@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/container-contents/remoteHydration/replacementBinding.js

@@ -1,75 +0,0 @@
-import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
-import { assertHeldContainerBinding, } from "../../../data/containers/containerBinding.js";
-import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { loadOrganizationFounder } from "../../../data/persistence/organizationFounderPersistence.js";
-import { persistOrganizationReplacementCheckpoints } from "../../../data/persistence/organizationReplacementCheckpointPersistence.js";
-async function acceptsSharedReplacement(input, oldOrganizationId) {
-    const { listed, role, runtime } = input;
-    const founder = await loadOrganizationFounder(runtime.infra.execSql, oldOrganizationId);
-    if (!founder || role.createSignerUserId !== founder.userId)
-        return false;
-    const identity = await runtime.resolveTrustedUserIdentity(founder.userId);
-    if (!identity)
-        throw new ProjectionDependencyUnavailableError("Replacement founder identity is unavailable");
-    if (identity.signingKeyFingerprint !== founder.signingKeyFingerprint)
-        throw new KeyingVerificationError("signer_mismatch", "Replacement founder differs from the held organization's pinned identity");
-    const response = await runtime.apiClient.getContainerReplacementAuthorizationsResult(listed.id, oldOrganizationId);
-    if (!response.ok) {
-        if (response.status === 404)
-            return false;
-        throw new ProjectionDependencyUnavailableError(response.message);
-    }
-    const last = verifyReplacementLineage(response.data.authorizations, oldOrganizationId, founder.userId, identity.signingPublicKey);
-    const replacementFounder = await loadOrganizationFounder(runtime.infra.execSql, listed.organizationId);
-    if (last?.organizationId !== listed.organizationId ||
-        replacementFounder?.userId !== founder.userId ||
-        replacementFounder.signingKeyFingerprint !==
-            founder.signingKeyFingerprint ||
-        replacementFounder.genesisStateHash !== last.organizationStateHash ||
-        role.rootContainerId !== last.rootContainerId ||
-        role.rootCreateManifestHash !== last.rootManifestHash ||
-        role.rootMetadataDocumentId !== last.rootMetadataDocumentId)
-        throw new KeyingVerificationError("object_mismatch", "Replacement authorization does not bind the destination genesis");
-    // The founder also commits the reserved groups' genesis. Pin those even
-    // when the readable folder's projection does not cite both groups yet.
-    await persistOrganizationReplacementCheckpoints({
-        authorization: last,
-        execSql: runtime.infra.execSql,
-        stillCurrent: input.stillCurrent,
-    });
-    return true;
-}
-function verifyReplacementLineage(authorizations, oldOrganizationId, userId, signingPublicKey) {
-    let expected = oldOrganizationId;
-    const visited = new Set([expected]);
-    let last;
-    for (const candidate of authorizations) {
-        const proof = verifyOrganizationReplacementAuthorization(candidate, signingPublicKey);
-        if (proof.replacesOrganizationId !== expected ||
-            proof.userId !== userId ||
-            visited.has(proof.organizationId))
-            throw new KeyingVerificationError("object_mismatch", "Replacement authorization lineage does not extend the held organization");
-        expected = proof.organizationId;
-        visited.add(expected);
-        last = proof;
-    }
-    return last;
-}
-/** A foreign creator needs the held organization's pinned founder to authorize rehome. */
-export async function assertPermittedDestinationBinding(input) {
-    const { heldBinding: held, listed, role, runtime } = input;
-    if (role.createSignerUserId === runtime.auth.userId)
-        return;
-    if (held?.metadataDocumentId === null)
-        throw new KeyingVerificationError("signer_mismatch", "a local folder can bind only to its own signed create");
-    if (held?.organizationId &&
-        held.organizationId !== listed.organizationId &&
-        role.systemSlot === null &&
-        (await acceptsSharedReplacement(input, held.organizationId)))
-        return;
-    assertHeldContainerBinding(held, {
-        organizationId: listed.organizationId,
-        metadataDocumentIds: [role.metadataDocumentId],
-    });
-}
-//# sourceMappingURL=replacementBinding.js.map

package/workflows/container-contents/remoteHydration/replacementBinding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"replacementBinding.js","sourceRoot":"","sources":["replacementBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,GAE3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,yCAAyC,EAAE,MAAM,wEAAwE,CAAC;AAYnI,KAAK,UAAU,wBAAwB,CACrC,KAAmB,EACnB,iBAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;IACJ,IAAI,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;QAClE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,QAAQ,GACZ,MAAM,OAAO,CAAC,SAAS,CAAC,2CAA2C,CACjE,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,oCAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAC5B,iBAAiB,EACjB,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,IACE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,cAAc;QAC9C,kBAAkB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM;QAC7C,kBAAkB,CAAC,qBAAqB;YACtC,OAAO,CAAC,qBAAqB;QAC/B,kBAAkB,CAAC,gBAAgB,KAAK,IAAI,CAAC,qBAAqB;QAClE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;QAC7C,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,gBAAgB;QACrD,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,sBAAsB;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,yCAAyC,CAAC;QAC9C,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAkC,EAClC,iBAAyB,EACzB,MAAc,EACd,gBAA4B;IAE5B,IAAI,QAAQ,GAAG,iBAAiB,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,IAES,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,0CAA0C,CACtD,SAAS,EACT,gBAAgB,CACjB,CAAC;QACF,IACE,KAAK,CAAC,sBAAsB,KAAK,QAAQ;YACzC,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;YAEjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;QACJ,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO;IAC5D,IAAI,IAAI,EAAE,kBAAkB,KAAK,IAAI;QACnC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,IAAI,EAAE,cAAc;QACpB,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,UAAU,KAAK,IAAI;QACxB,CAAC,MAAM,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO;IACT,0BAA0B,CAAC,IAAI,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n  assertHeldContainerBinding,\n  type HeldContainerBinding,\n} from \"../../../data/containers/containerBinding\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { loadOrganizationFounder } from \"../../../data/persistence/organizationFounderPersistence\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../../data/persistence/organizationReplacementCheckpointPersistence\";\nimport type { DestinationRole } from \"./destinationRoleCache\";\nimport type { RemoteContainer, RemoteContainerHydrationState } from \"./types\";\n\nexport interface BindingInput {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly heldBinding: HeldContainerBinding | null;\n  readonly listed: Pick<RemoteContainer, \"id\" | \"organizationId\">;\n  readonly role: DestinationRole;\n  readonly runtime: RemoteContainerHydrationState[\"runtime\"];\n}\n\nasync function acceptsSharedReplacement(\n  input: BindingInput,\n  oldOrganizationId: string,\n): Promise<boolean> {\n  const { listed, role, runtime } = input;\n  const founder = await loadOrganizationFounder(\n    runtime.infra.execSql,\n    oldOrganizationId,\n  );\n  if (!founder || role.createSignerUserId !== founder.userId) return false;\n  const identity = await runtime.resolveTrustedUserIdentity(founder.userId);\n  if (!identity)\n    throw new ProjectionDependencyUnavailableError(\n      \"Replacement founder identity is unavailable\",\n    );\n  if (identity.signingKeyFingerprint !== founder.signingKeyFingerprint)\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Replacement founder differs from the held organization's pinned identity\",\n    );\n  const response =\n    await runtime.apiClient.getContainerReplacementAuthorizationsResult(\n      listed.id,\n      oldOrganizationId,\n    );\n  if (!response.ok) {\n    if (response.status === 404) return false;\n    throw new ProjectionDependencyUnavailableError(response.message);\n  }\n  const last = verifyReplacementLineage(\n    response.data.authorizations,\n    oldOrganizationId,\n    founder.userId,\n    identity.signingPublicKey,\n  );\n  const replacementFounder = await loadOrganizationFounder(\n    runtime.infra.execSql,\n    listed.organizationId,\n  );\n  if (\n    last?.organizationId !== listed.organizationId ||\n    replacementFounder?.userId !== founder.userId ||\n    replacementFounder.signingKeyFingerprint !==\n      founder.signingKeyFingerprint ||\n    replacementFounder.genesisStateHash !== last.organizationStateHash ||\n    role.rootContainerId !== last.rootContainerId ||\n    role.rootCreateManifestHash !== last.rootManifestHash ||\n    role.rootMetadataDocumentId !== last.rootMetadataDocumentId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Replacement authorization does not bind the destination genesis\",\n    );\n  // The founder also commits the reserved groups' genesis. Pin those even\n  // when the readable folder's projection does not cite both groups yet.\n  await persistOrganizationReplacementCheckpoints({\n    authorization: last,\n    execSql: runtime.infra.execSql,\n    stillCurrent: input.stillCurrent,\n  });\n  return true;\n}\n\nfunction verifyReplacementLineage(\n  authorizations: readonly unknown[],\n  oldOrganizationId: string,\n  userId: string,\n  signingPublicKey: Uint8Array,\n) {\n  let expected = oldOrganizationId;\n  const visited = new Set([expected]);\n  let last:\n    | ReturnType<typeof verifyOrganizationReplacementAuthorization>\n    | undefined;\n  for (const candidate of authorizations) {\n    const proof = verifyOrganizationReplacementAuthorization(\n      candidate,\n      signingPublicKey,\n    );\n    if (\n      proof.replacesOrganizationId !== expected ||\n      proof.userId !== userId ||\n      visited.has(proof.organizationId)\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Replacement authorization lineage does not extend the held organization\",\n      );\n    expected = proof.organizationId;\n    visited.add(expected);\n    last = proof;\n  }\n  return last;\n}\n\n/** A foreign creator needs the held organization's pinned founder to authorize rehome. */\nexport async function assertPermittedDestinationBinding(\n  input: BindingInput,\n): Promise<void> {\n  const { heldBinding: held, listed, role, runtime } = input;\n  if (role.createSignerUserId === runtime.auth.userId) return;\n  if (held?.metadataDocumentId === null)\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"a local folder can bind only to its own signed create\",\n    );\n  if (\n    held?.organizationId &&\n    held.organizationId !== listed.organizationId &&\n    role.systemSlot === null &&\n    (await acceptsSharedReplacement(input, held.organizationId))\n  )\n    return;\n  assertHeldContainerBinding(held, {\n    organizationId: listed.organizationId,\n    metadataDocumentIds: [role.metadataDocumentId],\n  });\n}\n"]}

package/workflows/container-contents/remoteHydration/verifiedDestination.js

@@ -1,296 +0,0 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "../../../internal/validators/containerSystemSlot.js";
-import { listingRepeatsHeldOrdinaryBinding, } from "../../../data/containers/containerBinding.js";
-import { verifiedContainerCreateManifest } from "../../../data/keyingProjectionVerification/containerCreateManifest.js";
-import { verifyContainerDestinationProjection } from "../../../data/keyingProjectionVerification/containerDestinationVerification.js";
-import { verifyContainerWriterProjection } from "../../../data/keyingProjectionVerification/containerProjectionVerification.js";
-import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, runWithSecurityIncidentReporting, } from "../../../data/keyingProjectionVerification/error.js";
-import { verifyRuntimeGroupMetadataAuthority } from "../../organizations/runtimeGroupMetadataAuthority.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { cachedDestinationRole, rememberDestinationRole, } from "./destinationRoleCache.js";
-import { resolveWithMetadataRootReload } from "./destinationRootReload.js";
-import { assertPermittedDestinationBinding } from "./replacementBinding.js";
-async function destinationRoleFromPath(input) {
-    const { listed, path } = input;
-    const head = path.at(-1);
-    if (!head ||
-        head.state.containerId !== listed.id ||
-        head.state.organizationId !== listed.organizationId) {
-        throw new KeyingVerificationError("object_mismatch", "container destination manifest has the wrong identity");
-    }
-    const metadataSlot = await deriveOrganizationMetadataContainerSystemSlot({
-        organizationId: listed.organizationId,
-    });
-    if (head.state.systemSlot !== null &&
-        path.length !== (head.state.systemSlot === metadataSlot ? 1 : 2)) {
-        throw new KeyingVerificationError("invalid_shape", "system destination has the wrong signed topology");
-    }
-    // The head may be a later grant signed by any admin; only the epoch-1
-    // create names the creator, and roots are always created by the org owner.
-    const created = verifiedContainerCreateManifest({
-        head,
-        label: "Container destination",
-        verifiedByHash: input.verifiedByHash,
-    });
-    const root = path[0];
-    if (!root)
-        throw new Error("Destination root is unavailable");
-    const rootCreated = verifiedContainerCreateManifest({
-        head: root,
-        label: "Destination root",
-        verifiedByHash: input.verifiedByHash,
-    });
-    return {
-        parentId: head.state.parentContainerId,
-        role: {
-            createSignerUserId: created.event.event.signerUserId,
-            rootContainerId: rootCreated.state.containerId,
-            rootCreateManifestHash: rootCreated.manifestHash,
-            rootMetadataDocumentId: rootCreated.state.metadataDocumentId,
-            metadataDocumentId: head.state.metadataDocumentId,
-            ...(head.state.parentContainerId === null ||
-                head.state.systemSlot !== null
-                ? { parentId: head.state.parentContainerId }
-                : {}),
-            systemSlot: head.state.systemSlot,
-        },
-    };
-}
-/**
- * The session's root id arrives in an unsigned login response, so the root it
- * names must prove it belongs to this user: every acknowledged organization was
- * created by the session user, whose device signed the root's `container.create`.
- * A verified root created by anyone else is a substitution, never the merge
- * target for pre-login local content, whatever grants it carries. The check
- * runs on cache reuse too, since the cache is not scoped to the session user.
- */
-function assertRootCreatedBySessionUser(role, runtime) {
-    if (role.systemSlot !== null) {
-        throw new KeyingVerificationError("object_mismatch", "acknowledged session root cannot be a system container");
-    }
-    if (role.createSignerUserId !== runtime.auth.userId) {
-        throw new KeyingVerificationError("signer_mismatch", "acknowledged session root was not created by the session user");
-    }
-}
-function assertAcknowledgedRootSigner(input) {
-    const { listed, role, runtime } = input;
-    if (role.parentId !== null || listed.id !== runtime.auth.rootContainerId) {
-        return;
-    }
-    assertRootCreatedBySessionUser(role, runtime);
-}
-/**
- * Authenticate destination roles before admitting a binding or advancing any
- * placement pin. Shared rehomes additionally require signed replacement evidence.
- */
-async function verifyDestinationRole(input) {
-    const { isCurrent, listed, runtime } = input;
-    const projection = input.prefetched
-        ? input.prefetched.projection
-        : await runtime.apiClient.getContainerWriterProjection(listed.id);
-    if (!projection || isCurrent?.() === false)
-        return null;
-    if (projection.containerId !== listed.id ||
-        projection.organizationId !== listed.organizationId) {
-        throw new KeyingVerificationError("object_mismatch", "container destination projection has the wrong identity");
-    }
-    const verificationInput = {
-        execSql: runtime.infra.execSql,
-        projection,
-        resolveUserKey: runtime.resolveTrustedUserIdentity,
-        stillCurrent: isCurrent,
-        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
-    };
-    const { path, verifiedByHash } = await verifyContainerDestinationProjection(verificationInput);
-    if (isCurrent?.() === false)
-        return null;
-    const destination = await destinationRoleFromPath({
-        listed,
-        path,
-        verifiedByHash,
-    });
-    const { role } = destination;
-    // Refuse a rebinding before group checks or placement pins run for it.
-    await assertPermittedDestinationBinding({
-        stillCurrent: isCurrent,
-        heldBinding: input.heldBinding,
-        listed,
-        role,
-        runtime,
-    });
-    if (isCurrent?.() === false)
-        return null;
-    if (role.parentId === null && role.systemSlot !== null) {
-        const head = path.at(-1);
-        if (!head)
-            throw new Error("Metadata root manifest is unavailable");
-        await verifyRuntimeGroupMetadataAuthority({
-            runtime,
-            organizationId: listed.organizationId,
-            organizationReference: projection.policyEvidence.organization?.head,
-            state: head.state,
-            stillCurrent: isCurrent ?? (() => true),
-        });
-    }
-    if (isCurrent?.() === false)
-        return null;
-    if (input.verifyCurrentPlacement) {
-        // Check the immutable role before allowing current placement to advance pins.
-        assertAcknowledgedRootSigner({ listed, role, runtime });
-        const currentPath = await verifyContainerWriterProjection({
-            ...verificationInput,
-            stillCurrent: isCurrent,
-        });
-        const currentHead = currentPath.at(-1);
-        if (!currentHead)
-            throw new Error("Recovery placement manifest is unavailable");
-        input.onVerifiedCheckpoint?.(currentHead.checkpoint);
-    }
-    if (isCurrent?.() === false)
-        return null;
-    return destination;
-}
-/** A cached immutable role, or a freshly verified one with its signed parent. */
-async function resolveDestinationRole(input) {
-    const { remoteContainer: listed, isCurrent } = input;
-    const runtime = input.state.runtime;
-    const cached = input.refresh
-        ? undefined
-        : cachedDestinationRole(runtime.infra.execSql, listed);
-    // Ordinary parent edges are not immutable. A refresh authenticates current
-    // placement; a forged root hint must also be corrected from a signed path.
-    if (cached && !(cached.parentId === undefined && listed.parentId === null)) {
-        return { freshlyVerified: false, parentId: cached.parentId, role: cached };
-    }
-    const verified = await verifyDestinationRole({
-        heldBinding: input.heldBinding,
-        prefetched: input.refresh ? undefined : input.prefetchedProjection,
-        isCurrent,
-        listed,
-        runtime,
-        verifyCurrentPlacement: input.refresh === true,
-        onVerifiedCheckpoint: input.onVerifiedCheckpoint,
-    });
-    if (!verified)
-        return null;
-    return {
-        freshlyVerified: true,
-        parentId: input.refresh || listed.parentId === null
-            ? verified.parentId
-            : verified.role.parentId,
-        role: verified.role,
-    };
-}
-/**
- * Listing hints never establish a metadata target or a system/root role, and a
- * held folder keeps its organization and metadata target unless its own user
- * re-created it or its pinned founder authorized a verified replacement.
- * A conflicting proof is refused before placement pins
- * advance or its role is cached.
- */
-export async function verifyRemoteContainerDestination(input) {
-    const { remoteContainer: listed, state, isCurrent } = input;
-    const runtime = state.runtime;
-    return runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
-        objectId: listed.id,
-        objectKind: "container",
-        operation: "container.destination.verify",
-        organizationId: listed.organizationId,
-    }, async () => {
-        if (input.supersededListing) {
-            throw new KeyingVerificationError("object_mismatch", "container was re-homed away from the listed organization");
-        }
-        // A held ordinary binding was verified (or signed by this device) when
-        // it was stored; a listing that repeats it needs no second proof.
-        if (!input.refresh &&
-            listingRepeatsHeldOrdinaryBinding(input.heldBinding, listed)) {
-            return { ...listed, systemSlot: null };
-        }
-        if (input.refresh)
-            runtime.apiClient.evictContainerWriterProjection(listed.id);
-        // A metadata root read before a reserved-group commit is reloaded once.
-        const resolved = await resolveWithMetadataRootReload(input, resolveDestinationRole, () => runtime.apiClient.evictContainerWriterProjection(listed.id)).catch((error) => {
-            // Never re-serve a cached projection that failed verification.
-            if (isKeyingVerificationError(error))
-                runtime.apiClient.evictContainerWriterProjection(listed.id);
-            throw error;
-        });
-        if (!resolved || isCurrent?.() === false)
-            return null;
-        const { role, parentId } = resolved;
-        // Fresh verification checked this binding before any placement pins.
-        // A cached role still needs the held binding and replacement proof checked.
-        if (!resolved.freshlyVerified)
-            await assertPermittedDestinationBinding({
-                stillCurrent: isCurrent,
-                heldBinding: input.heldBinding,
-                listed,
-                role,
-                runtime,
-            });
-        if (isCurrent?.() === false)
-            return null;
-        if (resolved.freshlyVerified)
-            rememberDestinationRole(runtime.infra.execSql, listed, role);
-        assertAcknowledgedRootSigner({ listed, role, runtime });
-        return {
-            ...listed,
-            metadataDocumentId: role.metadataDocumentId,
-            parentId: parentId === undefined ? listed.parentId : parentId,
-            systemSlot: role.systemSlot,
-        };
-    });
-}
-/** The root the unsigned login answer named, in the expected organization. */
-export function isSessionRootState(remoteRootState, state) {
-    const { container } = remoteRootState;
-    const { auth } = state.runtime;
-    return (container.parentId === null &&
-        !container.systemSlot &&
-        container.id === auth.rootContainerId &&
-        container.organizationId === auth.organizationId);
-}
-/**
- * Whether the session root may absorb the pre-login local roots. The unsigned
- * login answer only names the root; the merge target must also be the verified
- * root whose epoch-1 `container.create` the session user signed. A row persisted
- * earlier as an ordinary shared container (another user's root this device once
- * hydrated) never passed that check for this session, so the creator is checked
- * here, at the reconciliation boundary itself, before any local content is
- * re-parented. The role comes only from the cache remote hydration fills when
- * it verifies the destination: this gate never fetches, so a local refresh stays
- * independent of the network. Without a cached role the merge is left pending
- * (no incident) until hydration verifies the root and reconciles from the
- * cache. A different creator is a `signer_mismatch` incident and never a merge;
- * the refusal is the "no merge" outcome, so the refresh that carried it
- * completes with the local content left in place.
- */
-export async function isVerifiedLocalRootReconciliationTarget(input) {
-    const { remoteRootState, state } = input;
-    const { container } = remoteRootState;
-    const runtime = state.runtime;
-    if (!isSessionRootState(remoteRootState, state))
-        return false;
-    const role = cachedDestinationRole(runtime.infra.execSql, container);
-    if (!role)
-        return false;
-    try {
-        if (role.parentId !== null) {
-            throw new KeyingVerificationError("object_mismatch", "session root reconciliation target is not a verified root");
-        }
-        assertRootCreatedBySessionUser(role, runtime);
-        return true;
-    }
-    catch (error) {
-        const reported = await reportKeyingVerificationErrorInCauseChain(error, runtime.util.reportSecurityIncident, {
-            objectId: container.id,
-            objectKind: "container",
-            operation: "container.root.reconcile",
-            organizationId: container.organizationId,
-        });
-        if (!reported)
-            throw error;
-        return false;
-    }
-}
-//# sourceMappingURL=verifiedDestination.js.map

package/workflows/container-contents/remoteHydration/verifiedDestination.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifiedDestination.js","sourceRoot":"","sources":["verifiedDestination.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAC1G,OAAO,EAEL,iCAAiC,GAClC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAC;AACrH,OAAO,EAAE,oCAAoC,EAAE,MAAM,6EAA6E,CAAC;AACnI,OAAO,EAAE,+BAA+B,EAAE,MAAM,4EAA4E,CAAC;AAC7H,OAAO,EACL,yBAAyB,EACzB,yCAAyC,EACzC,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EACL,qBAAqB,EAErB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAUzE,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6CAA6C,CAAC;QACvE,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,+BAA+B,CAAC;QAClD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QACtC,IAAI,EAAE;YACJ,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;YACpD,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW;YAC9C,sBAAsB,EAAE,WAAW,CAAC,YAAY;YAChD,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,kBAAkB;YAC5D,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;gBACzC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CACrC,IAAqB,EACrB,OAAiD;IAEjD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IACE,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,0BAA0B;QAClD,YAAY,EAAE,SAAS;QACvB,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAC5B,MAAM,oCAAoC,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,MAAM;QACN,IAAI;QACJ,cAAc;KACf,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;IAC7B,uEAAuE;IACvE,MAAM,iCAAiC,CAAC;QACtC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,MAAM,mCAAmC,CAAC;YACxC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,8EAA8E;QAC9E,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC;YACxD,GAAG,iBAAiB;YACpB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,KAAK,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAiBD,iFAAiF;AACjF,KAAK,UAAU,sBAAsB,CACnC,KAA4C;IAM5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB;QAClE,SAAS;QACT,MAAM;QACN,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EACN,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,8BAA8B;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,EACD,KAAK,IAAI,EAAE;QACT,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,IACE,CAAC,KAAK,CAAC,OAAO;YACd,iCAAiC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAC5D,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YACf,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,sBAAsB,EACtB,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAClE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,+DAA+D;YAC/D,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QACpC,qEAAqE;QACrE,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC3B,MAAM,iCAAiC,CAAC;gBACtC,YAAY,EAAE,SAAS;gBACvB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM;gBACN,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,QAAQ,CAAC,eAAe;YAC1B,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,GAAG,MAAM;YACT,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC7D,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAChC,eAA+B,EAC/B,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,OAAO,CACL,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,CAAC,SAAS,CAAC,UAAU;QACrB,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe;QACrC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAG7D;IACC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,0BAA0B;YACrC,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CACF,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport {\n  type HeldContainerBinding,\n  listingRepeatsHeldOrdinaryBinding,\n} from \"../../../data/containers/containerBinding\";\nimport { verifiedContainerCreateManifest } from \"../../../data/keyingProjectionVerification/containerCreateManifest\";\nimport { verifyContainerDestinationProjection } from \"../../../data/keyingProjectionVerification/containerDestinationVerification\";\nimport { verifyContainerWriterProjection } from \"../../../data/keyingProjectionVerification/containerProjectionVerification\";\nimport {\n  isKeyingVerificationError,\n  reportKeyingVerificationErrorInCauseChain,\n  runWithSecurityIncidentReporting,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { verifyRuntimeGroupMetadataAuthority } from \"../../organizations/runtimeGroupMetadataAuthority\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { PrefetchedDestinationProjection } from \"./destinationPrefetch\";\nimport {\n  cachedDestinationRole,\n  type DestinationRole,\n  rememberDestinationRole,\n} from \"./destinationRoleCache\";\nimport { resolveWithMetadataRootReload } from \"./destinationRootReload\";\nimport { assertPermittedDestinationBinding } from \"./replacementBinding\";\nimport type {\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\n/** The identity a role is verified and cached under. */\ntype DestinationIdentity = Pick<RemoteContainer, \"id\" | \"organizationId\">;\n\nasync function destinationRoleFromPath(input: {\n  listed: DestinationIdentity;\n  path: readonly VerifiedContainerAccessManifest[];\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<{ role: DestinationRole; parentId: string | null }> {\n  const { listed, path } = input;\n  const head = path.at(-1);\n  if (\n    !head ||\n    head.state.containerId !== listed.id ||\n    head.state.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination manifest has the wrong identity\",\n    );\n  }\n  const metadataSlot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: listed.organizationId,\n  });\n  if (\n    head.state.systemSlot !== null &&\n    path.length !== (head.state.systemSlot === metadataSlot ? 1 : 2)\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"system destination has the wrong signed topology\",\n    );\n  }\n  // The head may be a later grant signed by any admin; only the epoch-1\n  // create names the creator, and roots are always created by the org owner.\n  const created = verifiedContainerCreateManifest({\n    head,\n    label: \"Container destination\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  const root = path[0];\n  if (!root) throw new Error(\"Destination root is unavailable\");\n  const rootCreated = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Destination root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  return {\n    parentId: head.state.parentContainerId,\n    role: {\n      createSignerUserId: created.event.event.signerUserId,\n      rootContainerId: rootCreated.state.containerId,\n      rootCreateManifestHash: rootCreated.manifestHash,\n      rootMetadataDocumentId: rootCreated.state.metadataDocumentId,\n      metadataDocumentId: head.state.metadataDocumentId,\n      ...(head.state.parentContainerId === null ||\n      head.state.systemSlot !== null\n        ? { parentId: head.state.parentContainerId }\n        : {}),\n      systemSlot: head.state.systemSlot,\n    },\n  };\n}\n\n/**\n * The session's root id arrives in an unsigned login response, so the root it\n * names must prove it belongs to this user: every acknowledged organization was\n * created by the session user, whose device signed the root's `container.create`.\n * A verified root created by anyone else is a substitution, never the merge\n * target for pre-login local content, whatever grants it carries. The check\n * runs on cache reuse too, since the cache is not scoped to the session user.\n */\nfunction assertRootCreatedBySessionUser(\n  role: DestinationRole,\n  runtime: RemoteContainerHydrationState[\"runtime\"],\n): void {\n  if (role.systemSlot !== null) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"acknowledged session root cannot be a system container\",\n    );\n  }\n  if (role.createSignerUserId !== runtime.auth.userId) {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"acknowledged session root was not created by the session user\",\n    );\n  }\n}\n\nfunction assertAcknowledgedRootSigner(input: {\n  listed: DestinationIdentity;\n  role: DestinationRole;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): void {\n  const { listed, role, runtime } = input;\n  if (role.parentId !== null || listed.id !== runtime.auth.rootContainerId) {\n    return;\n  }\n  assertRootCreatedBySessionUser(role, runtime);\n}\n\n/**\n * Authenticate destination roles before admitting a binding or advancing any\n * placement pin. Shared rehomes additionally require signed replacement evidence.\n */\nasync function verifyDestinationRole(input: {\n  heldBinding: HeldContainerBinding | null;\n  prefetched: PrefetchedDestinationProjection | undefined;\n  verifyCurrentPlacement: boolean;\n  onVerifiedCheckpoint:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  isCurrent?: (() => boolean) | undefined;\n  listed: DestinationIdentity;\n  runtime: RemoteContainerHydrationState[\"runtime\"];\n}): Promise<{ role: DestinationRole; parentId: string | null } | null> {\n  const { isCurrent, listed, runtime } = input;\n  const projection = input.prefetched\n    ? input.prefetched.projection\n    : await runtime.apiClient.getContainerWriterProjection(listed.id);\n  if (!projection || isCurrent?.() === false) return null;\n  if (\n    projection.containerId !== listed.id ||\n    projection.organizationId !== listed.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container destination projection has the wrong identity\",\n    );\n  }\n  const verificationInput = {\n    execSql: runtime.infra.execSql,\n    projection,\n    resolveUserKey: runtime.resolveTrustedUserIdentity,\n    stillCurrent: isCurrent,\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  };\n  const { path, verifiedByHash } =\n    await verifyContainerDestinationProjection(verificationInput);\n  if (isCurrent?.() === false) return null;\n  const destination = await destinationRoleFromPath({\n    listed,\n    path,\n    verifiedByHash,\n  });\n  const { role } = destination;\n  // Refuse a rebinding before group checks or placement pins run for it.\n  await assertPermittedDestinationBinding({\n    stillCurrent: isCurrent,\n    heldBinding: input.heldBinding,\n    listed,\n    role,\n    runtime,\n  });\n  if (isCurrent?.() === false) return null;\n  if (role.parentId === null && role.systemSlot !== null) {\n    const head = path.at(-1);\n    if (!head) throw new Error(\"Metadata root manifest is unavailable\");\n    await verifyRuntimeGroupMetadataAuthority({\n      runtime,\n      organizationId: listed.organizationId,\n      organizationReference: projection.policyEvidence.organization?.head,\n      state: head.state,\n      stillCurrent: isCurrent ?? (() => true),\n    });\n  }\n  if (isCurrent?.() === false) return null;\n  if (input.verifyCurrentPlacement) {\n    // Check the immutable role before allowing current placement to advance pins.\n    assertAcknowledgedRootSigner({ listed, role, runtime });\n    const currentPath = await verifyContainerWriterProjection({\n      ...verificationInput,\n      stillCurrent: isCurrent,\n    });\n    const currentHead = currentPath.at(-1);\n    if (!currentHead)\n      throw new Error(\"Recovery placement manifest is unavailable\");\n    input.onVerifiedCheckpoint?.(currentHead.checkpoint);\n  }\n  if (isCurrent?.() === false) return null;\n  return destination;\n}\n\ntype VerifyRemoteContainerDestinationInput = {\n  heldBinding: HeldContainerBinding | null;\n  /** The held folder was re-homed away from the listed organization. */\n  supersededListing?: boolean | undefined;\n  /** Fetched ahead by page hydration; ignored when placement is refreshed. */\n  prefetchedProjection?: PrefetchedDestinationProjection | undefined;\n  refresh?: boolean;\n  onVerifiedCheckpoint?:\n    | ((checkpoint: AccessManifestCheckpoint) => void)\n    | undefined;\n  remoteContainer: RemoteContainer;\n  state: RemoteContainerHydrationState;\n  isCurrent?: (() => boolean) | undefined;\n};\n\n/** A cached immutable role, or a freshly verified one with its signed parent. */\nasync function resolveDestinationRole(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<{\n  freshlyVerified: boolean;\n  parentId: string | null | undefined;\n  role: DestinationRole;\n} | null> {\n  const { remoteContainer: listed, isCurrent } = input;\n  const runtime = input.state.runtime;\n  const cached = input.refresh\n    ? undefined\n    : cachedDestinationRole(runtime.infra.execSql, listed);\n  // Ordinary parent edges are not immutable. A refresh authenticates current\n  // placement; a forged root hint must also be corrected from a signed path.\n  if (cached && !(cached.parentId === undefined && listed.parentId === null)) {\n    return { freshlyVerified: false, parentId: cached.parentId, role: cached };\n  }\n  const verified = await verifyDestinationRole({\n    heldBinding: input.heldBinding,\n    prefetched: input.refresh ? undefined : input.prefetchedProjection,\n    isCurrent,\n    listed,\n    runtime,\n    verifyCurrentPlacement: input.refresh === true,\n    onVerifiedCheckpoint: input.onVerifiedCheckpoint,\n  });\n  if (!verified) return null;\n  return {\n    freshlyVerified: true,\n    parentId:\n      input.refresh || listed.parentId === null\n        ? verified.parentId\n        : verified.role.parentId,\n    role: verified.role,\n  };\n}\n\n/**\n * Listing hints never establish a metadata target or a system/root role, and a\n * held folder keeps its organization and metadata target unless its own user\n * re-created it or its pinned founder authorized a verified replacement.\n * A conflicting proof is refused before placement pins\n * advance or its role is cached.\n */\nexport async function verifyRemoteContainerDestination(\n  input: VerifyRemoteContainerDestinationInput,\n): Promise<RemoteContainer | null> {\n  const { remoteContainer: listed, state, isCurrent } = input;\n  const runtime = state.runtime;\n  return runWithSecurityIncidentReporting(\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: listed.id,\n      objectKind: \"container\",\n      operation: \"container.destination.verify\",\n      organizationId: listed.organizationId,\n    },\n    async () => {\n      if (input.supersededListing) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"container was re-homed away from the listed organization\",\n        );\n      }\n      // A held ordinary binding was verified (or signed by this device) when\n      // it was stored; a listing that repeats it needs no second proof.\n      if (\n        !input.refresh &&\n        listingRepeatsHeldOrdinaryBinding(input.heldBinding, listed)\n      ) {\n        return { ...listed, systemSlot: null };\n      }\n      if (input.refresh)\n        runtime.apiClient.evictContainerWriterProjection(listed.id);\n      // A metadata root read before a reserved-group commit is reloaded once.\n      const resolved = await resolveWithMetadataRootReload(\n        input,\n        resolveDestinationRole,\n        () => runtime.apiClient.evictContainerWriterProjection(listed.id),\n      ).catch((error: unknown) => {\n        // Never re-serve a cached projection that failed verification.\n        if (isKeyingVerificationError(error))\n          runtime.apiClient.evictContainerWriterProjection(listed.id);\n        throw error;\n      });\n      if (!resolved || isCurrent?.() === false) return null;\n      const { role, parentId } = resolved;\n      // Fresh verification checked this binding before any placement pins.\n      // A cached role still needs the held binding and replacement proof checked.\n      if (!resolved.freshlyVerified)\n        await assertPermittedDestinationBinding({\n          stillCurrent: isCurrent,\n          heldBinding: input.heldBinding,\n          listed,\n          role,\n          runtime,\n        });\n      if (isCurrent?.() === false) return null;\n      if (resolved.freshlyVerified)\n        rememberDestinationRole(runtime.infra.execSql, listed, role);\n      assertAcknowledgedRootSigner({ listed, role, runtime });\n      return {\n        ...listed,\n        metadataDocumentId: role.metadataDocumentId,\n        parentId: parentId === undefined ? listed.parentId : parentId,\n        systemSlot: role.systemSlot,\n      };\n    },\n  );\n}\n\n/** The root the unsigned login answer named, in the expected organization. */\nexport function isSessionRootState(\n  remoteRootState: ContainerState,\n  state: RemoteContainerHydrationState,\n): boolean {\n  const { container } = remoteRootState;\n  const { auth } = state.runtime;\n  return (\n    container.parentId === null &&\n    !container.systemSlot &&\n    container.id === auth.rootContainerId &&\n    container.organizationId === auth.organizationId\n  );\n}\n\n/**\n * Whether the session root may absorb the pre-login local roots. The unsigned\n * login answer only names the root; the merge target must also be the verified\n * root whose epoch-1 `container.create` the session user signed. A row persisted\n * earlier as an ordinary shared container (another user's root this device once\n * hydrated) never passed that check for this session, so the creator is checked\n * here, at the reconciliation boundary itself, before any local content is\n * re-parented. The role comes only from the cache remote hydration fills when\n * it verifies the destination: this gate never fetches, so a local refresh stays\n * independent of the network. Without a cached role the merge is left pending\n * (no incident) until hydration verifies the root and reconciles from the\n * cache. A different creator is a `signer_mismatch` incident and never a merge;\n * the refusal is the \"no merge\" outcome, so the refresh that carried it\n * completes with the local content left in place.\n */\nexport async function isVerifiedLocalRootReconciliationTarget(input: {\n  remoteRootState: ContainerState;\n  state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n  const { remoteRootState, state } = input;\n  const { container } = remoteRootState;\n  const runtime = state.runtime;\n  if (!isSessionRootState(remoteRootState, state)) return false;\n  const role = cachedDestinationRole(runtime.infra.execSql, container);\n  if (!role) return false;\n  try {\n    if (role.parentId !== null) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"session root reconciliation target is not a verified root\",\n      );\n    }\n    assertRootCreatedBySessionUser(role, runtime);\n    return true;\n  } catch (error) {\n    const reported = await reportKeyingVerificationErrorInCauseChain(\n      error,\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: container.id,\n        objectKind: \"container\",\n        operation: \"container.root.reconcile\",\n        organizationId: container.organizationId,\n      },\n    );\n    if (!reported) throw error;\n    return false;\n  }\n}\n"]}

package/workflows/containers/child/carriedDescendantRekeys.js

@@ -1,126 +0,0 @@
-import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
-import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
-import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
-import { selectReplacementPrincipalPolicyReferences } from "./replacementPrincipalPolicyReferences.js";
-/**
- * Re-root a served projection on the deepest not-yet-accepted proper ancestor
- * among `speculativePaths`. Each carried plan's own path was built the same
- * way, so the deepest one already holds every speculative level above it. The
- * container's own path, when the batch rotates it too, is not an ancestor: the
- * caller is re-planning that rotation, and it extends what sits above.
- */
-export function rebaseOnDeepestAncestor(served, speculativePaths) {
-    let deepest = null;
-    let deepestIndex = -1;
-    for (const speculative of speculativePaths) {
-        const containerId = speculative.containerKeks.at(-1)?.containerId;
-        if (containerId === served.containerId)
-            continue;
-        const index = served.containerKeks.findIndex((kek) => kek.containerId === containerId);
-        if (index > deepestIndex) {
-            deepest = speculative;
-            deepestIndex = index;
-        }
-    }
-    if (!deepest)
-        return null;
-    const projection = rebaseContainerWriterProjection(served, deepest);
-    return projection ? { ancestor: deepest, projection } : null;
-}
-/**
- * Sign one carried rekey against the path its batch will leave behind. The
- * served projection is fetched by the caller; here it is verified, must sit
- * below one of the rotated containers and in that container's organization,
- * and is signed only if this signer holds its key and write access — which a
- * member able to rotate the ancestor always does, since both inherit downward.
- */
-export async function planCarriedDescendantRekey(input) {
-    // Pin the served head before signing beyond it. The batch is acknowledged
-    // against the latest durable pin, and a carried rekey is always past epoch
-    // 1, so a device that never pinned this container would otherwise reject
-    // its own batch after the server had committed it.
-    await verifyContainerWriterProjection({
-        execSql: input.execSql,
-        principalPolicyCache: input.principalPolicyCache,
-        projection: input.served,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);
-    if (!rebased) {
-        throw new Error("Carried descendant rekey is not below the rotated container");
-    }
-    // A batch locks whatever organizations it names, so the server holds each
-    // to the rule on its own; a carried rekey belongs to the rotation it rides.
-    if (input.served.organizationId !== rebased.ancestor.organizationId) {
-        throw new Error("Carried descendant rekey is outside the rotated container's organization");
-    }
-    return buildMaterializedContainerRekeyPlan({
-        author: {
-            ...input.author,
-            organizationId: rebased.ancestor.organizationId,
-        },
-        execSql: input.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        // Nothing here is acknowledged yet: pins move only with the batch.
-        persistVerificationCheckpoints: false,
-        previousProjection: rebased.projection,
-        principalPolicyCache: input.principalPolicyCache,
-        replacementPrincipalPolicy: input.replacementPrincipalPolicy
-            ? await selectReplacementPrincipalPolicyReferences({
-                policy: input.replacementPrincipalPolicy,
-                projection: rebased.projection,
-                principalPolicyCache: input.principalPolicyCache,
-                resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
-            })
-            : undefined,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-}
-/**
- * Sign the descendant rekeys a rotation must commit with (#2340). The server
- * refuses a rotation that would leave a level above a directly granted
- * container pinned to a retired epoch, because the grantee could never re-key
- * that level itself and its writes would wait on another device. It names the
- * levels; this signs them, parent-first, each against the path the batch will
- * leave behind rather than the one currently served.
- *
- * `requiredContainerIds` is a hint, never an authority: each container is
- * fetched and verified here, and refused unless it sits below a rotation.
- */
-export async function planCarriedDescendantRekeys(input) {
-    const plans = [];
-    const speculativePaths = [...input.rotated];
-    const knownContainerKeks = new Map(input.knownContainerKeks);
-    const planned = new Set();
-    for (const containerId of input.requiredContainerIds) {
-        if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS)
-            break;
-        if (planned.has(containerId))
-            continue;
-        const served = await input.apiClient.getContainerWriterProjection(containerId);
-        if (!served) {
-            throw new Error("Carried descendant rekey projection is unavailable");
-        }
-        if (served.containerId !== containerId) {
-            throw new Error("Carried descendant rekey targets another container");
-        }
-        const plan = await planCarriedDescendantRekey({
-            ...input,
-            knownContainerKeks,
-            rotated: speculativePaths,
-            served,
-        });
-        planned.add(containerId);
-        plans.push(plan);
-        speculativePaths.push(plan.writerProjection);
-        knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);
-    }
-    return plans;
-}
-//# sourceMappingURL=carriedDescendantRekeys.js.map

package/workflows/containers/child/carriedDescendantRekeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"carriedDescendantRekeys.js","sourceRoot":"","sources":["carriedDescendantRekeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAM3E,OAAO,EAIL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAuCpG;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyC,EACzC,gBAA4C;IAK5C,IAAI,OAAO,GAA2B,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAClE,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CACzC,CAAC;QACF,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,WAAW,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAGC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mEAAmE;QACnE,8BAA8B,EAAE,KAAK;QACrC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC1D,CAAC,CAAC,MAAM,0CAA0C,CAAC;gBAC/C,MAAM,EAAE,KAAK,CAAC,0BAA0B;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;aACxC,CAAC;YACJ,CAAC,CAAC,SAAS;QACb,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAIC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;YAAE,MAAM;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,KAAK;YACR,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\nimport { rebaseContainerWriterProjection } from \"./rekeyProjection\";\nimport { selectReplacementPrincipalPolicyReferences } from \"./replacementPrincipalPolicyReferences\";\n\n/** What a rotation needs in hand to sign the descendant rekeys it must carry. */\nexport interface CarriedRekeyPlanningInput {\n  readonly apiClient: Pick<ContainerRekeyApi, \"getContainerWriterProjection\">;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  /**\n   * Keys the batch minted and has yet to commit, by epoch id. A rotation's\n   * successor is wrapped to recipients at heads the batch itself commits, so\n   * no wrap on a re-rooted path opens it for the signer before then; the key\n   * the signer just minted does, and its keyring then opens what sits below.\n   */\n  readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * Verified policies the batch itself commits, which the rebased paths cite\n   * before any store holds them; and the one each carried rekey cites anew.\n   */\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** A rotated container's own path once its batch is accepted. */\nexport type SpeculativePath = Pick<\n  ContainerWriterProjectionResponse,\n  \"containerKeks\" | \"organizationId\" | \"path\" | \"policyEvidence\"\n>;\n\n/**\n * Re-root a served projection on the deepest not-yet-accepted proper ancestor\n * among `speculativePaths`. Each carried plan's own path was built the same\n * way, so the deepest one already holds every speculative level above it. The\n * container's own path, when the batch rotates it too, is not an ancestor: the\n * caller is re-planning that rotation, and it extends what sits above.\n */\nexport function rebaseOnDeepestAncestor(\n  served: ContainerWriterProjectionResponse,\n  speculativePaths: readonly SpeculativePath[],\n): {\n  ancestor: SpeculativePath;\n  projection: ContainerWriterProjectionResponse;\n} | null {\n  let deepest: SpeculativePath | null = null;\n  let deepestIndex = -1;\n  for (const speculative of speculativePaths) {\n    const containerId = speculative.containerKeks.at(-1)?.containerId;\n    if (containerId === served.containerId) continue;\n    const index = served.containerKeks.findIndex(\n      (kek) => kek.containerId === containerId,\n    );\n    if (index > deepestIndex) {\n      deepest = speculative;\n      deepestIndex = index;\n    }\n  }\n  if (!deepest) return null;\n  const projection = rebaseContainerWriterProjection(served, deepest);\n  return projection ? { ancestor: deepest, projection } : null;\n}\n\n/**\n * Sign one carried rekey against the path its batch will leave behind. The\n * served projection is fetched by the caller; here it is verified, must sit\n * below one of the rotated containers and in that container's organization,\n * and is signed only if this signer holds its key and write access — which a\n * member able to rotate the ancestor always does, since both inherit downward.\n */\nexport async function planCarriedDescendantRekey(\n  input: CarriedRekeyPlanningInput & {\n    readonly rotated: readonly SpeculativePath[];\n    readonly served: ContainerWriterProjectionResponse;\n  },\n): Promise<MaterializedContainerRekeyPlan> {\n  // Pin the served head before signing beyond it. The batch is acknowledged\n  // against the latest durable pin, and a carried rekey is always past epoch\n  // 1, so a device that never pinned this container would otherwise reject\n  // its own batch after the server had committed it.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.served,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);\n  if (!rebased) {\n    throw new Error(\n      \"Carried descendant rekey is not below the rotated container\",\n    );\n  }\n  // A batch locks whatever organizations it names, so the server holds each\n  // to the rule on its own; a carried rekey belongs to the rotation it rides.\n  if (input.served.organizationId !== rebased.ancestor.organizationId) {\n    throw new Error(\n      \"Carried descendant rekey is outside the rotated container's organization\",\n    );\n  }\n  return buildMaterializedContainerRekeyPlan({\n    author: {\n      ...input.author,\n      organizationId: rebased.ancestor.organizationId,\n    },\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Nothing here is acknowledged yet: pins move only with the batch.\n    persistVerificationCheckpoints: false,\n    previousProjection: rebased.projection,\n    principalPolicyCache: input.principalPolicyCache,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy\n      ? await selectReplacementPrincipalPolicyReferences({\n          policy: input.replacementPrincipalPolicy,\n          projection: rebased.projection,\n          principalPolicyCache: input.principalPolicyCache,\n          resolveAuthoredPolicyReferences:\n            input.resolveAuthoredPolicyReferences,\n        })\n      : undefined,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n\n/**\n * Sign the descendant rekeys a rotation must commit with (#2340). The server\n * refuses a rotation that would leave a level above a directly granted\n * container pinned to a retired epoch, because the grantee could never re-key\n * that level itself and its writes would wait on another device. It names the\n * levels; this signs them, parent-first, each against the path the batch will\n * leave behind rather than the one currently served.\n *\n * `requiredContainerIds` is a hint, never an authority: each container is\n * fetched and verified here, and refused unless it sits below a rotation.\n */\nexport async function planCarriedDescendantRekeys(\n  input: CarriedRekeyPlanningInput & {\n    readonly requiredContainerIds: readonly string[];\n    /** Each rotated container's own path once the batch is accepted. */\n    readonly rotated: readonly SpeculativePath[];\n  },\n): Promise<MaterializedContainerRekeyPlan[]> {\n  const plans: MaterializedContainerRekeyPlan[] = [];\n  const speculativePaths: SpeculativePath[] = [...input.rotated];\n  const knownContainerKeks = new Map(input.knownContainerKeks);\n  const planned = new Set<string>();\n  for (const containerId of input.requiredContainerIds) {\n    if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS) break;\n    if (planned.has(containerId)) continue;\n    const served =\n      await input.apiClient.getContainerWriterProjection(containerId);\n    if (!served) {\n      throw new Error(\"Carried descendant rekey projection is unavailable\");\n    }\n    if (served.containerId !== containerId) {\n      throw new Error(\"Carried descendant rekey targets another container\");\n    }\n    const plan = await planCarriedDescendantRekey({\n      ...input,\n      knownContainerKeks,\n      rotated: speculativePaths,\n      served,\n    });\n    planned.add(containerId);\n    plans.push(plan);\n    speculativePaths.push(plan.writerProjection);\n    knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);\n  }\n  return plans;\n}\n"]}

package/workflows/containers/child/create.d.ts

@@ -1,24 +0,0 @@
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { BuildContainerCreatePlanInput, ContainerCreatePlan, ContainerMutationAuthor, CreateRemoteContainerResult, MaterializedContainerCreatePlan } from "../../../data/containers/shared/types.js";
-import { type ProjectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import type { ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-import { type RemoteContainerCreateInput } from "./createSubmission.js";
-export declare function buildContainerCreatePlan(input: BuildContainerCreatePlanInput): Promise<ContainerCreatePlan>;
-export declare function buildMaterializedContainerCreatePlan(input: {
-    author: ContainerMutationAuthor;
-    containerId?: string | undefined;
-    containerKey?: Uint8Array | undefined;
-    containerKeyEpochId?: string | undefined;
-    eventId?: string | undefined;
-    execSql?: ExecSql | undefined;
-    managedPrincipalGrant?: BuildContainerCreatePlanInput["managedPrincipalGrant"];
-    metadataDocumentId?: string | undefined;
-    systemSlot?: string | null | undefined;
-    parentProjection: ContainerWriterProjectionResponse;
-    parentSecretKey: Uint8Array;
-    signedAt?: string | undefined;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-} & ProjectionVerificationOptions): Promise<MaterializedContainerCreatePlan>;
-export { childContainerWriterProjectionFromCreatePlan } from "./createProjection.js";
-export declare function createRemoteContainer(input: RemoteContainerCreateInput): Promise<CreateRemoteContainerResult | null>;