reciteContainer.bind(input.apiClient),
-            getContainerWriterProjection: async (containerId) => {
-                const projection = await input.apiClient.getContainerWriterProjection(containerId);
-                return projection ? rebase(projection) : null;
-            },
-            getContainerWriterProjectionResult: async (containerId, options) => {
-                const result = await input.apiClient.getContainerWriterProjectionResult(containerId, options);
-                return result.ok ? { ...result, data: rebase(result.data) } : result;
-            },
-        },
-    };
-}
-//# sourceMappingURL=precedingPrincipalRematerialization.js.map

package/workflows/organizations/precedingPrincipalRematerialization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"precedingPrincipalRematerialization.js","sourceRoot":"","sources":["precedingPrincipalRematerialization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,4FAA4F;AAC5F,MAAM,UAAU,8BAA8B,CAC5C,KAA+C;IAE/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,MAAyC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,CAAC;QACjC,OAAO,CACL,uBAAuB,CAAC,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,UAAU;YACtE,UAAU,CACX,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,6BAA6B,CAC5D,KAAK,CAAC,+BAA+B,EACrC,SAAS,CAAC,QAAQ,IAAI,EAAE,CACzB;QACD,SAAS,EAAE;YACT,GAAG,KAAK,CAAC,SAAS;YAClB,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,4BAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;gBAClD,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;gBAClE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC;YACD,kCAAkC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { rebaseOnDeepestAncestor } from \"../containers/child/carriedDescendantRekeys\";\nimport { withAuthoredPrincipalPolicies } from \"./authoredPrincipalPolicyWarmer\";\nimport type { PrincipalContainerRematerializationInput } from \"./principalContainerRematerializationPlanning\";\n\n/** Plan the next group against container heads authored earlier in the same transaction. */\nexport function withPrecedingRematerialization(\n  input: PrincipalContainerRematerializationInput,\n): PrincipalContainerRematerializationInput {\n  const preceding = input.preceding;\n  if (!preceding) return input;\n  const rebase = (served: ContainerWriterProjectionResponse) => {\n    const own = preceding.projections.findLast(\n      (projection) => projection.containerId === served.containerId,\n    );\n    const projection = own ?? served;\n    return (\n      rebaseOnDeepestAncestor(projection, preceding.projections)?.projection ??\n      projection\n    );\n  };\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: withAuthoredPrincipalPolicies(\n      input.warmReferencedPrincipalPolicies,\n      preceding.authored ?? [],\n    ),\n    apiClient: {\n      ...input.apiClient,\n      reciteContainer: input.apiClient.reciteContainer.bind(input.apiClient),\n      getContainerWriterProjection: async (containerId) => {\n        const projection =\n          await input.apiClient.getContainerWriterProjection(containerId);\n        return projection ? rebase(projection) : null;\n      },\n      getContainerWriterProjectionResult: async (containerId, options) => {\n        const result = await input.apiClient.getContainerWriterProjectionResult(\n          containerId,\n          options,\n        );\n        return result.ok ? { ...result, data: rebase(result.data) } : result;\n      },\n    },\n  };\n}\n"]}

package/workflows/organizations/principalContainerRematerialization.js

@@ -1,321 +0,0 @@
-import { MAX_ROTATION_CONTAINER_REKEYS } from "../../internal/validators/util/index.js";
-import { rememberVerifiedContainerHeads } from "../../data/containers/shared/heldContainerHeads.js";
-import { acknowledgeContainerMutationBatch } from "../../data/containers/shared/mutationAcknowledgement.js";
-import { getTargetContainerContext, readContainerState, } from "../../data/containers/shared/projection.js";
-import { verifyContainerWriterProjection, } from "../../data/keyingProjectionVerification/index.js";
-import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
-import { rebaseOnDeepestAncestor } from "../containers/child/carriedDescendantRekeys.js";
-import { scheduleHeldDescendantRecitations } from "../containers/child/recite.js";
-import { buildMaterializedContainerRekeyPlan } from "../containers/child/rekey.js";
-import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../containers/child/rekeyProjection.js";
-import { selectReplacementPrincipalPolicyReferences } from "../containers/child/replacementPrincipalPolicyReferences.js";
-import { buildMaterializedContainerRevokePlan } from "../containers/child/revoke.js";
-import { buildMaterializedContainerSharePlan } from "../containers/child/shareMaterialization.js";
-import { withPrecedingRematerialization } from "./precedingPrincipalRematerialization.js";
-import { addPlan, carryLevel, staleLevelsAbove, } from "./principalContainerRematerializationPlanning.js";
-import { loadRematerializationTargets, loadServedProjection, seededPrincipalPolicyCache, } from "./principalContainerRematerializationTargets.js";
-function matchingGroupGrant(input) {
-    return (input.directGrants.find((grant) => grant.subjectType === "group" && grant.subjectId === input.groupId) ?? null);
-}
-function referencedGroupKeyEpoch(input) {
-    return (input.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === input.groupId)?.keyEpoch ?? null);
-}
-async function loadGrantedContainerContext(input, grantRow, projection, principalPolicyCache) {
-    // A projection re-rooted on a rotation this batch has yet to commit must
-    // not pin anything: its heads are speculative until acknowledged, and a
-    // pin past the group's served head would refuse the other served paths.
-    await verifyContainerWriterProjection({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: !isSpeculativeContainerWriterProjection(projection),
-        principalPolicyCache,
-        projection,
-        resolveUserKey: createProjectionUserKeyResolver({
-            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        }),
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const state = readContainerState(getTargetContainerContext(projection).manifest);
-    const grant = matchingGroupGrant({
-        directGrants: state.directGrants,
-        groupId: input.groupId,
-    });
-    if (grant && grant.accessLevel !== grantRow.accessLevel) {
-        const nextGrant = input.nextPolicy.grants.find((candidate) => candidate.containerId === grantRow.containerId);
-        if (!nextGrant || nextGrant.accessLevel !== grantRow.accessLevel) {
-            throw new Error(`Container ${grantRow.containerId} does not contain the expected group grant`);
-        }
-    }
-    const referencedKeyEpoch = referencedGroupKeyEpoch({
-        groupId: input.groupId,
-        referencedPrincipalHeads: state.referencedPrincipalHeads,
-    });
-    if (grant && referencedKeyEpoch === null) {
-        throw new Error(`Container ${grantRow.containerId} is missing its group reference`);
-    }
-    return { grant, projection, referencedKeyEpoch };
-}
-export async function buildPrincipalContainerRematerializationBatch(input) {
-    return (await buildPrincipalContainerRematerializationPlans(input)).entries.map((entry) => entry.planned.plan.request);
-}
-function authoredMutationHead(planned) {
-    return planned.plan;
-}
-async function buildPrincipalContainerRematerializationPlan(input) {
-    const { grantRow } = input;
-    const rematerialization = {
-        ...input.rematerialization,
-        nextPolicy: await selectReplacementPrincipalPolicyReferences({
-            policy: input.rematerialization.nextPolicy,
-            projection: input.projection,
-            principalPolicyCache: input.principalPolicyCache,
-            resolveAuthoredPolicyReferences: input.rematerialization.resolveAuthoredPolicyReferences,
-        }),
-    };
-    const { grant, projection, referencedKeyEpoch } = await loadGrantedContainerContext(rematerialization, grantRow, input.projection, input.principalPolicyCache);
-    const nextGrant = rematerialization.nextPolicy.grants.find((candidate) => candidate.containerId === grantRow.containerId);
-    const author = {
-        ...rematerialization.author,
-        organizationId: projection.organizationId,
-    };
-    const sharedInput = {
-        author,
-        execSql: rematerialization.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        // Planning against a path this batch has yet to commit pins nothing; the
-        // acknowledgement advances every head at once. The rekey planner applies
-        // this rule itself; revoke and grant planning take it from here.
-        persistVerificationCheckpoints: !isSpeculativeContainerWriterProjection(projection),
-        previousProjection: projection,
-        principalPolicyCache: input.principalPolicyCache,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        stillCurrent: rematerialization.stillCurrent,
-        targetSecretKey: rematerialization.targetSecretKey,
-        warmReferencedPrincipalPolicies: rematerialization.warmReferencedPrincipalPolicies,
-    };
-    if (grantRow.containerId === rematerialization.revokedContainerId) {
-        if (!grant) {
-            throw new Error(`Container ${grantRow.containerId} does not contain the revoked group grant`);
-        }
-        return buildMaterializedContainerRevokePlan({
-            ...sharedInput,
-            replacementPrincipalPolicy: rematerialization.nextPolicy,
-            revokedSubject: {
-                subjectId: rematerialization.groupId,
-                subjectType: "group",
-            },
-        });
-    }
-    if (!grant || grant.accessLevel !== nextGrant?.accessLevel) {
-        if (!nextGrant) {
-            throw new Error(`Container ${grantRow.containerId} is absent from the next group grant set`);
-        }
-        return buildMaterializedContainerSharePlan({
-            ...sharedInput,
-            accessLevel: nextGrant.accessLevel,
-            recipient: {
-                principalPolicy: rematerialization.nextPolicy,
-                subjectId: rematerialization.groupId,
-                subjectType: "group",
-            },
-        });
-    }
-    if (referencedKeyEpoch === rematerialization.nextPolicy.keyEpoch) {
-        return buildMaterializedContainerSharePlan({
-            ...sharedInput,
-            accessLevel: grant.accessLevel,
-            recipient: {
-                principalPolicy: rematerialization.nextPolicy,
-                subjectId: rematerialization.groupId,
-                subjectType: "group",
-            },
-        });
-    }
-    return buildMaterializedContainerRekeyPlan({
-        ...sharedInput,
-        replacementPrincipalPolicy: rematerialization.nextPolicy,
-    });
-}
-/**
- * Plan one target against the paths already planned above it. A grant's
- * rematerialization extends the served head; a rotation's, and every carried
- * rekey, extends the epoch the batch mints above it.
- */
-async function planRematerializationTarget(batch, target) {
-    const { rematerialization } = batch;
-    let rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);
-    const stale = rebased
-        ? staleLevelsAbove(rebased.projection, rebased.ancestor.containerKeks.at(-1)?.containerId ?? "")
-        : [];
-    for (const containerId of stale) {
-        await carryLevel(batch, await loadServedProjection(rematerialization.apiClient, containerId));
-    }
-    if (!target.grantRow) {
-        await carryLevel(batch, target.projection);
-        return;
-    }
-    // Each level carried above re-roots the target one step deeper.
-    if (stale.length > 0) {
-        rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);
-    }
-    const previousProjection = rebased?.projection ?? target.projection;
-    const planned = await buildPrincipalContainerRematerializationPlan({
-        grantRow: target.grantRow,
-        knownContainerKeks: batch.knownContainerKeks,
-        principalPolicyCache: batch.principalPolicyCache,
-        projection: previousProjection,
-        rematerialization,
-        resolveProjectionUserKey: batch.resolveProjectionUserKey,
-    });
-    const nextProjection = "keyring" in planned.plan
-        ? await containerWriterProjectionFromRotationPlan({
-            plan: planned.plan,
-            previousProjection,
-        })
-        : await containerWriterProjectionFromSharePlan({
-            plan: planned.plan,
-            previousProjection,
-        });
-    addPlan(batch, {
-        carried: false,
-        planned,
-        rotated: "keyring" in planned.plan ? nextProjection : null,
-        nextProjection,
-    });
-}
-/**
- * Sign the batch parent-first. `carriedContainerIds` are the descendant rekeys
- * a refused attempt was told to carry; woven in by depth, each sits under the
- * rotation it rides, and a named container the batch rematerializes anyway is
- * re-planned there rather than rotated twice.
- */
-async function buildPrincipalContainerRematerializationPlans(input, carriedContainerIds = []) {
-    input = withPrecedingRematerialization(input);
-    if (input.revokedContainerId &&
-        !input.grants.some((grant) => grant.containerId === input.revokedContainerId)) {
-        throw new Error("Revoked container is not granted to the group");
-    }
-    const { targets, retiredContainerIds } = await loadRematerializationTargets({
-        apiClient: input.apiClient,
-        carriedContainerIds,
-        grants: input.grants,
-    });
-    const batch = {
-        knownContainerKeks: new Map(input.preceding?.knownContainerKeks),
-        plans: [],
-        // A rotation planned above cites the group at the head this batch commits,
-        // which no store holds yet; the cache is what lets a rebased path verify.
-        principalPolicyCache: new Map([
-            ...(input.preceding?.policies ?? []).flatMap((policy) => [
-                ...seededPrincipalPolicyCache(policy),
-            ]),
-            ...seededPrincipalPolicyCache(input.nextPolicy),
-        ]),
-        rematerialization: input,
-        resolveProjectionUserKey: createProjectionUserKeyResolver({
-            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        }),
-        rotatedAbove: [],
-    };
-    for (const target of targets) {
-        await planRematerializationTarget(batch, target);
-    }
-    return {
-        entries: batch.plans,
-        retiredContainerIds,
-        preceding: {
-            policies: [...(input.preceding?.policies ?? []), input.nextPolicy],
-            projections: [
-                ...(input.preceding?.projections ?? []),
-                ...batch.plans.flatMap((entry) => entry.nextProjection ? [entry.nextProjection] : []),
-            ],
-            knownContainerKeks: batch.knownContainerKeks,
-        },
-    };
-}
-/**
- * The server names a level it found pinned to a retired epoch. A batch answers
- * with a rotation of it: a carried rekey, or its own rematerialization when
- * that is a rekey or revoke. A rematerialized grant rotates nothing, so a
- * batch that both grants a container and must re-key it cannot be signed;
- * no policy change the SDK builds combines the two.
- */
-function assertNamedContainersRotated(plans, requiredContainerIds) {
-    const rotatedIds = new Set(plans.flatMap((entry) => entry.rotated ? [entry.planned.plan.containerId] : []));
-    const unrotated = requiredContainerIds
-        .slice(0, MAX_ROTATION_CONTAINER_REKEYS)
-        .find((containerId) => !rotatedIds.has(containerId));
-    if (unrotated !== undefined) {
-        throw new Error(`Container ${unrotated} needs a rekey this policy change only grants`);
-    }
-}
-export async function preparePrincipalContainerRematerializationBatch(input) {
-    let { entries, retiredContainerIds, preceding } = await buildPrincipalContainerRematerializationPlans(input);
-    const requests = () => entries.map((entry) => entry.planned.plan.request);
-    return {
-        get preceding() {
-            return preceding;
-        },
-        get retiredContainerIds() {
-            return retiredContainerIds;
-        },
-        get plans() {
-            return entries.map((entry) => entry.planned);
-        },
-        get requests() {
-            return requests();
-        },
-        carry: async (requiredContainerIds) => {
-            // The refused attempt rolled back whole, so every served head still
-            // stands; the batch is signed again from them with the named levels in.
-            const replanned = await buildPrincipalContainerRematerializationPlans(input, requiredContainerIds);
-            assertNamedContainersRotated(replanned.entries, requiredContainerIds);
-            entries = replanned.entries;
-            retiredContainerIds = replanned.retiredContainerIds;
-            preceding = replanned.preceding;
-            return requests();
-        },
-        acknowledge: async (responses, stillCurrent) => {
-            const isCurrent = () => input.stillCurrent?.() !== false && stillCurrent?.() !== false;
-            const heads = entries.map((entry) => authoredMutationHead(entry.planned));
-            const acknowledged = await acknowledgeContainerMutationBatch({
-                execSql: input.execSql,
-                plans: heads,
-                responses,
-                stillCurrent: isCurrent,
-            });
-            if (!acknowledged || !isCurrent())
-                return;
-            const plansByOrganization = new Map();
-            for (const head of heads) {
-                const organizationId = head.state.organizationId;
-                const group = plansByOrganization.get(organizationId) ?? [];
-                group.push(head);
-                plansByOrganization.set(organizationId, group);
-            }
-            for (const [organizationId, organizationPlans] of plansByOrganization) {
-                try {
-                    rememberVerifiedContainerHeads({
-                        organizationId,
-                        execSql: input.execSql,
-                        heads: [],
-                        policies: [input.nextPolicy],
-                    });
-                }
-                catch {
-                    // Cache failure must not invalidate the durably acknowledged batch.
-                    continue;
-                }
-                scheduleHeldDescendantRecitations({
-                    apiClient: input.apiClient,
-                    author: { ...input.author, organizationId },
-                    execSql: input.execSql,
-                    plans: organizationPlans,
-                    stillCurrent: input.recitationStillCurrent ?? isCurrent,
-                    reportSecurityIncident: input.reportSecurityIncident,
-                });
-            }
-        },
-    };
-}
-//# sourceMappingURL=principalContainerRematerialization.js.map

package/workflows/organizations/principalContainerRematerialization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerialization.js","sourceRoot":"","sources":["principalContainerRematerialization.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AAEjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,sDAAsD,CAAC;AACzG,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAEL,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0CAA0C,EAAE,MAAM,0DAA0D,CAAC;AACtH,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EACL,OAAO,EAEP,UAAU,EAGV,gBAAgB,GACjB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EAIpB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AAEtD,SAAS,kBAAkB,CAAC,KAG3B;IACC,OAAO,CACL,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAKhC;IACC,OAAO,CACL,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,EAAE,QAAQ,IAAI,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA+C,EAC/C,QAAiC,EACjC,UAA6C,EAC7C,oBAA0C;IAE1C,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,oBAAoB;QACpB,UAAU;QACV,cAAc,EAAE,+BAA+B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,4CAA4C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,iCAAiC,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,KAA+C;IAE/C,OAAO,CACL,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAwBD,SAAS,oBAAoB,CAC3B,OAAmD;IAEnD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,4CAA4C,CAAC,KAY3D;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,iBAAiB,GAAG;QACxB,GAAG,KAAK,CAAC,iBAAiB;QAC1B,UAAU,EAAE,MAAM,0CAA0C,CAAC;YAC3D,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,UAAU;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,+BAA+B,EAC7B,KAAK,CAAC,iBAAiB,CAAC,+BAA+B;SAC1D,CAAC;KACH,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAC7C,MAAM,2BAA2B,CAC/B,iBAAiB,EACjB,QAAQ,EACR,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACJ,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,iBAAiB,CAAC,MAAM;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;KAC1C,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,kBAAkB,EAAE,UAAU;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,2CAA2C,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,GAAG,WAAW;YACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;YACxD,cAAc,EAAE;gBACd,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,0CAA0C,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjE,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,GAAG,WAAW;QACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAoB,EACpB,MAA+B;IAE/B,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,gBAAgB,CACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CACzD;QACH,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,CACd,KAAK,EACL,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,gEAAgE;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,kBAAkB;QAC9B,iBAAiB;QACjB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,MAAM,cAAc,GAClB,SAAS,IAAI,OAAO,CAAC,IAAI;QACvB,CAAC,CAAC,MAAM,yCAAyC,CAAC;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC;QACJ,CAAC,CAAC,MAAM,sCAAsC,CAAC;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC,CAAC;IACT,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,KAAK;QACd,OAAO;QACP,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC1D,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6CAA6C,CAC1D,KAA+C,EAC/C,sBAAyC,EAAE;IAM3C,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9C,IACE,KAAK,CAAC,kBAAkB;QACxB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,4BAA4B,CAAC;QAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAkB;QAC3B,kBAAkB,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC;QAChE,KAAK,EAAE,EAAE;QACT,2EAA2E;QAC3E,0EAA0E;QAC1E,oBAAoB,EAAE,IAAI,GAAG,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvD,GAAG,0BAA0B,CAAC,MAAM,CAAC;aACtC,CAAC;YACF,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;SAChD,CAAC;QACF,iBAAiB,EAAE,KAAK;QACxB,wBAAwB,EAAE,+BAA+B,CAAC;YACxD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,EAAE;KACjB,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,mBAAmB;QACnB,SAAS,EAAE;YACT,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;YAClE,WAAW,EAAE;gBACX,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC;gBACvC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD;aACF;YACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,KAA0C,EAC1C,oBAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB;SACnC,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC;SACvC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,aAAa,SAAS,+CAA+C,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CACnE,KAA+C;IAE/C,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAC7C,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,SAAS;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,mBAAmB;YACrB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK;YACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE;YACpC,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,6CAA6C,CACnE,KAAK,EACL,oBAAoB,CACrB,CAAC;YACF,4BAA4B,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACtE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;YACpD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YAChC,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;YAC7C,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;gBAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK;gBACZ,SAAS;gBACT,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO;YAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;YACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,mBAAmB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACtE,IAAI,CAAC;oBACH,8BAA8B,CAAC;wBAC7B,cAAc;wBACd,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,KAAK,EAAE,EAAE;wBACT,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,SAAS;gBACX,CAAC;gBACD,iCAAiC,CAAC;oBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE;oBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,SAAS;oBACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerDirectGrant,\n  PrincipalContainerGrant,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { rememberVerifiedContainerHeads } from \"../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../data/containers/shared/mutationAcknowledgement\";\nimport { acknowledgeContainerMutationBatch } from \"../../data/containers/shared/mutationAcknowledgement\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../data/containers/shared/projection\";\nimport {\n  type PrincipalPolicyCache,\n  verifyContainerWriterProjection,\n} from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport { rebaseOnDeepestAncestor } from \"../containers/child/carriedDescendantRekeys\";\nimport { scheduleHeldDescendantRecitations } from \"../containers/child/recite\";\nimport { buildMaterializedContainerRekeyPlan } from \"../containers/child/rekey\";\nimport {\n  containerWriterProjectionFromRotationPlan,\n  containerWriterProjectionFromSharePlan,\n  isSpeculativeContainerWriterProjection,\n} from \"../containers/child/rekeyProjection\";\nimport { selectReplacementPrincipalPolicyReferences } from \"../containers/child/replacementPrincipalPolicyReferences\";\nimport { buildMaterializedContainerRevokePlan } from \"../containers/child/revoke\";\nimport { buildMaterializedContainerSharePlan } from \"../containers/child/shareMaterialization\";\nimport { withPrecedingRematerialization } from \"./precedingPrincipalRematerialization\";\nimport {\n  addPlan,\n  type BatchPlanning,\n  carryLevel,\n  type PrincipalContainerRematerializationInput,\n  type PrincipalRematerializationPredecessor,\n  staleLevelsAbove,\n} from \"./principalContainerRematerializationPlanning\";\nimport {\n  loadRematerializationTargets,\n  loadServedProjection,\n  type MaterializedPrincipalContainerMutationPlan,\n  type PlannedRematerialization,\n  type RematerializationTarget,\n  seededPrincipalPolicyCache,\n} from \"./principalContainerRematerializationTargets\";\n\nfunction matchingGroupGrant(input: {\n  readonly directGrants: readonly ContainerDirectGrant[];\n  readonly groupId: string;\n}): ContainerDirectGrant | null {\n  return (\n    input.directGrants.find(\n      (grant) =>\n        grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n    ) ?? null\n  );\n}\n\nfunction referencedGroupKeyEpoch(input: {\n  readonly groupId: string;\n  readonly referencedPrincipalHeads: ReturnType<\n    typeof readContainerState\n  >[\"referencedPrincipalHeads\"];\n}): number | null {\n  return (\n    input.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.groupId,\n    )?.keyEpoch ?? null\n  );\n}\n\nasync function loadGrantedContainerContext(\n  input: PrincipalContainerRematerializationInput,\n  grantRow: PrincipalContainerGrant,\n  projection: ContainerWriterProjectionResponse,\n  principalPolicyCache: PrincipalPolicyCache,\n) {\n  // A projection re-rooted on a rotation this batch has yet to commit must\n  // not pin anything: its heads are speculative until acknowledged, and a\n  // pin past the group's served head would refuse the other served paths.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    principalPolicyCache,\n    projection,\n    resolveUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const state = readContainerState(\n    getTargetContainerContext(projection).manifest,\n  );\n  const grant = matchingGroupGrant({\n    directGrants: state.directGrants,\n    groupId: input.groupId,\n  });\n  if (grant && grant.accessLevel !== grantRow.accessLevel) {\n    const nextGrant = input.nextPolicy.grants.find(\n      (candidate) => candidate.containerId === grantRow.containerId,\n    );\n    if (!nextGrant || nextGrant.accessLevel !== grantRow.accessLevel) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the expected group grant`,\n      );\n    }\n  }\n  const referencedKeyEpoch = referencedGroupKeyEpoch({\n    groupId: input.groupId,\n    referencedPrincipalHeads: state.referencedPrincipalHeads,\n  });\n  if (grant && referencedKeyEpoch === null) {\n    throw new Error(\n      `Container ${grantRow.containerId} is missing its group reference`,\n    );\n  }\n  return { grant, projection, referencedKeyEpoch };\n}\n\nexport async function buildPrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<ContainerMutationRequest[]> {\n  return (\n    await buildPrincipalContainerRematerializationPlans(input)\n  ).entries.map((entry) => entry.planned.plan.request);\n}\n\nexport interface PreparedPrincipalContainerRematerializationBatch {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /**\n   * Re-sign the batch with the descendant rekeys the server named for its\n   * rotations woven in, parent-first, each against the path the batch will\n   * leave behind. A named container the batch already rotates is re-planned\n   * under what is carried above it, so no container rotates twice. Returns the\n   * whole request list, which replaces `requests`; `acknowledge` then expects\n   * the responses in that order.\n   */\n  readonly carry: (\n    requiredContainerIds: readonly string[],\n  ) => Promise<readonly ContainerMutationRequest[]>;\n  readonly plans: readonly MaterializedPrincipalContainerMutationPlan[];\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\nfunction authoredMutationHead(\n  planned: MaterializedPrincipalContainerMutationPlan,\n): AuthoredContainerMutationHead {\n  return planned.plan;\n}\n\nasync function buildPrincipalContainerRematerializationPlan(input: {\n  readonly grantRow: PrincipalContainerGrant;\n  /** Keys the batch minted above this container; see `BatchPlanning`. */\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  /** Holds the policy this batch commits, which rebased paths already cite. */\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  /** The served projection, re-rooted on any rotation planned above it. */\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n}): Promise<MaterializedPrincipalContainerMutationPlan> {\n  const { grantRow } = input;\n  const rematerialization = {\n    ...input.rematerialization,\n    nextPolicy: await selectReplacementPrincipalPolicyReferences({\n      policy: input.rematerialization.nextPolicy,\n      projection: input.projection,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveAuthoredPolicyReferences:\n        input.rematerialization.resolveAuthoredPolicyReferences,\n    }),\n  };\n  const { grant, projection, referencedKeyEpoch } =\n    await loadGrantedContainerContext(\n      rematerialization,\n      grantRow,\n      input.projection,\n      input.principalPolicyCache,\n    );\n  const nextGrant = rematerialization.nextPolicy.grants.find(\n    (candidate) => candidate.containerId === grantRow.containerId,\n  );\n  const author = {\n    ...rematerialization.author,\n    organizationId: projection.organizationId,\n  };\n  const sharedInput = {\n    author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Planning against a path this batch has yet to commit pins nothing; the\n    // acknowledgement advances every head at once. The rekey planner applies\n    // this rule itself; revoke and grant planning take it from here.\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    previousProjection: projection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  };\n  if (grantRow.containerId === rematerialization.revokedContainerId) {\n    if (!grant) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the revoked group grant`,\n      );\n    }\n    return buildMaterializedContainerRevokePlan({\n      ...sharedInput,\n      replacementPrincipalPolicy: rematerialization.nextPolicy,\n      revokedSubject: {\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (!grant || grant.accessLevel !== nextGrant?.accessLevel) {\n    if (!nextGrant) {\n      throw new Error(\n        `Container ${grantRow.containerId} is absent from the next group grant set`,\n      );\n    }\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: nextGrant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (referencedKeyEpoch === rematerialization.nextPolicy.keyEpoch) {\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: grant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  return buildMaterializedContainerRekeyPlan({\n    ...sharedInput,\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n  });\n}\n\n/**\n * Plan one target against the paths already planned above it. A grant's\n * rematerialization extends the served head; a rotation's, and every carried\n * rekey, extends the epoch the batch mints above it.\n */\nasync function planRematerializationTarget(\n  batch: BatchPlanning,\n  target: RematerializationTarget,\n): Promise<void> {\n  const { rematerialization } = batch;\n  let rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  const stale = rebased\n    ? staleLevelsAbove(\n        rebased.projection,\n        rebased.ancestor.containerKeks.at(-1)?.containerId ?? \"\",\n      )\n    : [];\n  for (const containerId of stale) {\n    await carryLevel(\n      batch,\n      await loadServedProjection(rematerialization.apiClient, containerId),\n    );\n  }\n  if (!target.grantRow) {\n    await carryLevel(batch, target.projection);\n    return;\n  }\n  // Each level carried above re-roots the target one step deeper.\n  if (stale.length > 0) {\n    rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  }\n  const previousProjection = rebased?.projection ?? target.projection;\n  const planned = await buildPrincipalContainerRematerializationPlan({\n    grantRow: target.grantRow,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    projection: previousProjection,\n    rematerialization,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n  });\n  const nextProjection =\n    \"keyring\" in planned.plan\n      ? await containerWriterProjectionFromRotationPlan({\n          plan: planned.plan,\n          previousProjection,\n        })\n      : await containerWriterProjectionFromSharePlan({\n          plan: planned.plan,\n          previousProjection,\n        });\n  addPlan(batch, {\n    carried: false,\n    planned,\n    rotated: \"keyring\" in planned.plan ? nextProjection : null,\n    nextProjection,\n  });\n}\n\n/**\n * Sign the batch parent-first. `carriedContainerIds` are the descendant rekeys\n * a refused attempt was told to carry; woven in by depth, each sits under the\n * rotation it rides, and a named container the batch rematerializes anyway is\n * re-planned there rather than rotated twice.\n */\nasync function buildPrincipalContainerRematerializationPlans(\n  input: PrincipalContainerRematerializationInput,\n  carriedContainerIds: readonly string[] = [],\n): Promise<{\n  entries: PlannedRematerialization[];\n  retiredContainerIds: readonly string[];\n  preceding: PrincipalRematerializationPredecessor;\n}> {\n  input = withPrecedingRematerialization(input);\n  if (\n    input.revokedContainerId &&\n    !input.grants.some(\n      (grant) => grant.containerId === input.revokedContainerId,\n    )\n  ) {\n    throw new Error(\"Revoked container is not granted to the group\");\n  }\n  const { targets, retiredContainerIds } = await loadRematerializationTargets({\n    apiClient: input.apiClient,\n    carriedContainerIds,\n    grants: input.grants,\n  });\n  const batch: BatchPlanning = {\n    knownContainerKeks: new Map(input.preceding?.knownContainerKeks),\n    plans: [],\n    // A rotation planned above cites the group at the head this batch commits,\n    // which no store holds yet; the cache is what lets a rebased path verify.\n    principalPolicyCache: new Map([\n      ...(input.preceding?.policies ?? []).flatMap((policy) => [\n        ...seededPrincipalPolicyCache(policy),\n      ]),\n      ...seededPrincipalPolicyCache(input.nextPolicy),\n    ]),\n    rematerialization: input,\n    resolveProjectionUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    rotatedAbove: [],\n  };\n  for (const target of targets) {\n    await planRematerializationTarget(batch, target);\n  }\n  return {\n    entries: batch.plans,\n    retiredContainerIds,\n    preceding: {\n      policies: [...(input.preceding?.policies ?? []), input.nextPolicy],\n      projections: [\n        ...(input.preceding?.projections ?? []),\n        ...batch.plans.flatMap((entry) =>\n          entry.nextProjection ? [entry.nextProjection] : [],\n        ),\n      ],\n      knownContainerKeks: batch.knownContainerKeks,\n    },\n  };\n}\n\n/**\n * The server names a level it found pinned to a retired epoch. A batch answers\n * with a rotation of it: a carried rekey, or its own rematerialization when\n * that is a rekey or revoke. A rematerialized grant rotates nothing, so a\n * batch that both grants a container and must re-key it cannot be signed;\n * no policy change the SDK builds combines the two.\n */\nfunction assertNamedContainersRotated(\n  plans: readonly PlannedRematerialization[],\n  requiredContainerIds: readonly string[],\n): void {\n  const rotatedIds = new Set(\n    plans.flatMap((entry) =>\n      entry.rotated ? [entry.planned.plan.containerId] : [],\n    ),\n  );\n  const unrotated = requiredContainerIds\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS)\n    .find((containerId) => !rotatedIds.has(containerId));\n  if (unrotated !== undefined) {\n    throw new Error(\n      `Container ${unrotated} needs a rekey this policy change only grants`,\n    );\n  }\n}\n\nexport async function preparePrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  let { entries, retiredContainerIds, preceding } =\n    await buildPrincipalContainerRematerializationPlans(input);\n  const requests = () => entries.map((entry) => entry.planned.plan.request);\n  return {\n    get preceding() {\n      return preceding;\n    },\n    get retiredContainerIds() {\n      return retiredContainerIds;\n    },\n    get plans() {\n      return entries.map((entry) => entry.planned);\n    },\n    get requests() {\n      return requests();\n    },\n    carry: async (requiredContainerIds) => {\n      // The refused attempt rolled back whole, so every served head still\n      // stands; the batch is signed again from them with the named levels in.\n      const replanned = await buildPrincipalContainerRematerializationPlans(\n        input,\n        requiredContainerIds,\n      );\n      assertNamedContainersRotated(replanned.entries, requiredContainerIds);\n      entries = replanned.entries;\n      retiredContainerIds = replanned.retiredContainerIds;\n      preceding = replanned.preceding;\n      return requests();\n    },\n    acknowledge: async (responses, stillCurrent) => {\n      const isCurrent = () =>\n        input.stillCurrent?.() !== false && stillCurrent?.() !== false;\n      const heads = entries.map((entry) => authoredMutationHead(entry.planned));\n      const acknowledged = await acknowledgeContainerMutationBatch({\n        execSql: input.execSql,\n        plans: heads,\n        responses,\n        stillCurrent: isCurrent,\n      });\n      if (!acknowledged || !isCurrent()) return;\n      const plansByOrganization = new Map<\n        string,\n        AuthoredContainerMutationHead[]\n      >();\n      for (const head of heads) {\n        const organizationId = head.state.organizationId;\n        const group = plansByOrganization.get(organizationId) ?? [];\n        group.push(head);\n        plansByOrganization.set(organizationId, group);\n      }\n      for (const [organizationId, organizationPlans] of plansByOrganization) {\n        try {\n          rememberVerifiedContainerHeads({\n            organizationId,\n            execSql: input.execSql,\n            heads: [],\n            policies: [input.nextPolicy],\n          });\n        } catch {\n          // Cache failure must not invalidate the durably acknowledged batch.\n          continue;\n        }\n        scheduleHeldDescendantRecitations({\n          apiClient: input.apiClient,\n          author: { ...input.author, organizationId },\n          execSql: input.execSql,\n          plans: organizationPlans,\n          stillCurrent: input.recitationStillCurrent ?? isCurrent,\n          reportSecurityIncident: input.reportSecurityIncident,\n        });\n      }\n    },\n  };\n}\n"]}