@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/blobs/upload.js

@@ -1,243 +0,0 @@
-import { computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, } from "../../internal/crypto/index.js";
-import { createBlobByteSource, } from "../../data/blobs/blobContracts.js";
-import { prepareBlobEncryption } from "../../data/documents/blob/shared/crypto.js";
-import { signBlobAttachmentEvent, signBlobAttachmentWriteHeader, } from "../../data/documents/blob/shared/events.js";
-import { verifiedBlobWrapTargetsFromDocumentProjection, wrapBlobContentKey, } from "../../data/documents/blob/shared/projection.js";
-import { assertBlobAttachmentBindResponse } from "../../data/documents/blob/shared/responses.js";
-import { authorizingContainerPathRefs } from "../../data/documents/shared/projection.js";
-import { uniqueSortedStrings } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions, } from "../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../data/keying/canonicalJson.js";
-import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
-import { shouldRetryWithFreshProjection } from "../documents/syncFailureClassification.js";
-import { resolveMultipartUploadOptions } from "./automaticMultipartUpload.js";
-import { stageMultipartBlobAttachment } from "./multipartUpload.js";
-import { resolveBlobMutationWriterProjection } from "./writerProjection.js";
-async function buildBlobAttachmentMaterial(input) {
-    const resolved = await resolveBlobMutationWriterProjection({
-        apiClient: input.apiClient,
-        documentId: input.documentId,
-        errorLabel: "Blob attachment",
-        execSql: input.execSql,
-        isRemoteSyncBlocked: input.isRemoteSyncBlocked,
-        writerProjection: input.writerProjection,
-        ...projectionVerificationOptions(input),
-    });
-    if (!resolved) {
-        return null;
-    }
-    const { manifestIdentity, writerProjection } = resolved;
-    const targets = verifiedBlobWrapTargetsFromDocumentProjection({
-        bindingId: input.bindingId,
-        documentId: input.documentId,
-        writerProjection,
-    });
-    const targetHash = await computeBlobContentKeyTargetHash(targets);
-    const contentKeyBundle = {
-        contentKeyEpoch: input.contentKeyEpoch,
-        targetHash,
-        targets: await wrapBlobContentKey({
-            blobId: input.blobId,
-            contentKey: input.contentKey,
-            contentKeyEpoch: input.contentKeyEpoch,
-            execSql: input.execSql,
-            secretKey: input.targetSecretKey,
-            targets,
-            writerProjection,
-            ...projectionVerificationOptions(input),
-        }),
-    };
-    const encrypted = await prepareBlobEncryption({
-        blobId: input.blobId,
-        chunkSize: input.partSize,
-        contentKey: input.contentKey,
-        contentKeyBundle,
-        nonceSeed: input.nonceSeed,
-        organizationId: manifestIdentity.organizationId,
-        source: input.source,
-        sourceSnapshot: input.sourceSnapshot,
-    });
-    const blobAccessManifestHash = await computeBlobAccessManifestHash({
-        version: 1,
-        blobId: input.blobId,
-        organizationId: manifestIdentity.organizationId,
-        activeBindingIds: [input.bindingId],
-        documentManifestHashes: [manifestIdentity.manifestHash],
-        linkedContainerManifestHashes: uniqueSortedStrings(targets.map((target) => target.containerManifestHash)),
-        linkedContainerKeyEpochIds: uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)),
-        blobKeyTargetHash: targetHash,
-    });
-    return {
-        blobAccessManifestHash,
-        contentKeyBundle,
-        encrypted,
-        manifestIdentity,
-        targetHash,
-        targets,
-        writerProjection,
-    };
-}
-function blobAttachmentBindRequest(input) {
-    return {
-        event: readCanonicalRecord(input.event, "Blob attachment bind event"),
-        body: readCanonicalRecord(input.body, "Blob attachment bind body"),
-        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
-        contentKeyBundle: input.material.contentKeyBundle,
-        stagedBlob: {
-            stageId: input.stageId,
-            writeHeader: readCanonicalRecord(input.writeHeader, "Blob attachment write header"),
-        },
-    };
-}
-async function stageAndBindBlobAttachment(input) {
-    const { body, event } = await signBlobAttachmentEvent({
-        author: input.author,
-        bindingId: input.bindingId,
-        blobId: input.blobId,
-        documentId: input.documentId,
-        eventId: input.eventId,
-        expectedBindingId: input.expectedBindingId,
-        manifestIdentity: input.material.manifestIdentity,
-        signedAt: input.signedAt,
-        slotId: input.slotId,
-        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
-    });
-    const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({
-        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
-        author: input.author,
-        blobAccessManifestHash: input.material.blobAccessManifestHash,
-        blobId: input.blobId,
-        contentKeyEpoch: input.contentKeyEpoch,
-        encrypted: input.material.encrypted,
-        manifestIdentity: input.material.manifestIdentity,
-        signedAt: input.signedAt,
-        targetHash: input.material.targetHash,
-    });
-    const stageId = await stageMultipartBlobAttachment({
-        organizationId: input.material.manifestIdentity.organizationId,
-        apiClient: input.apiClient,
-        encryption: input.material.encrypted,
-        multipart: input.multipart,
-        onMultipartProgress: input.onMultipartProgress,
-        onStageResolved: input.onStageResolved,
-        onStageUnavailable: input.onStageUnavailable,
-    });
-    if (!stageId) {
-        return null;
-    }
-    const request = blobAttachmentBindRequest({
-        body,
-        event,
-        material: input.material,
-        stageId,
-        writeHeader,
-    });
-    const response = await input.apiClient.bindBlobAttachment(input.blobId, request, {
-        expectedPaymentRequiredOrganizationId: input.material.manifestIdentity.organizationId,
-    });
-    if (!response) {
-        return null;
-    }
-    await assertBlobAttachmentBindResponse({
-        body,
-        bindingId: input.bindingId,
-        blobAccessManifestHash: input.material.blobAccessManifestHash,
-        blobId: input.blobId,
-        contentKeyBundle: input.material.contentKeyBundle,
-        documentId: input.documentId,
-        event,
-        manifestIdentity: input.material.manifestIdentity,
-        response,
-        slotId: input.slotId,
-        targetHash: input.material.targetHash,
-        targets: input.material.targets,
-        writeHeader,
-        writeHeaderHash,
-    });
-    return {
-        request,
-        response,
-        sha256: input.material.encrypted.sha256,
-        byteLength: input.material.encrypted.byteLength,
-        writeHeader,
-        writeHeaderHash,
-    };
-}
-async function uploadDocumentAttachmentImpl({ apiClient, author, blobId = crypto.randomUUID(), bindingId = crypto.randomUUID(), bytes, contentKey = crypto.getRandomValues(new Uint8Array(32)), contentKeyEpoch = 1, documentId, eventId = crypto.randomUUID(), execSql, expectedBindingId, isRemoteSyncBlocked, nonceSeed, multipart, onMultipartProgress, onStageResolved, onStageUnavailable, resolveProjectionUserKey, signedAt = new Date().toISOString(), slotId, sourceSnapshot, targetSecretKey, warmReferencedPrincipalPolicies, writerProjection, }) {
-    if (contentKey.byteLength !== 32) {
-        throw new Error("Blob content key must be 32 bytes");
-    }
-    const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(resolveProjectionUserKey, "Document attachment upload");
-    const resolvedMultipart = resolveMultipartUploadOptions(multipart);
-    const source = createBlobByteSource(bytes);
-    const buildMaterial = (freshWriterProjection) => buildBlobAttachmentMaterial({
-        apiClient,
-        bindingId,
-        blobId,
-        contentKey,
-        contentKeyEpoch,
-        documentId,
-        execSql,
-        isRemoteSyncBlocked,
-        nonceSeed,
-        partSize: resolvedMultipart.partSize,
-        resolveProjectionUserKey: resolveProjectionUserKeyForUpload,
-        source,
-        sourceSnapshot,
-        targetSecretKey,
-        warmReferencedPrincipalPolicies,
-        writerProjection: freshWriterProjection,
-    });
-    let material;
-    try {
-        material = await buildMaterial(writerProjection);
-    }
-    catch (error) {
-        if (!apiClient.evictDocumentWriterProjection ||
-            !shouldRetryWithFreshProjection(error, (message) => message.startsWith("Container writer projection KEK") &&
-                message.includes("could not be unwrapped"))) {
-            throw error;
-        }
-        // The attachment binds to this document; only its projection was stale, so
-        // evict just it rather than wiping the whole projection cache.
-        apiClient.evictDocumentWriterProjection(documentId);
-        material = await buildMaterial(undefined);
-    }
-    if (!material) {
-        return null;
-    }
-    const result = await stageAndBindBlobAttachment({
-        apiClient,
-        author,
-        bindingId,
-        blobId,
-        contentKeyEpoch,
-        documentId,
-        eventId,
-        expectedBindingId,
-        material,
-        multipart: resolvedMultipart,
-        onMultipartProgress,
-        onStageResolved,
-        onStageUnavailable,
-        signedAt,
-        slotId,
-    });
-    if (!result) {
-        return null;
-    }
-    return {
-        blobId,
-        bindingId,
-        writerProjection: material.writerProjection,
-        ...result,
-    };
-}
-export function uploadDocumentAttachment(input) {
-    return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });
-}
-/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */
-export function uploadPreparedDocumentAttachment(input) {
-    return uploadDocumentAttachmentImpl(input);
-}
-//# sourceMappingURL=upload.js.map

package/workflows/blobs/upload.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"upload.js","sourceRoot":"","sources":["upload.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAEL,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,6CAA6C,EAC7C,kBAAkB,GACnB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAS9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAGL,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAE3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,KAAK,UAAU,2BAA2B,CACxC,KAeiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAExD,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAgC;QACpD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU;QACV,OAAO,EAAE,MAAM,kBAAkB,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO;YACP,gBAAgB;YAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC;KACH,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,6BAA6B,CAAC;QACjE,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACvD,6BAA6B,EAAE,mBAAmB,CAChD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACtD;QACD,0BAA0B,EAAE,mBAAmB,CAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CACpD;QACD,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,sBAAsB;QACtB,gBAAgB;QAChB,SAAS;QACT,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAMlC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC;QACrE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAClE,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,mBAAmB,CAC9B,KAAK,CAAC,WAAW,EACjB,8BAA8B,CAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAgBzC;IAQC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC3E,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACvD,KAAK,CAAC,MAAM,EACZ,OAAO,EACP;QACE,qCAAqC,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;KACjD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gCAAgC,CAAC;QACrC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,WAAW;QACX,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QACvC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;QAC/C,WAAW;QACX,eAAe;KAChB,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,4BAA4B,CAAC,EAC1C,SAAS,EACT,MAAM,EACN,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,EAC5B,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,EAC/B,KAAK,EACL,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACvD,eAAe,GAAG,CAAC,EACnB,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,cAAc,EACd,eAAe,EACf,+BAA+B,EAC/B,gBAAgB,GACsB;IACtC,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,iCAAiC,GAAG,gCAAgC,CACxE,wBAAwB,EACxB,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,CACpB,qBAAwE,EACxE,EAAE,CACF,2BAA2B,CAAC;QAC1B,SAAS;QACT,SAAS;QACT,MAAM;QACN,UAAU;QACV,eAAe;QACf,UAAU;QACV,OAAO;QACP,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,wBAAwB,EAAE,iCAAiC;QAC3D,MAAM;QACN,cAAc;QACd,eAAe;QACf,+BAA+B;QAC/B,gBAAgB,EAAE,qBAAqB;KACxC,CAAC,CAAC;IACL,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,SAAS,CAAC,6BAA6B;YACxC,CAAC,8BAA8B,CAC7B,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBACrD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC7C,EACD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,SAAS;QACT,MAAM;QACN,SAAS;QACT,MAAM;QACN,eAAe;QACf,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,QAAQ;QACR,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB;QACnB,eAAe;QACf,kBAAkB;QAClB,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAC9C,KAA4C;IAE5C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AttachmentBindAccessEventBody,\n  WriteHeader,\n} from \"@tearleads/crypto\";\nimport {\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n} from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentBindRequest,\n  BlobContentKeyBundleRequest,\n} from \"@tearleads/validators/request\";\nimport type { BlobAttachmentBindResponse } from \"@tearleads/validators/response\";\nimport {\n  type BlobByteSource,\n  createBlobByteSource,\n} from \"../../data/blobs/blobContracts\";\nimport type { BlobSourceSnapshot } from \"../../data/documents/blob/shared/blobSourceSnapshot\";\nimport { prepareBlobEncryption } from \"../../data/documents/blob/shared/crypto\";\nimport {\n  signBlobAttachmentEvent,\n  signBlobAttachmentWriteHeader,\n} from \"../../data/documents/blob/shared/events\";\nimport {\n  verifiedBlobWrapTargetsFromDocumentProjection,\n  wrapBlobContentKey,\n} from \"../../data/documents/blob/shared/projection\";\nimport { assertBlobAttachmentBindResponse } from \"../../data/documents/blob/shared/responses\";\nimport type {\n  BlobAttachmentApi,\n  BlobAttachmentMaterial,\n  MultipartStageResolvedListener,\n  MultipartUploadProgressListener,\n  UploadDocumentAttachmentInput,\n  UploadDocumentAttachmentResult,\n} from \"../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../data/documents/shared/readers\";\nimport {\n  type DocumentCreateAuthor,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { shouldRetryWithFreshProjection } from \"../documents/syncFailureClassification\";\nimport { resolveMultipartUploadOptions } from \"./automaticMultipartUpload\";\nimport { stageMultipartBlobAttachment } from \"./multipartUpload\";\nimport { resolveBlobMutationWriterProjection } from \"./writerProjection\";\n\nasync function buildBlobAttachmentMaterial(\n  input: {\n    apiClient: BlobAttachmentApi;\n    bindingId: string;\n    blobId: string;\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    documentId: string;\n    execSql?: ExecSql | undefined;\n    isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n    nonceSeed?: Uint8Array | undefined;\n    partSize: number;\n    source: BlobByteSource;\n    sourceSnapshot?: BlobSourceSnapshot | undefined;\n    targetSecretKey: Uint8Array;\n    writerProjection?: UploadDocumentAttachmentInput[\"writerProjection\"];\n  } & ProjectionVerificationOptions,\n): Promise<BlobAttachmentMaterial | null> {\n  const resolved = await resolveBlobMutationWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n    errorLabel: \"Blob attachment\",\n    execSql: input.execSql,\n    isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  if (!resolved) {\n    return null;\n  }\n  const { manifestIdentity, writerProjection } = resolved;\n\n  const targets = verifiedBlobWrapTargetsFromDocumentProjection({\n    bindingId: input.bindingId,\n    documentId: input.documentId,\n    writerProjection,\n  });\n  const targetHash = await computeBlobContentKeyTargetHash(targets);\n  const contentKeyBundle: BlobContentKeyBundleRequest = {\n    contentKeyEpoch: input.contentKeyEpoch,\n    targetHash,\n    targets: await wrapBlobContentKey({\n      blobId: input.blobId,\n      contentKey: input.contentKey,\n      contentKeyEpoch: input.contentKeyEpoch,\n      execSql: input.execSql,\n      secretKey: input.targetSecretKey,\n      targets,\n      writerProjection,\n      ...projectionVerificationOptions(input),\n    }),\n  };\n  const encrypted = await prepareBlobEncryption({\n    blobId: input.blobId,\n    chunkSize: input.partSize,\n    contentKey: input.contentKey,\n    contentKeyBundle,\n    nonceSeed: input.nonceSeed,\n    organizationId: manifestIdentity.organizationId,\n    source: input.source,\n    sourceSnapshot: input.sourceSnapshot,\n  });\n  const blobAccessManifestHash = await computeBlobAccessManifestHash({\n    version: 1,\n    blobId: input.blobId,\n    organizationId: manifestIdentity.organizationId,\n    activeBindingIds: [input.bindingId],\n    documentManifestHashes: [manifestIdentity.manifestHash],\n    linkedContainerManifestHashes: uniqueSortedStrings(\n      targets.map((target) => target.containerManifestHash),\n    ),\n    linkedContainerKeyEpochIds: uniqueSortedStrings(\n      targets.map((target) => target.containerKeyEpochId),\n    ),\n    blobKeyTargetHash: targetHash,\n  });\n\n  return {\n    blobAccessManifestHash,\n    contentKeyBundle,\n    encrypted,\n    manifestIdentity,\n    targetHash,\n    targets,\n    writerProjection,\n  };\n}\n\nfunction blobAttachmentBindRequest(input: {\n  body: AttachmentBindAccessEventBody;\n  event: AccessEvent;\n  material: BlobAttachmentMaterial;\n  stageId: string;\n  writeHeader: WriteHeader;\n}): BlobAttachmentBindRequest {\n  return {\n    event: readCanonicalRecord(input.event, \"Blob attachment bind event\"),\n    body: readCanonicalRecord(input.body, \"Blob attachment bind body\"),\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n    contentKeyBundle: input.material.contentKeyBundle,\n    stagedBlob: {\n      stageId: input.stageId,\n      writeHeader: readCanonicalRecord(\n        input.writeHeader,\n        \"Blob attachment write header\",\n      ),\n    },\n  };\n}\n\nasync function stageAndBindBlobAttachment(input: {\n  apiClient: BlobAttachmentApi;\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  contentKeyEpoch: number;\n  documentId: string;\n  eventId: string;\n  expectedBindingId: string | null;\n  material: BlobAttachmentMaterial;\n  multipart: NonNullable<UploadDocumentAttachmentInput[\"multipart\"]>;\n  onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  onStageResolved?: MultipartStageResolvedListener | undefined;\n  onStageUnavailable?: ((stageId: string) => Promise<void>) | undefined;\n  signedAt: string;\n  slotId: string;\n}): Promise<{\n  request: BlobAttachmentBindRequest;\n  response: BlobAttachmentBindResponse;\n  sha256: string;\n  byteLength: number;\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n} | null> {\n  const { body, event } = await signBlobAttachmentEvent({\n    author: input.author,\n    bindingId: input.bindingId,\n    blobId: input.blobId,\n    documentId: input.documentId,\n    eventId: input.eventId,\n    expectedBindingId: input.expectedBindingId,\n    manifestIdentity: input.material.manifestIdentity,\n    signedAt: input.signedAt,\n    slotId: input.slotId,\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n  });\n  const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n    author: input.author,\n    blobAccessManifestHash: input.material.blobAccessManifestHash,\n    blobId: input.blobId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encrypted: input.material.encrypted,\n    manifestIdentity: input.material.manifestIdentity,\n    signedAt: input.signedAt,\n    targetHash: input.material.targetHash,\n  });\n  const stageId = await stageMultipartBlobAttachment({\n    organizationId: input.material.manifestIdentity.organizationId,\n    apiClient: input.apiClient,\n    encryption: input.material.encrypted,\n    multipart: input.multipart,\n    onMultipartProgress: input.onMultipartProgress,\n    onStageResolved: input.onStageResolved,\n    onStageUnavailable: input.onStageUnavailable,\n  });\n  if (!stageId) {\n    return null;\n  }\n\n  const request = blobAttachmentBindRequest({\n    body,\n    event,\n    material: input.material,\n    stageId,\n    writeHeader,\n  });\n  const response = await input.apiClient.bindBlobAttachment(\n    input.blobId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId:\n        input.material.manifestIdentity.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n\n  await assertBlobAttachmentBindResponse({\n    body,\n    bindingId: input.bindingId,\n    blobAccessManifestHash: input.material.blobAccessManifestHash,\n    blobId: input.blobId,\n    contentKeyBundle: input.material.contentKeyBundle,\n    documentId: input.documentId,\n    event,\n    manifestIdentity: input.material.manifestIdentity,\n    response,\n    slotId: input.slotId,\n    targetHash: input.material.targetHash,\n    targets: input.material.targets,\n    writeHeader,\n    writeHeaderHash,\n  });\n\n  return {\n    request,\n    response,\n    sha256: input.material.encrypted.sha256,\n    byteLength: input.material.encrypted.byteLength,\n    writeHeader,\n    writeHeaderHash,\n  };\n}\n\ninterface PreparedUploadDocumentAttachmentInput\n  extends UploadDocumentAttachmentInput {\n  readonly sourceSnapshot?: BlobSourceSnapshot | undefined;\n  readonly onStageUnavailable?:\n    | ((stageId: string) => Promise<void>)\n    | undefined;\n}\n\nasync function uploadDocumentAttachmentImpl({\n  apiClient,\n  author,\n  blobId = crypto.randomUUID(),\n  bindingId = crypto.randomUUID(),\n  bytes,\n  contentKey = crypto.getRandomValues(new Uint8Array(32)),\n  contentKeyEpoch = 1,\n  documentId,\n  eventId = crypto.randomUUID(),\n  execSql,\n  expectedBindingId,\n  isRemoteSyncBlocked,\n  nonceSeed,\n  multipart,\n  onMultipartProgress,\n  onStageResolved,\n  onStageUnavailable,\n  resolveProjectionUserKey,\n  signedAt = new Date().toISOString(),\n  slotId,\n  sourceSnapshot,\n  targetSecretKey,\n  warmReferencedPrincipalPolicies,\n  writerProjection,\n}: PreparedUploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult | null> {\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Blob content key must be 32 bytes\");\n  }\n  const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(\n    resolveProjectionUserKey,\n    \"Document attachment upload\",\n  );\n  const resolvedMultipart = resolveMultipartUploadOptions(multipart);\n  const source = createBlobByteSource(bytes);\n\n  const buildMaterial = (\n    freshWriterProjection: UploadDocumentAttachmentInput[\"writerProjection\"],\n  ) =>\n    buildBlobAttachmentMaterial({\n      apiClient,\n      bindingId,\n      blobId,\n      contentKey,\n      contentKeyEpoch,\n      documentId,\n      execSql,\n      isRemoteSyncBlocked,\n      nonceSeed,\n      partSize: resolvedMultipart.partSize,\n      resolveProjectionUserKey: resolveProjectionUserKeyForUpload,\n      source,\n      sourceSnapshot,\n      targetSecretKey,\n      warmReferencedPrincipalPolicies,\n      writerProjection: freshWriterProjection,\n    });\n  let material: BlobAttachmentMaterial | null;\n  try {\n    material = await buildMaterial(writerProjection);\n  } catch (error) {\n    if (\n      !apiClient.evictDocumentWriterProjection ||\n      !shouldRetryWithFreshProjection(\n        error,\n        (message) =>\n          message.startsWith(\"Container writer projection KEK\") &&\n          message.includes(\"could not be unwrapped\"),\n      )\n    ) {\n      throw error;\n    }\n\n    // The attachment binds to this document; only its projection was stale, so\n    // evict just it rather than wiping the whole projection cache.\n    apiClient.evictDocumentWriterProjection(documentId);\n    material = await buildMaterial(undefined);\n  }\n  if (!material) {\n    return null;\n  }\n  const result = await stageAndBindBlobAttachment({\n    apiClient,\n    author,\n    bindingId,\n    blobId,\n    contentKeyEpoch,\n    documentId,\n    eventId,\n    expectedBindingId,\n    material,\n    multipart: resolvedMultipart,\n    onMultipartProgress,\n    onStageResolved,\n    onStageUnavailable,\n    signedAt,\n    slotId,\n  });\n  if (!result) {\n    return null;\n  }\n\n  return {\n    blobId,\n    bindingId,\n    writerProjection: material.writerProjection,\n    ...result,\n  };\n}\n\nexport function uploadDocumentAttachment(\n  input: UploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult | null> {\n  return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });\n}\n\n/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */\nexport function uploadPreparedDocumentAttachment(\n  input: PreparedUploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult | null> {\n  return uploadDocumentAttachmentImpl(input);\n}\n"]}

package/workflows/blobs/verifiedWrapScope.js

@@ -1,20 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-/** A retained wrap must name a KEK committed by verified container history. */
-export function assertBlobWrapScopeVerified(input) {
-    const targets = input.binding.contentKeyBundle.targets.filter((target) => target.bindingId === input.binding.bindingId &&
-        target.documentId === input.documentId);
-    if (targets.length === 0)
-        throw new KeyingVerificationError("object_mismatch", "Blob bundle lacks its attachment target");
-    for (const target of targets) {
-        const path = input.authorization.containerPathByManifestHash.get(target.containerManifestHash);
-        const manifest = path?.at(-1);
-        if (!manifest)
-            throw new ProjectionDependencyUnavailableError("Blob wrapped-target manifest is unavailable");
-        if (manifest.state.containerId !== target.containerId ||
-            manifest.state.containerKeyEpochId !== target.containerKeyEpochId) {
-            throw new KeyingVerificationError("object_mismatch", "Blob wrapped target differs from verified container history");
-        }
-    }
-}
-//# sourceMappingURL=verifiedWrapScope.js.map

package/workflows/blobs/verifiedWrapScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifiedWrapScope.js","sourceRoot":"","sources":["verifiedWrapScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAErH,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;QAC5C,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACzC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yCAAyC,CAC1C,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAG,CAC9D,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;QACJ,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACjD,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EACjE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { BlobAttachmentSummary } from \"@tearleads/validators/response\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\n\n/** A retained wrap must name a KEK committed by verified container history. */\nexport function assertBlobWrapScopeVerified(input: {\n  authorization: DocumentWriterProjectionAuthorization;\n  binding: BlobAttachmentSummary;\n  documentId: string;\n}): void {\n  const targets = input.binding.contentKeyBundle.targets.filter(\n    (target) =>\n      target.bindingId === input.binding.bindingId &&\n      target.documentId === input.documentId,\n  );\n  if (targets.length === 0)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Blob bundle lacks its attachment target\",\n    );\n  for (const target of targets) {\n    const path = input.authorization.containerPathByManifestHash.get(\n      target.containerManifestHash,\n    );\n    const manifest = path?.at(-1);\n    if (!manifest)\n      throw new ProjectionDependencyUnavailableError(\n        \"Blob wrapped-target manifest is unavailable\",\n      );\n    if (\n      manifest.state.containerId !== target.containerId ||\n      manifest.state.containerKeyEpochId !== target.containerKeyEpochId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Blob wrapped target differs from verified container history\",\n      );\n    }\n  }\n}\n"]}

package/workflows/blobs/writerProjection.js

@@ -1,29 +0,0 @@
-import { readDocumentManifestIdentity } from "../../data/documents/blob/shared/readers.js";
-import { assertDocumentWriterProjectionConsistent } from "../../data/documents/shared/projection.js";
-import { projectionVerificationOptions, } from "../../data/documents/shared/types.js";
-/**
- * Shared prologue for blob attachment mutations (upload/detach): resolve the
- * document writer projection, verify its consistency, confirm it targets the
- * mutated document, and gate on a blocked organization. Returns null when the
- * projection is unavailable or the organization's remote sync is blocked.
- */
-export async function resolveBlobMutationWriterProjection(input) {
-    const writerProjection = input.writerProjection ??
-        (await input.apiClient.getDocumentWriterProjection(input.documentId));
-    if (!writerProjection) {
-        return null;
-    }
-    await assertDocumentWriterProjectionConsistent(writerProjection, {
-        execSql: input.execSql,
-        ...projectionVerificationOptions(input),
-    });
-    const manifestIdentity = readDocumentManifestIdentity(writerProjection);
-    if (manifestIdentity.documentId !== input.documentId) {
-        throw new Error(`${input.errorLabel} writer projection targets wrong document`);
-    }
-    if (input.isRemoteSyncBlocked?.(manifestIdentity.organizationId)) {
-        return null;
-    }
-    return { manifestIdentity, writerProjection };
-}
-//# sourceMappingURL=writerProjection.js.map

package/workflows/blobs/writerProjection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"writerProjection.js","sourceRoot":"","sources":["writerProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAKxF,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAG3C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAQiC;IAKjC,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,wCAAwC,CAAC,gBAAgB,EAAE;QAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAI,gBAAgB,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,UAAU,2CAA2C,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAChD,CAAC","sourcesContent":["import type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readDocumentManifestIdentity } from \"../../data/documents/blob/shared/readers\";\nimport type {\n  BlobAttachmentApi,\n  DocumentManifestIdentity,\n} from \"../../data/documents/blob/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport {\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n/**\n * Shared prologue for blob attachment mutations (upload/detach): resolve the\n * document writer projection, verify its consistency, confirm it targets the\n * mutated document, and gate on a blocked organization. Returns null when the\n * projection is unavailable or the organization's remote sync is blocked.\n */\nexport async function resolveBlobMutationWriterProjection(\n  input: {\n    apiClient: Pick<BlobAttachmentApi, \"getDocumentWriterProjection\">;\n    documentId: string;\n    /** Prefix for the wrong-document error, e.g. \"Blob attachment detach\". */\n    errorLabel: string;\n    execSql?: ExecSql | undefined;\n    isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n    writerProjection?: DocumentWriterProjectionResponse | undefined;\n  } & ProjectionVerificationOptions,\n): Promise<{\n  manifestIdentity: DocumentManifestIdentity;\n  writerProjection: DocumentWriterProjectionResponse;\n} | null> {\n  const writerProjection =\n    input.writerProjection ??\n    (await input.apiClient.getDocumentWriterProjection(input.documentId));\n  if (!writerProjection) {\n    return null;\n  }\n\n  await assertDocumentWriterProjectionConsistent(writerProjection, {\n    execSql: input.execSql,\n    ...projectionVerificationOptions(input),\n  });\n  const manifestIdentity = readDocumentManifestIdentity(writerProjection);\n  if (manifestIdentity.documentId !== input.documentId) {\n    throw new Error(\n      `${input.errorLabel} writer projection targets wrong document`,\n    );\n  }\n  if (input.isRemoteSyncBlocked?.(manifestIdentity.organizationId)) {\n    return null;\n  }\n\n  return { manifestIdentity, writerProjection };\n}\n"]}

package/workflows/container-contents/container-state/createAdoption.js

@@ -1,193 +0,0 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { verifiedContainerCreateManifest } from "../../../data/keyingProjectionVerification/containerCreateManifest.js";
-import { verifyContainerDestinationProjection } from "../../../data/keyingProjectionVerification/containerDestinationVerification.js";
-import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, } from "../../../data/keyingProjectionVerification/error.js";
-import { errorMessage } from "../../../data/shared/errorMessage.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { settleContainerCreateIntent } from "./createIntentSettlement.js";
-const LABEL = "Container create conflict";
-/** The recorded error that parks an intent whose listed create is foreign. */
-export const CONTAINER_CREATE_ADOPTION_REFUSED = "Container create adoption was refused";
-/**
- * The listed create's signed identity is not this device's pending create: its
- * signed create names another signer, another organization, or a root. An honest server never lists that under the
- * id this device minted, and no later read can change those signed facts, so
- * the intent parks instead of re-verifying.
- */
-class ForeignContainerCreateError extends KeyingVerificationError {
-}
-function foreignCreate(code, message) {
-    return new ForeignContainerCreateError(code, `${LABEL} ${message}`);
-}
-async function verifyAdoptableProjection(input) {
-    const { projection } = input;
-    if (projection.containerId !== input.containerId ||
-        projection.organizationId !== input.expectedOrganizationId) {
-        // The envelope is unsigned: a corrupt read is retried, not parked.
-        throw new KeyingVerificationError("object_mismatch", `${LABEL} projection has the wrong identity`);
-    }
-    const { path, verifiedByHash } = await verifyContainerDestinationProjection({
-        execSql: input.state.runtime.infra.execSql,
-        projection,
-        resolveUserKey: input.state.resolveProjectionUserKey,
-        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.state.runtime),
-    });
-    const head = path.at(-1);
-    // One read naming another container says nothing signed about this id.
-    if (!head || head.state.containerId !== input.containerId) {
-        throw new KeyingVerificationError("object_mismatch", `${LABEL} projection names another container`);
-    }
-    const create = verifiedContainerCreateManifest({
-        head,
-        label: LABEL,
-        verifiedByHash,
-    });
-    if (create.event.event.signerUserId !== input.sessionUserId) {
-        throw foreignCreate("signer_mismatch", "was signed by another user");
-    }
-    if (create.state.organizationId !== input.expectedOrganizationId) {
-        throw foreignCreate("object_mismatch", "belongs to another organization");
-    }
-    const createdParentId = create.state.parentContainerId;
-    const currentParentId = head.state.parentContainerId;
-    if (createdParentId === null || currentParentId === null) {
-        throw foreignCreate("object_mismatch", "is an organization root");
-    }
-    return { createdParentId, currentParentId };
-}
-/**
- * A pending create whose container the listing already carries is adopted
- * only when the container's signed epoch-1 `container.create` is this user's,
- * in the intended organization (#2365 finding 26). Listing metadata is
- * unsigned: a create by another writer that collides on the pending id, or one
- * a dishonest server invents, must not become this device's container.
- * Documents apply the same rule (`workflows/documents/createAdoption.ts`).
- *
- * Returns where the create committed and where the verified head sits now.
- * The user may have moved the pending container since, which rewrites its
- * intent's parent; that is a move still owed, not a mismatch.
- */
-async function assertContainerCreateAdoptable(input) {
-    const { runtime } = input.state;
-    const sessionUserId = runtime.auth.userId;
-    // Without a session user there is no signer to compare: not tampering.
-    if (!sessionUserId) {
-        throw new Error(`${LABEL} needs a signed-in session user`);
-    }
-    const projection = await runtime.apiClient.getContainerWriterProjection(input.containerId);
-    if (!projection) {
-        throw new Error(`${LABEL} is unavailable to verify`);
-    }
-    try {
-        return await verifyAdoptableProjection({
-            ...input,
-            projection,
-            sessionUserId,
-        });
-    }
-    catch (error) {
-        // Never re-serve a cached projection that failed verification.
-        if (isKeyingVerificationError(error)) {
-            runtime.apiClient.evictContainerWriterProjection(input.containerId);
-        }
-        throw error;
-    }
-}
-function verifyListedContainerCreate(input) {
-    const adoption = {
-        containerId: input.intent.containerId,
-        expectedOrganizationId: input.parentState.container.organizationId,
-    };
-    return input.state.verifyCreateAdoption
-        ? input.state.verifyCreateAdoption(adoption)
-        : assertContainerCreateAdoptable({ ...adoption, state: input.state });
-}
-/** Settles a verified adoption against the row hydration installed. */
-async function markContainerCreateIntentAdopted(input) {
-    const { containerState, placement, syncInput } = input;
-    const remoteMetadataDocumentId = containerState.record.documentId;
-    const remoteMetadataAccessStateHash = containerState.record.accessStateHash;
-    if (!remoteMetadataDocumentId || !remoteMetadataAccessStateHash) {
-        return false;
-    }
-    return settleContainerCreateIntent({
-        createdParentContainerId: placement.createdParentId,
-        desiredParentContainerId: syncInput.intent.parentContainerId,
-        intent: syncInput.intent,
-        isCurrent: syncInput.isCurrent,
-        remoteContainerId: containerState.container.id,
-        remoteMetadataAccessStateHash,
-        remoteMetadataDocumentId,
-        state: syncInput.state,
-        supersededMovePreviousParentId: placement.currentParentId,
-    });
-}
-/**
- * Records a failed adoption and leaves the lane's other intents to proceed. A
- * foreign create parks the intent: its signed facts never change, so later
- * passes neither re-read it nor report it again. Any other failure retries.
- */
-async function recordAdoptionFailure(input) {
-    const { intent, isCurrent, state } = input.syncInput;
-    if (!isCurrent())
-        return "abandoned";
-    await reportKeyingVerificationErrorInCauseChain(input.error, state.runtime.util.reportSecurityIncident, {
-        objectId: intent.containerId,
-        objectKind: "container",
-        operation: "container.create.replay",
-        organizationId: input.organizationId,
-    });
-    if (!isCurrent())
-        return "abandoned";
-    const action = input.error instanceof ForeignContainerCreateError
-        ? CONTAINER_CREATE_ADOPTION_REFUSED
-        : "Container create adoption verification failed";
-    await state.persistence.recordCreateIntentRevisionError(state.runtime.infra.execSql, {
-        containerId: intent.containerId,
-        expectedIntentId: intent.id,
-        expectedUpdatedAt: intent.updatedAt,
-        message: `${action}: ${errorMessage(input.error)}`,
-        stillCurrent: isCurrent,
-    });
-    return isCurrent() ? "failed" : "abandoned";
-}
-/**
- * Adopts a pending create the listing already carries, once its signed create
- * proves it is this device's. A parked refusal stays blocked without a read.
- */
-export async function syncListedContainerCreate(input) {
-    const { containerState, parentState, syncInput } = input;
-    const { intent, isCurrent, state } = syncInput;
-    if (intent.lastError?.startsWith(CONTAINER_CREATE_ADOPTION_REFUSED)) {
-        return "blocked";
-    }
-    let placement;
-    try {
-        placement = await verifyListedContainerCreate({
-            intent,
-            parentState,
-            state,
-        });
-    }
-    catch (error) {
-        return recordAdoptionFailure({
-            error,
-            organizationId: parentState.container.organizationId,
-            syncInput,
-        });
-    }
-    const marked = await markContainerCreateIntentAdopted({
-        containerState,
-        placement,
-        syncInput,
-    });
-    if (!marked)
-        return isCurrent() ? "blocked" : "abandoned";
-    // The folder now sits elsewhere; list it there rather than waiting for the
-    // next poll to correct the local parent.
-    if (placement.currentParentId !== intent.parentContainerId) {
-        syncInput.requestRemoteReconciliation(placement.currentParentId);
-    }
-    return "created";
-}
-//# sourceMappingURL=createAdoption.js.map

package/workflows/container-contents/container-state/createAdoption.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createAdoption.js","sourceRoot":"","sources":["createAdoption.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAC;AACrH,OAAO,EAAE,oCAAoC,EAAE,MAAM,6EAA6E,CAAC;AACnI,OAAO,EACL,yBAAyB,EACzB,yCAAyC,GAC1C,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAOvE,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iCAAiC,GAC5C,uCAAuC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,2BAA4B,SAAQ,uBAAuB;CAAG;AAEpE,SAAS,aAAa,CACpB,IAA4B,EAC5B,OAAe;IAEf,OAAO,IAAI,2BAA2B,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAMxC;IACC,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC5C,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAC1D,CAAC;QACD,mEAAmE;QACnE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,oCAAoC,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,oCAAoC,CAAC;QAC1E,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAC1C,UAAU;QACV,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QACpD,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,KAAK,CAAC,OAAO,CACpB;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,uEAAuE;IACvE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,qCAAqC,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC;QAC7C,IAAI;QACJ,KAAK,EAAE,KAAK;QACZ,cAAc;KACf,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjE,MAAM,aAAa,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACrD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,aAAa,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1C,uEAAuE;IACvE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACrE,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC;YACrC,GAAG,KAAK;YACR,UAAU;YACV,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;QACrC,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc;KACnE,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,oBAAoB;QACrC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,8BAA8B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,gCAAgC,CAAC,KAI/C;IACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACvD,MAAM,wBAAwB,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;IAClE,MAAM,6BAA6B,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;IAE5E,IAAI,CAAC,wBAAwB,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2BAA2B,CAAC;QACjC,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,wBAAwB,EAAE,SAAS,CAAC,MAAM,CAAC,iBAAiB;QAC5D,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,iBAAiB,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,6BAA6B;QAC7B,wBAAwB;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,8BAA8B,EAAE,SAAS,CAAC,eAAe;KAC1D,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,KAIpC;IACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACrD,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,yCAAyC,CAC7C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,yBAAyB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,MAAM,GACV,KAAK,CAAC,KAAK,YAAY,2BAA2B;QAChD,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,+CAA+C,CAAC;IACtD,MAAM,KAAK,CAAC,WAAW,CAAC,+BAA+B,CACrD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B;QACE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;QAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;QACnC,OAAO,EAAE,GAAG,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAClD,YAAY,EAAE,SAAS;KACxB,CACF,CAAC;IACF,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC/C,IAAI,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAoC,CAAC;IACzC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAC5C,MAAM;YACN,WAAW;YACX,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,qBAAqB,CAAC;YAC3B,KAAK;YACL,cAAc,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc;YACpD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;QACpD,cAAc;QACd,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1D,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,SAAS,CAAC,eAAe,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3D,SAAS,CAAC,2BAA2B,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import {\n  type KeyingVerificationCode,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { verifiedContainerCreateManifest } from \"../../../data/keyingProjectionVerification/containerCreateManifest\";\nimport { verifyContainerDestinationProjection } from \"../../../data/keyingProjectionVerification/containerDestinationVerification\";\nimport {\n  isKeyingVerificationError,\n  reportKeyingVerificationErrorInCauseChain,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { settleContainerCreateIntent } from \"./createIntentSettlement\";\nimport type {\n  AdoptedContainerPlacement,\n  ContainerCreateIntentSyncInput,\n  ContainerCreateIntentSyncState,\n} from \"./types\";\n\nconst LABEL = \"Container create conflict\";\n\n/** The recorded error that parks an intent whose listed create is foreign. */\nexport const CONTAINER_CREATE_ADOPTION_REFUSED =\n  \"Container create adoption was refused\";\n\n/**\n * The listed create's signed identity is not this device's pending create: its\n * signed create names another signer, another organization, or a root. An honest server never lists that under the\n * id this device minted, and no later read can change those signed facts, so\n * the intent parks instead of re-verifying.\n */\nclass ForeignContainerCreateError extends KeyingVerificationError {}\n\nfunction foreignCreate(\n  code: KeyingVerificationCode,\n  message: string,\n): ForeignContainerCreateError {\n  return new ForeignContainerCreateError(code, `${LABEL} ${message}`);\n}\n\nasync function verifyAdoptableProjection(input: {\n  readonly containerId: string;\n  readonly expectedOrganizationId: string;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly sessionUserId: string;\n  readonly state: ContainerCreateIntentSyncState;\n}): Promise<AdoptedContainerPlacement> {\n  const { projection } = input;\n  if (\n    projection.containerId !== input.containerId ||\n    projection.organizationId !== input.expectedOrganizationId\n  ) {\n    // The envelope is unsigned: a corrupt read is retried, not parked.\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${LABEL} projection has the wrong identity`,\n    );\n  }\n  const { path, verifiedByHash } = await verifyContainerDestinationProjection({\n    execSql: input.state.runtime.infra.execSql,\n    projection,\n    resolveUserKey: input.state.resolveProjectionUserKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.state.runtime,\n    ),\n  });\n  const head = path.at(-1);\n  // One read naming another container says nothing signed about this id.\n  if (!head || head.state.containerId !== input.containerId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${LABEL} projection names another container`,\n    );\n  }\n  const create = verifiedContainerCreateManifest({\n    head,\n    label: LABEL,\n    verifiedByHash,\n  });\n  if (create.event.event.signerUserId !== input.sessionUserId) {\n    throw foreignCreate(\"signer_mismatch\", \"was signed by another user\");\n  }\n  if (create.state.organizationId !== input.expectedOrganizationId) {\n    throw foreignCreate(\"object_mismatch\", \"belongs to another organization\");\n  }\n  const createdParentId = create.state.parentContainerId;\n  const currentParentId = head.state.parentContainerId;\n  if (createdParentId === null || currentParentId === null) {\n    throw foreignCreate(\"object_mismatch\", \"is an organization root\");\n  }\n  return { createdParentId, currentParentId };\n}\n\n/**\n * A pending create whose container the listing already carries is adopted\n * only when the container's signed epoch-1 `container.create` is this user's,\n * in the intended organization (#2365 finding 26). Listing metadata is\n * unsigned: a create by another writer that collides on the pending id, or one\n * a dishonest server invents, must not become this device's container.\n * Documents apply the same rule (`workflows/documents/createAdoption.ts`).\n *\n * Returns where the create committed and where the verified head sits now.\n * The user may have moved the pending container since, which rewrites its\n * intent's parent; that is a move still owed, not a mismatch.\n */\nasync function assertContainerCreateAdoptable(input: {\n  readonly containerId: string;\n  readonly expectedOrganizationId: string;\n  readonly state: ContainerCreateIntentSyncState;\n}): Promise<AdoptedContainerPlacement> {\n  const { runtime } = input.state;\n  const sessionUserId = runtime.auth.userId;\n  // Without a session user there is no signer to compare: not tampering.\n  if (!sessionUserId) {\n    throw new Error(`${LABEL} needs a signed-in session user`);\n  }\n  const projection = await runtime.apiClient.getContainerWriterProjection(\n    input.containerId,\n  );\n  if (!projection) {\n    throw new Error(`${LABEL} is unavailable to verify`);\n  }\n  try {\n    return await verifyAdoptableProjection({\n      ...input,\n      projection,\n      sessionUserId,\n    });\n  } catch (error) {\n    // Never re-serve a cached projection that failed verification.\n    if (isKeyingVerificationError(error)) {\n      runtime.apiClient.evictContainerWriterProjection(input.containerId);\n    }\n    throw error;\n  }\n}\n\nfunction verifyListedContainerCreate(input: {\n  readonly intent: ContainerCreateIntentSyncInput[\"intent\"];\n  readonly parentState: ContainerState;\n  readonly state: ContainerCreateIntentSyncState;\n}): Promise<AdoptedContainerPlacement> {\n  const adoption = {\n    containerId: input.intent.containerId,\n    expectedOrganizationId: input.parentState.container.organizationId,\n  };\n  return input.state.verifyCreateAdoption\n    ? input.state.verifyCreateAdoption(adoption)\n    : assertContainerCreateAdoptable({ ...adoption, state: input.state });\n}\n\n/** Settles a verified adoption against the row hydration installed. */\nasync function markContainerCreateIntentAdopted(input: {\n  containerState: ContainerState;\n  placement: AdoptedContainerPlacement;\n  syncInput: ContainerCreateIntentSyncInput;\n}): Promise<boolean> {\n  const { containerState, placement, syncInput } = input;\n  const remoteMetadataDocumentId = containerState.record.documentId;\n  const remoteMetadataAccessStateHash = containerState.record.accessStateHash;\n\n  if (!remoteMetadataDocumentId || !remoteMetadataAccessStateHash) {\n    return false;\n  }\n  return settleContainerCreateIntent({\n    createdParentContainerId: placement.createdParentId,\n    desiredParentContainerId: syncInput.intent.parentContainerId,\n    intent: syncInput.intent,\n    isCurrent: syncInput.isCurrent,\n    remoteContainerId: containerState.container.id,\n    remoteMetadataAccessStateHash,\n    remoteMetadataDocumentId,\n    state: syncInput.state,\n    supersededMovePreviousParentId: placement.currentParentId,\n  });\n}\n\n/**\n * Records a failed adoption and leaves the lane's other intents to proceed. A\n * foreign create parks the intent: its signed facts never change, so later\n * passes neither re-read it nor report it again. Any other failure retries.\n */\nasync function recordAdoptionFailure(input: {\n  readonly error: unknown;\n  readonly organizationId: string;\n  readonly syncInput: ContainerCreateIntentSyncInput;\n}): Promise<\"abandoned\" | \"failed\"> {\n  const { intent, isCurrent, state } = input.syncInput;\n  if (!isCurrent()) return \"abandoned\";\n  await reportKeyingVerificationErrorInCauseChain(\n    input.error,\n    state.runtime.util.reportSecurityIncident,\n    {\n      objectId: intent.containerId,\n      objectKind: \"container\",\n      operation: \"container.create.replay\",\n      organizationId: input.organizationId,\n    },\n  );\n  if (!isCurrent()) return \"abandoned\";\n  const action =\n    input.error instanceof ForeignContainerCreateError\n      ? CONTAINER_CREATE_ADOPTION_REFUSED\n      : \"Container create adoption verification failed\";\n  await state.persistence.recordCreateIntentRevisionError(\n    state.runtime.infra.execSql,\n    {\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      message: `${action}: ${errorMessage(input.error)}`,\n      stillCurrent: isCurrent,\n    },\n  );\n  return isCurrent() ? \"failed\" : \"abandoned\";\n}\n\n/**\n * Adopts a pending create the listing already carries, once its signed create\n * proves it is this device's. A parked refusal stays blocked without a read.\n */\nexport async function syncListedContainerCreate(input: {\n  readonly containerState: ContainerState;\n  readonly parentState: ContainerState;\n  readonly syncInput: ContainerCreateIntentSyncInput;\n}): Promise<\"abandoned\" | \"blocked\" | \"created\" | \"failed\"> {\n  const { containerState, parentState, syncInput } = input;\n  const { intent, isCurrent, state } = syncInput;\n  if (intent.lastError?.startsWith(CONTAINER_CREATE_ADOPTION_REFUSED)) {\n    return \"blocked\";\n  }\n  let placement: AdoptedContainerPlacement;\n  try {\n    placement = await verifyListedContainerCreate({\n      intent,\n      parentState,\n      state,\n    });\n  } catch (error) {\n    return recordAdoptionFailure({\n      error,\n      organizationId: parentState.container.organizationId,\n      syncInput,\n    });\n  }\n  const marked = await markContainerCreateIntentAdopted({\n    containerState,\n    placement,\n    syncInput,\n  });\n  if (!marked) return isCurrent() ? \"blocked\" : \"abandoned\";\n  // The folder now sits elsewhere; list it there rather than waiting for the\n  // next poll to correct the local parent.\n  if (placement.currentParentId !== intent.parentContainerId) {\n    syncInput.requestRemoteReconciliation(placement.currentParentId);\n  }\n  return \"created\";\n}\n"]}