@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/create.js

@@ -1,335 +0,0 @@
-import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
-import { buildContainerCreateBody, buildContainerCreateKeyEpoch, buildParentRecipientTargets, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../data/containers/shared/events.js";
-import { acknowledgeContainerMutation } from "../../../data/containers/shared/mutationAcknowledgement.js";
-import { containerManifestRef, getParentCreateContext, readContainerState, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, } from "../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
-import { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
-import { repairContainerCreateFailure, submitRemoteContainerCreate, } from "./createSubmission.js";
-import { containerMutationRequestCore } from "./mutationRequestCore.js";
-import { requireUnwrappedKek } from "./rotationContext.js";
-function assertContainerCreatePlanInput(input) {
-    if (input.containerKey.byteLength !== 32) {
-        throw new Error("Container KEK material must be 32 bytes");
-    }
-    // The child container's organization is derived from the parent projection
-    // (see buildContainerCreatePlan), so it always matches the parent by
-    // construction — a member writing under another org's shared root is the
-    // expected case, not an error. The author supplies only the signer identity.
-}
-function buildContainerCreateRequest(input) {
-    return {
-        ...containerMutationRequestCore("create", {
-            ...input,
-            userRecipientKeys: [],
-        }),
-        previousManifestRef: null,
-        parentContainerPathRefs: input.parentProjection.path.map(containerManifestRef),
-        predecessorBridge: null,
-        keyring: null,
-        parentKekState: readCanonicalRecord(input.parentKek, "Container create parent KEK state"),
-    };
-}
-async function resolveContainerCreatePlanContext(input) {
-    assertContainerCreatePlanInput(input);
-    assertContainerKekPathCurrent(input.parentProjection.containerKeks);
-    const containerId = input.containerId ?? crypto.randomUUID();
-    return {
-        ...input,
-        containerId,
-        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
-            containerId,
-            keyMaterial: input.containerKey,
-        }),
-        containerKeyEpochId: await resolveContainerKekEpochId({
-            containerId,
-            keyEpoch: 1,
-            keyMaterial: input.containerKey,
-            override: input.containerKeyEpochId,
-        }),
-        eventId: input.eventId ?? crypto.randomUUID(),
-        metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),
-        parent: getParentCreateContext(input.parentProjection),
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    };
-}
-function buildChildContainerCreateBody(context, managedGrant) {
-    const baseBody = buildContainerCreateBody({
-        systemSlot: context.systemSlot ?? null,
-        containerKeyEpochId: context.containerKeyEpochId,
-        containerKeyPublicKey: context.containerKeyPublicKey,
-        metadataDocumentId: context.metadataDocumentId,
-        parentContainerId: context.parentProjection.containerId,
-        parentManifestHash: context.parent.manifest.manifestHash,
-    });
-    if (!managedGrant) {
-        return baseBody;
-    }
-    return {
-        ...baseBody,
-        directGrants: [
-            {
-                accessLevel: managedGrant.accessLevel,
-                subjectId: managedGrant.principalHead.principalId,
-                subjectType: managedGrant.principalHead.principalType,
-            },
-        ],
-        referencedPrincipalHeads: [managedGrant.principalHead],
-    };
-}
-// A managed-principal grant adds a second recipient: the group/organization key
-// wrap alongside the parent-inheritance wrap. The server derives both targets
-// (parent inheritance + directGrant) and requires exactly one wrap each; target
-// order is irrelevant since the key-target hash is normalized.
-async function buildChildContainerWrapsAndTargets(input) {
-    const { context, managedGrant, manifestHash } = input;
-    const parentPublicKey = readContainerState(context.parent.manifest).containerKeyPublicKey;
-    if (!parentPublicKey)
-        throw new Error("Container parent wrapping public key is missing");
-    const parentWrap = await wrapContainerKeyToParent({
-        containerKey: context.containerKey,
-        containerKeyEpochId: context.containerKeyEpochId,
-        manifestHash,
-        parentKek: context.parent.kek,
-        parentPublicKey,
-    });
-    const parentTargets = buildParentRecipientTargets(context.parent.kek);
-    if (!managedGrant) {
-        return { recipientTargets: parentTargets, wraps: [parentWrap] };
-    }
-    const managedRecipient = await wrapContainerKeyToManagedPrincipal({
-        containerKey: context.containerKey,
-        containerKeyEpochId: context.containerKeyEpochId,
-        manifestHash,
-        principalEncapsulationPublicKey: managedGrant.principalEncapsulationPublicKey,
-        principalHead: managedGrant.principalHead,
-    });
-    return {
-        recipientTargets: [...parentTargets, managedRecipient.recipientTarget],
-        wraps: [parentWrap, managedRecipient.wrap],
-    };
-}
-export async function buildContainerCreatePlan(input) {
-    const context = await resolveContainerCreatePlanContext(input);
-    const parentContainerId = context.parentProjection.containerId;
-    const parentManifestHash = context.parent.manifest.manifestHash;
-    const managedGrant = input.managedPrincipalGrant;
-    const body = buildChildContainerCreateBody(context, managedGrant);
-    // The new container belongs to the parent's organization, not the author's.
-    // A member writing under another org's shared root mints a container owned by
-    // that org; the author only supplies the signer identity.
-    const organizationId = context.parentProjection.organizationId;
-    const { event, eventHash } = await signContainerCreateEvent({
-        author: context.author,
-        body,
-        containerId: context.containerId,
-        eventId: context.eventId,
-        organizationId,
-        parentPath: context.parentProjection.path,
-        signedAt: context.signedAt,
-    });
-    const { manifest, manifestHash, state } = await deriveContainerCreateManifest({
-        systemSlot: context.systemSlot ?? null,
-        containerId: context.containerId,
-        containerKeyEpochId: context.containerKeyEpochId,
-        containerKeyPublicKey: context.containerKeyPublicKey,
-        directGrants: body.directGrants,
-        eventHash,
-        metadataDocumentId: context.metadataDocumentId,
-        organizationId,
-        parentContainerId,
-        parentManifestHash,
-        referencedPrincipalHeads: body.referencedPrincipalHeads,
-    });
-    const keyEpoch = buildContainerCreateKeyEpoch({
-        containerId: context.containerId,
-        containerKeyEpochId: context.containerKeyEpochId,
-        eventHash,
-        manifestHash,
-        parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,
-    });
-    const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({
-        context,
-        managedGrant,
-        manifestHash,
-    });
-    const keyTargetHash = await computeContainerKekRecipientTargetHash(recipientTargets);
-    const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);
-    return {
-        body,
-        containerId: context.containerId,
-        containerKeyEpochId: context.containerKeyEpochId,
-        event,
-        eventHash,
-        keyEpoch,
-        keyEpochHash,
-        keyTargetHash,
-        manifest,
-        manifestHash,
-        metadataDocumentId: context.metadataDocumentId,
-        parentContainerId,
-        parentManifestHash,
-        recipientTargets,
-        request: buildContainerCreateRequest({
-            body,
-            event,
-            keyEpoch,
-            manifest,
-            manifestHash,
-            parentKek: context.parent.kek,
-            parentProjection: context.parentProjection,
-            principalPolicies: context.principalPolicies ?? [],
-            wraps,
-        }),
-        state,
-        wraps,
-    };
-}
-export async function buildMaterializedContainerCreatePlan(input) {
-    const containerKey = input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));
-    const parentKeksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        projection: input.parentProjection,
-        secretKey: input.parentSecretKey,
-        ...projectionVerificationOptions(input),
-    });
-    const parent = getParentCreateContext(input.parentProjection);
-    requireUnwrappedKek(parentKeksByEpochId, parent.kek, "Container parent");
-    // Checked on the path verification just accepted, never on the raw response.
-    assertContainerChildPathFits(input.parentProjection.path);
-    const principalPolicies = input.resolveProjectionUserKey
-        ? await collectContainerWriterProjectionPrincipalPolicies({
-            execSql: input.execSql,
-            projection: input.parentProjection,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        })
-        : [];
-    if (input.resolveProjectionUserKey) {
-        assertContainerAuthorAccess({
-            author: {
-                ...input.author,
-                organizationId: input.parentProjection.organizationId,
-            },
-            projection: input.parentProjection,
-            principalPolicies,
-            minimumAccess: input.systemSlot ? "admin" : "write",
-        });
-    }
-    const plan = await buildContainerCreatePlan({
-        author: input.author,
-        containerId: input.containerId,
-        containerKey,
-        containerKeyEpochId: input.containerKeyEpochId,
-        eventId: input.eventId,
-        managedPrincipalGrant: input.managedPrincipalGrant,
-        metadataDocumentId: input.metadataDocumentId,
-        systemSlot: input.systemSlot,
-        parentProjection: input.parentProjection,
-        principalPolicies,
-        signedAt: input.signedAt,
-    });
-    return {
-        containerKey,
-        plan,
-    };
-}
-export { childContainerWriterProjectionFromCreatePlan } from "./createProjection.js";
-async function createRemoteContainerWithRepairs(input) {
-    let parentProjection = input.parentProjection;
-    const repairState = {
-        didRepairStaleParent: false,
-        policyRepairs: new PrincipalPolicyRepairBudget(),
-    };
-    for (;;) {
-        const materializedPlan = await buildMaterializedContainerCreatePlan({
-            author: input.request.author,
-            containerId: input.containerId,
-            containerKey: input.containerKey,
-            containerKeyEpochId: input.request.containerKeyEpochId,
-            eventId: input.eventId,
-            execSql: input.request.execSql,
-            metadataDocumentId: input.metadataDocumentId,
-            parentProjection,
-            parentSecretKey: input.request.parentSecretKey,
-            resolveProjectionUserKey: input.resolveProjectionUserKey,
-            signedAt: input.signedAt,
-            stillCurrent: input.request.stillCurrent,
-            warmReferencedPrincipalPolicies: input.request.warmReferencedPrincipalPolicies,
-        });
-        const submitted = await submitRemoteContainerCreate({
-            apiClient: input.request.apiClient,
-            plan: materializedPlan.plan,
-            stillCurrent: input.request.stillCurrent,
-        });
-        if (!submitted)
-            return null;
-        if (!submitted.ok) {
-            const repair = await repairContainerCreateFailure({
-                apiClient: input.request.apiClient,
-                failure: submitted,
-                parentContainerId: input.request.parentContainerId,
-                parentProjection,
-                state: repairState,
-                warmReferencedPrincipalPolicies: input.request.warmReferencedPrincipalPolicies,
-                stillCurrent: input.request.stillCurrent,
-            });
-            if (repair.kind === "retry") {
-                parentProjection = repair.parentProjection;
-                continue;
-            }
-            if (repair.kind === "unavailable") {
-                return null;
-            }
-            submitted.report();
-            return null;
-        }
-        const acknowledged = await acknowledgeContainerMutation({
-            execSql: input.request.execSql,
-            plan: materializedPlan.plan,
-            response: submitted.response,
-            stillCurrent: input.request.stillCurrent,
-        });
-        return {
-            acknowledged,
-            result: {
-                containerKey: materializedPlan.containerKey,
-                containerId: submitted.response.containerId,
-                metadataDocumentId: materializedPlan.plan.metadataDocumentId,
-                plan: materializedPlan.plan,
-                response: submitted.response,
-            },
-        };
-    }
-}
-async function createRemoteContainerOutcome(input) {
-    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container create");
-    const parentProjection = input.parentProjection ??
-        (await input.apiClient.getContainerWriterProjection(input.parentContainerId));
-    if (!parentProjection) {
-        return null;
-    }
-    return nullOnProjectionVerificationCancellation(() => createRemoteContainerWithRepairs({
-        containerId: input.containerId ?? crypto.randomUUID(),
-        containerKey: input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),
-        eventId: input.eventId ?? crypto.randomUUID(),
-        metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),
-        parentProjection,
-        request: input,
-        resolveProjectionUserKey,
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    }));
-}
-export async function createRemoteContainer(input) {
-    const outcome = await createRemoteContainerOutcome(input);
-    return outcome?.acknowledged && input.stillCurrent?.() !== false
-        ? outcome.result
-        : null;
-}
-//# sourceMappingURL=create.js.map

package/workflows/containers/child/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAKzE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerCreateAccessEventBody,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n  buildContainerCreateBody,\n  buildContainerCreateKeyEpoch,\n  buildParentRecipientTargets,\n  deriveContainerCreateManifest,\n  resolveContainerKekEpochId,\n  signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n  containerManifestRef,\n  getParentCreateContext,\n  readContainerState,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  BuildContainerCreatePlanInput,\n  ContainerCreatePlan,\n  ContainerCreatePlanContext,\n  ContainerMutationAuthor,\n  CreateRemoteContainerResult,\n  MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n  type ContainerCreateRepairState,\n  type RemoteContainerCreateInput,\n  repairContainerCreateFailure,\n  submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n  containerKey: Uint8Array;\n}): void {\n  if (input.containerKey.byteLength !== 32) {\n    throw new Error(\"Container KEK material must be 32 bytes\");\n  }\n  // The child container's organization is derived from the parent projection\n  // (see buildContainerCreatePlan), so it always matches the parent by\n  // construction — a member writing under another org's shared root is the\n  // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n  body: ContainerCreateAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse;\n  parentProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"create\", {\n      ...input,\n      userRecipientKeys: [],\n    }),\n    previousManifestRef: null,\n    parentContainerPathRefs:\n      input.parentProjection.path.map(containerManifestRef),\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecord(\n      input.parentKek,\n      \"Container create parent KEK state\",\n    ),\n  };\n}\n\nasync function resolveContainerCreatePlanContext(\n  input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n  assertContainerCreatePlanInput(input);\n  assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n  const containerId = input.containerId ?? crypto.randomUUID();\n\n  return {\n    ...input,\n    containerId,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId,\n      keyMaterial: input.containerKey,\n    }),\n    containerKeyEpochId: await resolveContainerKekEpochId({\n      containerId,\n      keyEpoch: 1,\n      keyMaterial: input.containerKey,\n      override: input.containerKeyEpochId,\n    }),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n    parent: getParentCreateContext(input.parentProjection),\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n}\n\nfunction buildChildContainerCreateBody(\n  context: ContainerCreatePlanContext,\n  managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n  const baseBody = buildContainerCreateBody({\n    systemSlot: context.systemSlot ?? null,\n    containerKeyEpochId: context.containerKeyEpochId,\n    containerKeyPublicKey: context.containerKeyPublicKey,\n    metadataDocumentId: context.metadataDocumentId,\n    parentContainerId: context.parentProjection.containerId,\n    parentManifestHash: context.parent.manifest.manifestHash,\n  });\n  if (!managedGrant) {\n    return baseBody;\n  }\n  return {\n    ...baseBody,\n    directGrants: [\n      {\n        accessLevel: managedGrant.accessLevel,\n        subjectId: managedGrant.principalHead.principalId,\n        subjectType: managedGrant.principalHead.principalType,\n      },\n    ],\n    referencedPrincipalHeads: [managedGrant.principalHead],\n  };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n  context: ContainerCreatePlanContext;\n  managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n  manifestHash: string;\n}): Promise<{\n  recipientTargets: ContainerKekRecipientTarget[];\n  wraps: ContainerKeyWrap[];\n}> {\n  const { context, managedGrant, manifestHash } = input;\n  const parentPublicKey = readContainerState(\n    context.parent.manifest,\n  ).containerKeyPublicKey;\n  if (!parentPublicKey)\n    throw new Error(\"Container parent wrapping public key is missing\");\n  const parentWrap = await wrapContainerKeyToParent({\n    containerKey: context.containerKey,\n    containerKeyEpochId: context.containerKeyEpochId,\n    manifestHash,\n    parentKek: context.parent.kek,\n    parentPublicKey,\n  });\n  const parentTargets = buildParentRecipientTargets(context.parent.kek);\n  if (!managedGrant) {\n    return { recipientTargets: parentTargets, wraps: [parentWrap] };\n  }\n  const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: context.containerKey,\n    containerKeyEpochId: context.containerKeyEpochId,\n    manifestHash,\n    principalEncapsulationPublicKey:\n      managedGrant.principalEncapsulationPublicKey,\n    principalHead: managedGrant.principalHead,\n  });\n  return {\n    recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n    wraps: [parentWrap, managedRecipient.wrap],\n  };\n}\n\nexport async function buildContainerCreatePlan(\n  input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n  const context = await resolveContainerCreatePlanContext(input);\n  const parentContainerId = context.parentProjection.containerId;\n  const parentManifestHash = context.parent.manifest.manifestHash;\n  const managedGrant = input.managedPrincipalGrant;\n  const body = buildChildContainerCreateBody(context, managedGrant);\n  // The new container belongs to the parent's organization, not the author's.\n  // A member writing under another org's shared root mints a container owned by\n  // that org; the author only supplies the signer identity.\n  const organizationId = context.parentProjection.organizationId;\n  const { event, eventHash } = await signContainerCreateEvent({\n    author: context.author,\n    body,\n    containerId: context.containerId,\n    eventId: context.eventId,\n    organizationId,\n    parentPath: context.parentProjection.path,\n    signedAt: context.signedAt,\n  });\n  const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n    {\n      systemSlot: context.systemSlot ?? null,\n      containerId: context.containerId,\n      containerKeyEpochId: context.containerKeyEpochId,\n      containerKeyPublicKey: context.containerKeyPublicKey,\n      directGrants: body.directGrants,\n      eventHash,\n      metadataDocumentId: context.metadataDocumentId,\n      organizationId,\n      parentContainerId,\n      parentManifestHash,\n      referencedPrincipalHeads: body.referencedPrincipalHeads,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: context.containerId,\n    containerKeyEpochId: context.containerKeyEpochId,\n    eventHash,\n    manifestHash,\n    parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n  });\n  const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n    context,\n    managedGrant,\n    manifestHash,\n  });\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  return {\n    body,\n    containerId: context.containerId,\n    containerKeyEpochId: context.containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyEpochHash,\n    keyTargetHash,\n    manifest,\n    manifestHash,\n    metadataDocumentId: context.metadataDocumentId,\n    parentContainerId,\n    parentManifestHash,\n    recipientTargets,\n    request: buildContainerCreateRequest({\n      body,\n      event,\n      keyEpoch,\n      manifest,\n      manifestHash,\n      parentKek: context.parent.kek,\n      parentProjection: context.parentProjection,\n      principalPolicies: context.principalPolicies ?? [],\n      wraps,\n    }),\n    state,\n    wraps,\n  };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n  input: {\n    author: ContainerMutationAuthor;\n    containerId?: string | undefined;\n    containerKey?: Uint8Array | undefined;\n    containerKeyEpochId?: string | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n    metadataDocumentId?: string | undefined;\n    systemSlot?: string | null | undefined;\n    parentProjection: ContainerWriterProjectionResponse;\n    parentSecretKey: Uint8Array;\n    signedAt?: string | undefined;\n    // Fetches the parent path's referenced principal policies on demand when\n    // they are not cached locally — lets a member create under another org's\n    // shared root without having first hydrated that org's group policy.\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n  const containerKey =\n    input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n  const parentKeksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.parentProjection,\n    secretKey: input.parentSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const parent = getParentCreateContext(input.parentProjection);\n  requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n  // Checked on the path verification just accepted, never on the raw response.\n  assertContainerChildPathFits(input.parentProjection.path);\n  const principalPolicies = input.resolveProjectionUserKey\n    ? await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        projection: input.parentProjection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      })\n    : [];\n  if (input.resolveProjectionUserKey) {\n    assertContainerAuthorAccess({\n      author: {\n        ...input.author,\n        organizationId: input.parentProjection.organizationId,\n      },\n      projection: input.parentProjection,\n      principalPolicies,\n      minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n    });\n  }\n  const plan = await buildContainerCreatePlan({\n    author: input.author,\n    containerId: input.containerId,\n    containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventId: input.eventId,\n    managedPrincipalGrant: input.managedPrincipalGrant,\n    metadataDocumentId: input.metadataDocumentId,\n    systemSlot: input.systemSlot,\n    parentProjection: input.parentProjection,\n    principalPolicies,\n    signedAt: input.signedAt,\n  });\n\n  return {\n    containerKey,\n    plan,\n  };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n  readonly containerId: string;\n  readonly containerKey: Uint8Array;\n  readonly eventId: string;\n  readonly metadataDocumentId: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly request: RemoteContainerCreateInput;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly signedAt: string;\n}): Promise<{\n  readonly acknowledged: boolean;\n  readonly result: CreateRemoteContainerResult;\n} | null> {\n  let parentProjection = input.parentProjection;\n  const repairState: ContainerCreateRepairState = {\n    didRepairStaleParent: false,\n    policyRepairs: new PrincipalPolicyRepairBudget(),\n  };\n  for (;;) {\n    const materializedPlan = await buildMaterializedContainerCreatePlan({\n      author: input.request.author,\n      containerId: input.containerId,\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.request.containerKeyEpochId,\n      eventId: input.eventId,\n      execSql: input.request.execSql,\n      metadataDocumentId: input.metadataDocumentId,\n      parentProjection,\n      parentSecretKey: input.request.parentSecretKey,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      signedAt: input.signedAt,\n      stillCurrent: input.request.stillCurrent,\n      warmReferencedPrincipalPolicies:\n        input.request.warmReferencedPrincipalPolicies,\n    });\n    const submitted = await submitRemoteContainerCreate({\n      apiClient: input.request.apiClient,\n      plan: materializedPlan.plan,\n      stillCurrent: input.request.stillCurrent,\n    });\n    if (!submitted) return null;\n    if (!submitted.ok) {\n      const repair = await repairContainerCreateFailure({\n        apiClient: input.request.apiClient,\n        failure: submitted,\n        parentContainerId: input.request.parentContainerId,\n        parentProjection,\n        state: repairState,\n        warmReferencedPrincipalPolicies:\n          input.request.warmReferencedPrincipalPolicies,\n        stillCurrent: input.request.stillCurrent,\n      });\n      if (repair.kind === \"retry\") {\n        parentProjection = repair.parentProjection;\n        continue;\n      }\n      if (repair.kind === \"unavailable\") {\n        return null;\n      }\n      submitted.report();\n      return null;\n    }\n    const acknowledged = await acknowledgeContainerMutation({\n      execSql: input.request.execSql,\n      plan: materializedPlan.plan,\n      response: submitted.response,\n      stillCurrent: input.request.stillCurrent,\n    });\n    return {\n      acknowledged,\n      result: {\n        containerKey: materializedPlan.containerKey,\n        containerId: submitted.response.containerId,\n        metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n        plan: materializedPlan.plan,\n        response: submitted.response,\n      },\n    };\n  }\n}\n\nasync function createRemoteContainerOutcome(\n  input: RemoteContainerCreateInput,\n): Promise<{\n  readonly acknowledged: boolean;\n  readonly result: CreateRemoteContainerResult;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container create\",\n  );\n  const parentProjection =\n    input.parentProjection ??\n    (await input.apiClient.getContainerWriterProjection(\n      input.parentContainerId,\n    ));\n  if (!parentProjection) {\n    return null;\n  }\n  return nullOnProjectionVerificationCancellation(() =>\n    createRemoteContainerWithRepairs({\n      containerId: input.containerId ?? crypto.randomUUID(),\n      containerKey:\n        input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n      eventId: input.eventId ?? crypto.randomUUID(),\n      metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n      parentProjection,\n      request: input,\n      resolveProjectionUserKey,\n      signedAt: input.signedAt ?? new Date().toISOString(),\n    }),\n  );\n}\n\nexport async function createRemoteContainer(\n  input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult | null> {\n  const outcome = await createRemoteContainerOutcome(input);\n  return outcome?.acknowledged && input.stillCurrent?.() !== false\n    ? outcome.result\n    : null;\n}\n"]}

package/workflows/containers/child/createProjection.d.ts

@@ -1,6 +0,0 @@
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { MaterializedContainerCreatePlan } from "../../../data/containers/shared/types.js";
-export declare function childContainerWriterProjectionFromCreatePlan(input: {
-    materializedPlan: MaterializedContainerCreatePlan;
-    parentProjection: ContainerWriterProjectionResponse;
-}): ContainerWriterProjectionResponse;

package/workflows/containers/child/createProjection.js

@@ -1,43 +0,0 @@
-import { getParentCreateContext } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
-export function childContainerWriterProjectionFromCreatePlan(input) {
-    const { materializedPlan, parentProjection } = input;
-    const { plan } = materializedPlan;
-    const parentKek = getParentCreateContext(parentProjection).kek;
-    return {
-        policyEvidence: parentProjection.policyEvidence,
-        containerId: plan.containerId,
-        organizationId: plan.state.organizationId,
-        path: [
-            ...parentProjection.path,
-            {
-                event: {
-                    event: readCanonicalRecord(plan.event, "Container child event"),
-                    body: readCanonicalRecord(plan.body, "Container child body"),
-                    eventHash: plan.eventHash,
-                },
-                manifest: readCanonicalRecord(plan.manifest, "Container child manifest"),
-                manifestHash: plan.manifestHash,
-                state: readCanonicalRecord(plan.state, "Container child state"),
-            },
-        ],
-        containerKeks: [
-            ...parentProjection.containerKeks,
-            {
-                containerId: plan.containerId,
-                accessManifestHash: plan.manifestHash,
-                containerKeyEpochId: plan.containerKeyEpochId,
-                containerKeyEpoch: plan.keyEpoch.keyEpoch,
-                keyEpoch: readCanonicalRecord(plan.keyEpoch, "Container child key epoch"),
-                keyEpochHash: plan.keyEpochHash,
-                keyTargetHash: plan.keyTargetHash,
-                containerManifestHistory: [],
-                parentContainerKeyEpochId: parentKek.containerKeyEpochId,
-                keyring: null,
-                recipientTargets: readCanonicalRecords(plan.recipientTargets, "Container child recipient targets"),
-                wraps: readCanonicalRecords(plan.wraps, "Container child wraps"),
-            },
-        ],
-    };
-}
-//# sourceMappingURL=createProjection.js.map

package/workflows/containers/child/createProjection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createProjection.js","sourceRoot":"","sources":["createProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,UAAU,4CAA4C,CAAC,KAG5D;IACC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC;IAE/D,OAAO;QACL,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI;YACxB;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,gBAAgB,CAAC,aAAa;YACjC;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,2BAA2B,CAC5B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,SAAS,CAAC,mBAAmB;gBACxD,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,mCAAmC,CACpC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { getParentCreateContext } from \"../../../data/containers/shared/projection\";\nimport type { MaterializedContainerCreatePlan } from \"../../../data/containers/shared/types\";\nimport {\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\n\nexport function childContainerWriterProjectionFromCreatePlan(input: {\n  materializedPlan: MaterializedContainerCreatePlan;\n  parentProjection: ContainerWriterProjectionResponse;\n}): ContainerWriterProjectionResponse {\n  const { materializedPlan, parentProjection } = input;\n  const { plan } = materializedPlan;\n  const parentKek = getParentCreateContext(parentProjection).kek;\n\n  return {\n    policyEvidence: parentProjection.policyEvidence,\n    containerId: plan.containerId,\n    organizationId: plan.state.organizationId,\n    path: [\n      ...parentProjection.path,\n      {\n        event: {\n          event: readCanonicalRecord(plan.event, \"Container child event\"),\n          body: readCanonicalRecord(plan.body, \"Container child body\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(\n          plan.manifest,\n          \"Container child manifest\",\n        ),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container child state\"),\n      },\n    ],\n    containerKeks: [\n      ...parentProjection.containerKeks,\n      {\n        containerId: plan.containerId,\n        accessManifestHash: plan.manifestHash,\n        containerKeyEpochId: plan.containerKeyEpochId,\n        containerKeyEpoch: plan.keyEpoch.keyEpoch,\n        keyEpoch: readCanonicalRecord(\n          plan.keyEpoch,\n          \"Container child key epoch\",\n        ),\n        keyEpochHash: plan.keyEpochHash,\n        keyTargetHash: plan.keyTargetHash,\n        containerManifestHistory: [],\n        parentContainerKeyEpochId: parentKek.containerKeyEpochId,\n        keyring: null,\n        recipientTargets: readCanonicalRecords(\n          plan.recipientTargets,\n          \"Container child recipient targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container child wraps\"),\n      },\n    ],\n  };\n}\n"]}

package/workflows/containers/child/createSubmission.d.ts

@@ -1,56 +0,0 @@
-import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerCreateApi, ContainerCreatePlan, ContainerMutationAuthor, ContainerMutationSubmitFailure } from "../../../data/containers/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
-import type { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
-export interface ContainerCreateRepairState {
-    didRepairStaleParent: boolean;
-    policyRepairs: PrincipalPolicyRepairBudget;
-}
-export interface RemoteContainerCreateInput {
-    apiClient: ContainerCreateApi;
-    author: ContainerMutationAuthor;
-    containerId?: string | undefined;
-    containerKey?: Uint8Array | undefined;
-    containerKeyEpochId?: string | undefined;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    metadataDocumentId?: string | undefined;
-    parentContainerId: string;
-    parentProjection?: ContainerWriterProjectionResponse | undefined;
-    parentSecretKey: Uint8Array;
-    reportSecurityIncident: SecurityIncidentReporter;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}
-type ContainerCreateFailureRepair = {
-    readonly kind: "none";
-} | {
-    readonly kind: "unavailable";
-} | {
-    readonly kind: "retry";
-    readonly parentProjection: ContainerWriterProjectionResponse;
-};
-export declare function submitRemoteContainerCreate(input: {
-    readonly apiClient: ContainerCreateApi;
-    readonly plan: ContainerCreatePlan;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<{
-    readonly ok: true;
-    readonly response: ContainerMutationResponse;
-} | ContainerMutationSubmitFailure | null>;
-export declare function repairContainerCreateFailure(input: {
-    readonly apiClient: ContainerCreateApi;
-    readonly failure: ContainerMutationSubmitFailure;
-    readonly parentContainerId: string;
-    readonly parentProjection: ContainerWriterProjectionResponse;
-    readonly state: ContainerCreateRepairState;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<ContainerCreateFailureRepair>;
-export {};

package/workflows/containers/child/createSubmission.js

@@ -1,43 +0,0 @@
-import { isStaleParentContainerPathFailure } from "../../../data/containers/shared/mutationFailures.js";
-import { recoverPrincipalPolicyRepair } from "../../principals/policyRepair.js";
-export async function submitRemoteContainerCreate(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    const result = await input.apiClient.createContainerResult(input.plan.request, {
-        expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,
-        reportErrors: false,
-    });
-    return result.ok ? { ok: true, response: result.data } : result;
-}
-export async function repairContainerCreateFailure(input) {
-    if (input.stillCurrent?.() === false) {
-        return { kind: "unavailable" };
-    }
-    const repairedPolicy = input.state.policyRepairs.take(input.failure.stalePrincipalHeads) &&
-        (await recoverPrincipalPolicyRepair({
-            heads: input.failure.stalePrincipalHeads,
-            organizationId: input.parentProjection.organizationId,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-            stillCurrent: input.stillCurrent,
-        }));
-    if (input.stillCurrent?.() === false) {
-        return { kind: "unavailable" };
-    }
-    if (!repairedPolicy) {
-        if (input.state.didRepairStaleParent ||
-            !isStaleParentContainerPathFailure(input.failure))
-            return { kind: "none" };
-        input.state.didRepairStaleParent = true;
-    }
-    // Recovery may select newer policies. Rebuild against a fresh public evidence
-    // source so the old projection cannot conflict with newly admitted pins.
-    input.apiClient.evictContainerWriterProjection(input.parentContainerId);
-    const parentProjection = await input.apiClient.getContainerWriterProjection(input.parentContainerId);
-    if (input.stillCurrent?.() === false) {
-        return { kind: "unavailable" };
-    }
-    return parentProjection
-        ? { kind: "retry", parentProjection }
-        : { kind: "unavailable" };
-}
-//# sourceMappingURL=createSubmission.js.map

package/workflows/containers/child/createSubmission.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createSubmission.js","sourceRoot":"","sources":["createSubmission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AAcrG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAoC7E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CACxD,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;QACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACtE,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACjE,CAAC,MAAM,4BAA4B,CAAC;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACxC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;YACrD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;YAChC,CAAC,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;YAEjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACzE,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isStaleParentContainerPathFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n  ContainerCreateApi,\n  ContainerCreatePlan,\n  ContainerMutationAuthor,\n  ContainerMutationSubmitFailure,\n} from \"../../../data/containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { recoverPrincipalPolicyRepair } from \"../../principals/policyRepair\";\nimport type { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\n\nexport interface ContainerCreateRepairState {\n  didRepairStaleParent: boolean;\n  policyRepairs: PrincipalPolicyRepairBudget;\n}\n\nexport interface RemoteContainerCreateInput {\n  apiClient: ContainerCreateApi;\n  author: ContainerMutationAuthor;\n  containerId?: string | undefined;\n  containerKey?: Uint8Array | undefined;\n  containerKeyEpochId?: string | undefined;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  metadataDocumentId?: string | undefined;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  parentSecretKey: Uint8Array;\n  reportSecurityIncident: SecurityIncidentReporter;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ntype ContainerCreateFailureRepair =\n  | { readonly kind: \"none\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly kind: \"retry\";\n      readonly parentProjection: ContainerWriterProjectionResponse;\n    };\n\nexport async function submitRemoteContainerCreate(input: {\n  readonly apiClient: ContainerCreateApi;\n  readonly plan: ContainerCreatePlan;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | {\n      readonly ok: true;\n      readonly response: ContainerMutationResponse;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const result = await input.apiClient.createContainerResult(\n    input.plan.request,\n    {\n      expectedPaymentRequiredOrganizationId: input.plan.state.organizationId,\n      reportErrors: false,\n    },\n  );\n  return result.ok ? { ok: true, response: result.data } : result;\n}\n\nexport async function repairContainerCreateFailure(input: {\n  readonly apiClient: ContainerCreateApi;\n  readonly failure: ContainerMutationSubmitFailure;\n  readonly parentContainerId: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly state: ContainerCreateRepairState;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<ContainerCreateFailureRepair> {\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  const repairedPolicy =\n    input.state.policyRepairs.take(input.failure.stalePrincipalHeads) &&\n    (await recoverPrincipalPolicyRepair({\n      heads: input.failure.stalePrincipalHeads,\n      organizationId: input.parentProjection.organizationId,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      stillCurrent: input.stillCurrent,\n    }));\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  if (!repairedPolicy) {\n    if (\n      input.state.didRepairStaleParent ||\n      !isStaleParentContainerPathFailure(input.failure)\n    )\n      return { kind: \"none\" };\n    input.state.didRepairStaleParent = true;\n  }\n  // Recovery may select newer policies. Rebuild against a fresh public evidence\n  // source so the old projection cannot conflict with newly admitted pins.\n  input.apiClient.evictContainerWriterProjection(input.parentContainerId);\n  const parentProjection = await input.apiClient.getContainerWriterProjection(\n    input.parentContainerId,\n  );\n  if (input.stillCurrent?.() === false) {\n    return { kind: \"unavailable\" };\n  }\n  return parentProjection\n    ? { kind: \"retry\", parentProjection }\n    : { kind: \"unavailable\" };\n}\n"]}