@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/currentShareGrantMutation.js

@@ -1,82 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { commitCurrentGroupPolicyMutation } from "../../organizations/commitCurrentGroupPolicyMutation.js";
-import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
-import { buildSetGroupContainerGrantPolicyRequest } from "../../organizations/groupPolicyRequests.js";
-import { preparePrincipalContainerRematerializationBatch, } from "../../organizations/principalContainerRematerialization.js";
-import { groupPolicyNameMismatch } from "../../organizations/principalPolicyRequest.js";
-import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
-/** Fresh mutation authority rechecks the chosen name before authoring a grant. */
-export async function commitCurrentShareGrant(input) {
-    const share = input.share;
-    const expectedName = share.expectedGroupName;
-    if (expectedName === null)
-        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
-    const signingKeyPair = share.signingKeyPair;
-    if (!signingKeyPair)
-        throw new Error("Container group share requires principal policy signing context");
-    return input.mutate({
-        groupId: share.recipientGroupId,
-        organizationId: share.author.organizationId,
-        signerUserId: share.author.signerUserId,
-        stillCurrent: share.stillCurrent ?? (() => true),
-    }, async (context) => {
-        await assertCurrentShareGrantName(input.runtime, share, context, expectedName);
-        const request = await buildSetGroupContainerGrantPolicyRequest({
-            ...context,
-            accessLevel: share.accessLevel,
-            containerId: share.containerId,
-            signerUserId: share.author.signerUserId,
-            signingFingerprint: share.author.signerKeyFingerprint,
-            signingKeyPair,
-        });
-        const prepared = {};
-        const response = await commitCurrentGroupPolicyMutation({
-            apiClient: share.apiClient,
-            context,
-            groupId: share.recipientGroupId,
-            organizationId: share.author.organizationId,
-            request,
-            signerUserId: share.author.signerUserId,
-            signingFingerprint: share.author.signerKeyFingerprint,
-            signingKeyPair,
-            resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,
-            prepareContainerMutations: async (nextPolicy) => {
-                prepared.batch = await prepareCurrentShareGrantBatch(share, context, nextPolicy, input.recitationStillCurrent);
-                return prepared.batch;
-            },
-        });
-        const index = prepared.batch?.plans.findIndex((planned) => planned.plan.containerId === share.containerId) ?? -1;
-        const plan = prepared.batch?.plans[index];
-        const acknowledgement = response.containerMutations[index];
-        if (!plan || !acknowledgement || !isSharePlan(plan))
-            throw new Error("Container group share acknowledgement is incomplete");
-        return {
-            containerKey: plan.containerKey,
-            plan: plan.plan,
-            response: acknowledgement,
-        };
-    });
-}
-function isSharePlan(plan) {
-    return plan.plan.body.eventType === "container.grant";
-}
-async function assertCurrentShareGrantName(runtime, share, context, expectedName) {
-    const mismatch = await groupPolicyNameMismatch(context.currentPolicy, expectedName, createRuntimeGroupMetadataAccess(runtime, share.author.organizationId, context.stillCurrent, context.verifyMetadataContainer).readName);
-    if (mismatch)
-        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
-    assertProjectionVerificationCurrent(context.stillCurrent);
-}
-function prepareCurrentShareGrantBatch(share, context, nextPolicy, recitationStillCurrent) {
-    return preparePrincipalContainerRematerializationBatch({
-        ...share,
-        grants: [
-            ...new Map([...context.currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
-        ],
-        groupId: share.recipientGroupId,
-        nextPolicy,
-        resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,
-        stillCurrent: context.stillCurrent,
-        recitationStillCurrent,
-    });
-}
-//# sourceMappingURL=currentShareGrantMutation.js.map

package/workflows/containers/child/currentShareGrantMutation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAEL,+CAA+C,GAChD,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAOrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../organizations/commitCurrentGroupPolicyMutation\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../organizations/groupPolicyRequests\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../organizations/principalContainerRematerialization\";\nimport { groupPolicyNameMismatch } from \"../../organizations/principalPolicyRequest\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../organizations/runtimeCurrentGroupMutation\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./share\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}

package/workflows/containers/child/currentSharePrincipalPolicy.js

@@ -1,83 +0,0 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
-import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../organizations/currentGroupMetadataAuthority.js";
-import { loadCurrentOrganizationAuthority } from "../../organizations/currentOrganizationAuthority.js";
-import { createCurrentPrincipalMutationLease } from "../../organizations/currentPrincipalMutationLease.js";
-import { assertGroupMetadataBinding } from "../../organizations/groupMetadataBinding.js";
-import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
-import { groupPolicyNameMismatch, } from "../../organizations/principalPolicyRequest.js";
-import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
-/** A share read need not be a group administrator; minting a grant checks that separately. */
-export function createRuntimeCurrentSharePrincipalPolicy(runtime) {
-    const lease = createCurrentPrincipalMutationLease(runtime);
-    if (!lease)
-        return undefined;
-    return async (input, work) => {
-        input = {
-            ...input,
-            expectedGroupHead: input.expectedGroupHead
-                ? { ...input.expectedGroupHead }
-                : undefined,
-        };
-        return lease(input.stillCurrent, async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {
-            await runtime.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
-            assertProjectionVerificationCurrent(leaseCurrent);
-            const authority = await loadCurrentOrganizationAuthority({
-                execSql: runtime.infra.execSql,
-                organizationId: input.organizationId,
-                resolveCurrentPolicy,
-                stillCurrent: leaseCurrent,
-            });
-            const group = await authority.readGroup(input.groupId);
-            const stillCurrent = () => leaseCurrent() && authority.stillCurrent() && group.stillCurrent();
-            assertProjectionVerificationCurrent(stillCurrent);
-            if (input.expectedGroupHead &&
-                !principalHeadMatchesReference(group.policy.state, input.expectedGroupHead))
-                throw new KeyingVerificationError("object_mismatch", "Container share expected group head conflicts with the signed organization directory");
-            assertGroupMetadataBinding(group.current, authority.descriptor);
-            await assertCurrentShareName({
-                runtime,
-                input,
-                authority,
-                group,
-                stillCurrent,
-            });
-            assertProjectionVerificationCurrent(stillCurrent);
-            const checkpointPolicies = [...group.dependencies, group.policy];
-            await advanceKeyingCheckpointsAtomically({
-                access: [],
-                execSql: runtime.infra.execSql,
-                organizationId: input.organizationId,
-                policies: checkpointPolicies,
-                stillCurrent,
-            });
-            assertProjectionVerificationCurrent(stillCurrent);
-            const result = await work({
-                current: group.current,
-                policy: group.policy,
-                checkpointPolicies,
-                stillCurrent,
-            });
-            assertProjectionVerificationCurrent(stillCurrent);
-            return result;
-        });
-    };
-}
-async function assertCurrentShareName({ runtime, input, authority, group, stillCurrent, }) {
-    if (input.expectedGroupName === undefined)
-        return;
-    const readName = input.readEncryptedName ??
-        createRuntimeGroupMetadataAccess(runtime, input.organizationId, stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
-            authority,
-            organizationId: input.organizationId,
-            stillCurrent,
-        })).readName;
-    const mismatch = await groupPolicyNameMismatch(group.current, input.expectedGroupName, readName);
-    if (mismatch)
-        throw new GroupShareNameMismatchError(mismatch === "forbidden_characters"
-            ? "Container share group name contains control or format characters"
-            : "Container share group name does not match the signed group policy");
-}
-//# sourceMappingURL=currentSharePrincipalPolicy.js.map

package/workflows/containers/child/currentSharePrincipalPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentSharePrincipalPolicy.js","sourceRoot":"","sources":["currentSharePrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,mDAAmD,EAAE,MAAM,mDAAmD,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EAEL,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAoCrE,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA4B;IAE5B,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAwB,EACxB,IAAyD,EAC7C,EAAE;QACd,KAAK,GAAG;YACN,GAAG,KAAK;YACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBACxC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE;gBAChC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7D,MAAM,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACvD,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,oBAAoB;gBACpB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,CAAC,iBAAiB;gBACvB,CAAC,6BAA6B,CAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAClB,KAAK,CAAC,iBAAiB,CACxB;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;YACJ,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,SAAS;gBACT,KAAK;gBACL,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,SAAS,EACT,KAAK,EACL,YAAY,GAOb;IACC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB;QACvB,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,YAAY,EACZ,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,QAAQ,KAAK,sBAAsB;YACjC,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,mEAAmE,CACxE,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../organizations/currentGroupMetadataAuthority\";\nimport { loadCurrentOrganizationAuthority } from \"../../organizations/currentOrganizationAuthority\";\nimport { createCurrentPrincipalMutationLease } from \"../../organizations/currentPrincipalMutationLease\";\nimport { assertGroupMetadataBinding } from \"../../organizations/groupMetadataBinding\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport type { PrincipalMutationRecoveryApi } from \"../../organizations/principalMutationJournalManagement\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../organizations/principalPolicyRequest\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\ntype CurrentShareRuntime = Parameters<\n  typeof createRuntimeGroupMetadataAccess\n>[0] &\n  Parameters<typeof createCurrentPrincipalMutationLease>[0] & {\n    readonly apiClient: {\n      readonly recoverPendingPrincipalMutation?:\n        | PrincipalMutationRecoveryApi[\"recoverPendingPrincipalMutation\"]\n        | undefined;\n    };\n  };\n\ninterface CurrentShareInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  readonly expectedGroupName?: string | undefined;\n  /** Trusted internal reader; it must authenticate the signed metadata container. */\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\ntype CurrentGroup = Awaited<\n  ReturnType<\n    Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>[\"readGroup\"]\n  >\n>;\n\nexport interface CurrentSharePrincipalPolicy {\n  readonly current: CurrentGroup[\"current\"];\n  readonly policy: CurrentGroup[\"policy\"];\n  readonly checkpointPolicies: readonly CurrentGroup[\"policy\"][];\n  readonly stillCurrent: () => boolean;\n}\n\n/** A share read need not be a group administrator; minting a grant checks that separately. */\nexport function createRuntimeCurrentSharePrincipalPolicy(\n  runtime: CurrentShareRuntime,\n) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: CurrentShareInput,\n    work: (policy: CurrentSharePrincipalPolicy) => Promise<T>,\n  ): Promise<T> => {\n    input = {\n      ...input,\n      expectedGroupHead: input.expectedGroupHead\n        ? { ...input.expectedGroupHead }\n        : undefined,\n    };\n    return lease(\n      input.stillCurrent,\n      async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {\n        await runtime.apiClient.recoverPendingPrincipalMutation?.(\n          input.organizationId,\n        );\n        assertProjectionVerificationCurrent(leaseCurrent);\n        const authority = await loadCurrentOrganizationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          resolveCurrentPolicy,\n          stillCurrent: leaseCurrent,\n        });\n        const group = await authority.readGroup(input.groupId);\n        const stillCurrent = () =>\n          leaseCurrent() && authority.stillCurrent() && group.stillCurrent();\n        assertProjectionVerificationCurrent(stillCurrent);\n        if (\n          input.expectedGroupHead &&\n          !principalHeadMatchesReference(\n            group.policy.state,\n            input.expectedGroupHead,\n          )\n        )\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Container share expected group head conflicts with the signed organization directory\",\n          );\n        assertGroupMetadataBinding(group.current, authority.descriptor);\n        await assertCurrentShareName({\n          runtime,\n          input,\n          authority,\n          group,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const checkpointPolicies = [...group.dependencies, group.policy];\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          policies: checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          current: group.current,\n          policy: group.policy,\n          checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function assertCurrentShareName({\n  runtime,\n  input,\n  authority,\n  group,\n  stillCurrent,\n}: {\n  runtime: CurrentShareRuntime;\n  input: CurrentShareInput;\n  authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n  group: CurrentGroup;\n  stillCurrent: () => boolean;\n}) {\n  if (input.expectedGroupName === undefined) return;\n  const readName =\n    input.readEncryptedName ??\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      input.organizationId,\n      stillCurrent,\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    ).readName;\n  const mismatch = await groupPolicyNameMismatch(\n    group.current,\n    input.expectedGroupName,\n    readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      mismatch === \"forbidden_characters\"\n        ? \"Container share group name contains control or format characters\"\n        : \"Container share group name does not match the signed group policy\",\n    );\n}\n"]}

package/workflows/containers/child/keyringOverrideLineage.d.ts

@@ -1,22 +0,0 @@
-import { type ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-/**
- * A rebuilt keyring override that omits an epoch the container's signed
- * lineage names. That is what a rebuild made before a concurrent rotation
- * looks like, so it is not tampering: rebuild from the current log and retry.
- * It is deliberately not a `KeyingVerificationError`, which callers may read
- * as tampering, unlike an epoch outside the lineage, which no honest rebuild
- * names.
- */
-export declare class ContainerKeyringOverrideStaleError extends Error {
-    constructor();
-}
-/**
- * A rebuilt keyring override is sealed forward under this device's signature,
- * so it must name exactly the epochs the container's signed lineage commits to
- * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
- * verification walked it, wherever the projection served it: the target KEK's
- * own served history is not enough, since a server can serve the target's
- * older manifests under its parent's KEK, letting an invented id over
- * server-chosen material take the real epoch's ordinal.
- */
-export declare function assertOverrideMatchesSignedLineage(entries: readonly ContainerKekKeyringEntry[], signedEpochIds: ReadonlySet<string>): void;

package/workflows/containers/child/keyringOverrideLineage.js

@@ -1,39 +0,0 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-const LABEL = "Container rekey keyring override";
-/**
- * A rebuilt keyring override that omits an epoch the container's signed
- * lineage names. That is what a rebuild made before a concurrent rotation
- * looks like, so it is not tampering: rebuild from the current log and retry.
- * It is deliberately not a `KeyingVerificationError`, which callers may read
- * as tampering, unlike an epoch outside the lineage, which no honest rebuild
- * names.
- */
-export class ContainerKeyringOverrideStaleError extends Error {
-    constructor() {
-        super(`${LABEL} omits an epoch the container's signed lineage names; rebuild it from the current log`);
-        this.name = "ContainerKeyringOverrideStaleError";
-    }
-}
-/**
- * A rebuilt keyring override is sealed forward under this device's signature,
- * so it must name exactly the epochs the container's signed lineage commits to
- * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
- * verification walked it, wherever the projection served it: the target KEK's
- * own served history is not enough, since a server can serve the target's
- * older manifests under its parent's KEK, letting an invented id over
- * server-chosen material take the real epoch's ordinal.
- */
-export function assertOverrideMatchesSignedLineage(entries, signedEpochIds) {
-    const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));
-    for (const epochId of entryIds) {
-        if (!signedEpochIds.has(epochId)) {
-            throw new KeyingVerificationError("object_mismatch", `${LABEL} names an epoch outside the container's signed lineage`);
-        }
-    }
-    for (const epochId of signedEpochIds) {
-        if (!entryIds.has(epochId)) {
-            throw new ContainerKeyringOverrideStaleError();
-        }
-    }
-}
-//# sourceMappingURL=keyringOverrideLineage.js.map

package/workflows/containers/child/move.d.ts

@@ -1,23 +0,0 @@
-import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../data/containers/shared/types.js";
-import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-export declare function moveRemoteContainer(input: {
-    reportSecurityIncident: SecurityIncidentReporter;
-    apiClient: ContainerMoveApi;
-    author: ContainerMutationAuthor;
-    containerId: string;
-    destinationParentContainerId: string;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetSecretKey: Uint8Array;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<{
-    containerKey: Uint8Array;
-    plan: ContainerMovePlan;
-    response: ContainerRotationResponse;
-} | null>;

package/workflows/containers/child/move.js

@@ -1,268 +0,0 @@
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
-import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildMoveRotationWithBody, deriveMoveManifestArtifacts, } from "./moveArtifacts.js";
-import { buildContainerMoveWraps, collectContainerMovePrincipalPolicies, } from "./moveWraps.js";
-import { containerMutationRequestCore, previousPathRequestFields, } from "./mutationRequestCore.js";
-import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
-import { containerWriterProjectionFromRotationPlan } from "./rekeyProjection.js";
-import { requireUnwrappedKek, signedRotationTarget, } from "./rotationContext.js";
-function buildContainerMoveRequest(input) {
-    return {
-        ...containerMutationRequestCore("move", input),
-        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
-        destinationParentContainerPathRefs: input.destinationParentProjection.path.map(containerManifestRef),
-        predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container move predecessor bridge"),
-        keyring: readCanonicalRecord(input.keyring, "Container move keyring"),
-        parentKekState: readCanonicalRecord(input.destinationParentKek, "Container move destination parent KEK state"),
-    };
-}
-async function unwrapMoveContainerKeys(input) {
-    const verifiedByHash = new Map();
-    const keksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        projection: input.previousProjection,
-        secretKey: input.targetSecretKey,
-        verifiedByHash,
-        ...projectionVerificationOptions(input),
-    });
-    const source = signedRotationTarget(input.previousProjection, verifiedByHash);
-    const containerKey = requireUnwrappedKek(keksByEpochId, source.kek, "Container move source");
-    const destinationKeksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        projection: input.destinationParentProjection,
-        secretKey: input.targetSecretKey,
-        ...projectionVerificationOptions(input),
-    });
-    const destinationParent = getTargetContainerContext(input.destinationParentProjection);
-    requireUnwrappedKek(destinationKeksByEpochId, destinationParent.kek, "Container move destination parent");
-    return { containerKey, destinationParent, source };
-}
-function assertContainerMoveOrganizations(input) {
-    if (input.previousState.organizationId !== input.authorOrganizationId) {
-        throw new Error("Container move author organization mismatch");
-    }
-    if (input.destinationState.organizationId !== input.authorOrganizationId) {
-        throw new Error("Container move destination organization mismatch");
-    }
-}
-function readContainerMoveStates(input) {
-    const previousState = readContainerState(input.source.manifest);
-    const destinationState = readContainerState(input.destinationParent.manifest);
-    assertContainerMoveOrganizations({
-        authorOrganizationId: input.authorOrganizationId,
-        destinationState,
-        previousState,
-    });
-    return { destinationState, previousState };
-}
-function containerMoveDependencyManifestHashes(input) {
-    return [
-        ...uniqueSortedManifestHashes(input.previousProjection.path),
-        ...uniqueSortedManifestHashes(input.destinationParentProjection.path),
-    ];
-}
-function buildContainerMovePlanResult(input) {
-    const plan = {
-        body: input.body,
-        containerId: input.containerId,
-        containerKeyEpochId: input.containerKeyEpochId,
-        event: input.event,
-        eventHash: input.eventHash,
-        keyEpoch: input.keyEpoch,
-        keyring: input.keyring,
-        manifest: input.manifest,
-        manifestHash: input.manifestHash,
-        previousManifest: input.previousManifest,
-        request: buildContainerMoveRequest({
-            body: input.body,
-            destinationParentKek: input.destinationParentKek,
-            destinationParentProjection: input.destinationParentProjection,
-            event: input.event,
-            keyEpoch: input.keyEpoch,
-            keyring: input.keyring,
-            manifest: input.manifest,
-            manifestHash: input.manifestHash,
-            previousManifest: input.previousManifest,
-            previousProjection: input.previousProjection,
-            predecessorBridge: input.predecessorBridge,
-            principalPolicies: input.principalPolicies,
-            userRecipientKeys: input.userRecipientKeys,
-            wraps: input.wraps,
-        }),
-        state: input.state,
-        wraps: input.wraps,
-    };
-    return { containerKey: input.containerKey, plan };
-}
-async function collectAuthorizedMovePolicies(input) {
-    const principalPolicies = await collectContainerMovePrincipalPolicies({
-        ...input,
-        resolveUserKey: input.resolveProjectionUserKey,
-    });
-    assertContainerAuthorAccess({
-        author: input.author,
-        projection: input.previousProjection,
-        principalPolicies,
-        minimumAccess: "admin",
-    });
-    assertContainerAuthorAccess({
-        author: input.author,
-        projection: input.destinationParentProjection,
-        principalPolicies,
-        minimumAccess: "write",
-    });
-    return principalPolicies;
-}
-async function buildMaterializedContainerMovePlan(input) {
-    const { containerKey: predecessorContainerKey, destinationParent, source, } = await unwrapMoveContainerKeys({
-        destinationParentProjection: input.destinationParentProjection,
-        execSql: input.execSql,
-        previousProjection: input.previousProjection,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    // Only a verified path is a final depth refusal; a padded unverified path
-    // must fail verification (an incident), never look like an honest refusal.
-    assertContainerChildPathFits(input.destinationParentProjection.path);
-    const { destinationState, previousState } = readContainerMoveStates({
-        authorOrganizationId: input.author.organizationId,
-        destinationParent,
-        source,
-    });
-    const principalPolicies = await collectAuthorizedMovePolicies(input);
-    const { body, containerKey, containerKeyEpochId, keyring, predecessorBridge, } = await buildMoveRotationWithBody({
-        destinationParent,
-        destinationState,
-        override: input.containerKeyEpochId,
-        predecessorContainerKey,
-        previousState,
-        source,
-    });
-    const { event, eventHash, keyEpoch, manifest, manifestHash, state } = await deriveMoveManifestArtifacts({
-        body,
-        containerKeyEpochId,
-        destinationParent,
-        previousState,
-        signing: {
-            author: input.author,
-            dependencyManifestHashes: containerMoveDependencyManifestHashes(input),
-            eventId: input.eventId,
-            signedAt: input.signedAt,
-        },
-        source,
-    });
-    const { userRecipientKeys, wraps } = await buildContainerMoveWraps({
-        principalPolicies,
-        containerKey,
-        containerKeyEpochId,
-        destinationParentKek: destinationParent.kek,
-        destinationParentProjection: input.destinationParentProjection,
-        execSql: input.execSql,
-        manifestHash,
-        previousProjection: input.previousProjection,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        state,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    return buildContainerMovePlanResult({
-        body,
-        containerKey,
-        containerId: previousState.containerId,
-        containerKeyEpochId,
-        destinationParentKek: destinationParent.kek,
-        destinationParentProjection: input.destinationParentProjection,
-        event,
-        eventHash,
-        keyEpoch,
-        keyring,
-        manifest,
-        manifestHash,
-        previousManifest: asContainerManifestBundle(source.manifest),
-        previousProjection: input.previousProjection,
-        predecessorBridge,
-        principalPolicies,
-        state,
-        userRecipientKeys,
-        wraps,
-    });
-}
-export async function moveRemoteContainer(input) {
-    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container move");
-    const [previousProjection, destinationParentProjection] = await Promise.all([
-        input.apiClient.getContainerWriterProjection(input.containerId),
-        input.apiClient.getContainerWriterProjection(input.destinationParentContainerId),
-    ]);
-    if (!previousProjection || !destinationParentProjection) {
-        return null;
-    }
-    const materializedPlan = await nullOnProjectionVerificationCancellation(() => buildMaterializedContainerMovePlan({
-        author: input.author,
-        eventId: input.eventId,
-        execSql: input.execSql,
-        previousProjection,
-        destinationParentProjection,
-        resolveProjectionUserKey,
-        signedAt: input.signedAt,
-        stillCurrent: input.stillCurrent,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    }));
-    if (!materializedPlan)
-        return null;
-    return submitAcknowledgedContainerMutation({
-        reportSecurityIncident: input.reportSecurityIncident,
-        recitationPolicies: [],
-        apiClient: input.apiClient,
-        author: input.author,
-        carriedRekeys: {
-            planning: {
-                apiClient: input.apiClient,
-                author: input.author,
-                execSql: input.execSql,
-                knownContainerKeks: new Map([
-                    [
-                        materializedPlan.plan.containerKeyEpochId,
-                        materializedPlan.containerKey,
-                    ],
-                ]),
-                resolveProjectionUserKey: resolveProjectionUserKey,
-                stillCurrent: input.stillCurrent,
-                targetSecretKey: input.targetSecretKey,
-                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-            },
-            rotated: () => containerWriterProjectionFromRotationPlan({
-                ancestors: destinationParentProjection,
-                plan: materializedPlan.plan,
-                previousProjection,
-            }),
-        },
-        containerKey: materializedPlan.containerKey,
-        execSql: input.execSql,
-        plan: materializedPlan.plan,
-        stillCurrent: input.stillCurrent,
-        submit: (carried) => {
-            const request = carried.length
-                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
-                : materializedPlan.plan.request;
-            const options = {
-                expectedPaymentRequiredOrganizationId: input.author.organizationId,
-            };
-            const { moveContainerResult } = input.apiClient;
-            return submitContainerRotation({
-                plain: () => input.apiClient.moveContainer(input.containerId, request, options),
-                result: moveContainerResult
-                    ? () => moveContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
-                    : undefined,
-            });
-        },
-    });
-}
-//# sourceMappingURL=move.js.map

package/workflows/containers/child/move.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"move.js","sourceRoot":"","sources":["move.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAQpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,SAAS,yBAAyB,CAAC,KAelC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC;QAC9C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,kCAAkC,EAChC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClE,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,mCAAmC,CACpC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC;QACrE,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,oBAAoB,EAC1B,6CAA6C,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAQtC;IAKC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,uBAAuB,CACxB,CAAC;IAEF,MAAM,wBAAwB,GAAG,MAAM,sBAAsB,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,2BAA2B,CAClC,CAAC;IACF,mBAAmB,CACjB,wBAAwB,EACxB,iBAAiB,CAAC,GAAG,EACrB,mCAAmC,CACpC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9E,gCAAgC,CAAC;QAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,qCAAqC,CAAC,KAG9C;IACC,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5D,GAAG,0BAA0B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAoBrC;IACC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,yBAAyB,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAWD,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,qCAAqC,CAAC;QACpE,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,KAAqC;IAErC,MAAM,EACJ,YAAY,EAAE,uBAAuB,EACrC,iBAAiB,EACjB,MAAM,GACP,GAAG,MAAM,uBAAuB,CAAC;QAChC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,uBAAuB,CAAC;QAClE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACjD,iBAAiB;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,mBAAmB,EACnB,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,yBAAyB,CAAC;QAClC,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ,EAAE,KAAK,CAAC,mBAAmB;QACnC,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,wBAAwB,EAAE,qCAAqC,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACjE,iBAAiB;QACjB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC;QAClC,IAAI;QACJ,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAazC;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/D,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC1C,KAAK,CAAC,4BAA4B,CACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAC3E,kCAAkC,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,2BAA2B;QAC3B,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,wBAAwB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAChD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACpE,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,GAAG,EAAE,CACH,mBAAmB,CAAC,IAAI,CACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerUserRecipientKey,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerRotationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n  asContainerManifestBundle,\n  containerManifestRef,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  BuildMaterializedContainerMovePlanInput,\n  ContainerMoveApi,\n  ContainerMovePlan,\n  ContainerMutationAuthor,\n  MaterializedContainerMovePlan,\n} from \"../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  buildMoveRotationWithBody,\n  deriveMoveManifestArtifacts,\n} from \"./moveArtifacts\";\nimport {\n  buildContainerMoveWraps,\n  collectContainerMovePrincipalPolicies,\n} from \"./moveWraps\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n} from \"./mutationRequestCore\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n  requireUnwrappedKek,\n  type SignedRotationTarget,\n  signedRotationTarget,\n} from \"./rotationContext\";\n\nfunction buildContainerMoveRequest(input: {\n  body: ContainerMoveAccessEventBody;\n  destinationParentKek: ContainerKekResponse;\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"move\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    destinationParentContainerPathRefs:\n      input.destinationParentProjection.path.map(containerManifestRef),\n    predecessorBridge: readCanonicalRecord(\n      input.predecessorBridge,\n      \"Container move predecessor bridge\",\n    ),\n    keyring: readCanonicalRecord(input.keyring, \"Container move keyring\"),\n    parentKekState: readCanonicalRecord(\n      input.destinationParentKek,\n      \"Container move destination parent KEK state\",\n    ),\n  };\n}\n\nasync function unwrapMoveContainerKeys(input: {\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  source: SignedRotationTarget;\n}> {\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const source = signedRotationTarget(input.previousProjection, verifiedByHash);\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    source.kek,\n    \"Container move source\",\n  );\n\n  const destinationKeksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.destinationParentProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const destinationParent = getTargetContainerContext(\n    input.destinationParentProjection,\n  );\n  requireUnwrappedKek(\n    destinationKeksByEpochId,\n    destinationParent.kek,\n    \"Container move destination parent\",\n  );\n\n  return { containerKey, destinationParent, source };\n}\n\nfunction assertContainerMoveOrganizations(input: {\n  authorOrganizationId: string;\n  destinationState: ContainerAccessManifestState;\n  previousState: ContainerAccessManifestState;\n}): void {\n  if (input.previousState.organizationId !== input.authorOrganizationId) {\n    throw new Error(\"Container move author organization mismatch\");\n  }\n  if (input.destinationState.organizationId !== input.authorOrganizationId) {\n    throw new Error(\"Container move destination organization mismatch\");\n  }\n}\n\nfunction readContainerMoveStates(input: {\n  authorOrganizationId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const previousState = readContainerState(input.source.manifest);\n  const destinationState = readContainerState(input.destinationParent.manifest);\n  assertContainerMoveOrganizations({\n    authorOrganizationId: input.authorOrganizationId,\n    destinationState,\n    previousState,\n  });\n  return { destinationState, previousState };\n}\n\nfunction containerMoveDependencyManifestHashes(input: {\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  previousProjection: ContainerWriterProjectionResponse;\n}): string[] {\n  return [\n    ...uniqueSortedManifestHashes(input.previousProjection.path),\n    ...uniqueSortedManifestHashes(input.destinationParentProjection.path),\n  ];\n}\n\nfunction buildContainerMovePlanResult(input: {\n  body: ContainerMoveAccessEventBody;\n  containerId: string;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  destinationParentKek: ContainerKekResponse;\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  event: AccessEvent;\n  eventHash: string;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  state: ContainerAccessManifestState;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerMovePlan {\n  const plan: ContainerMovePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: buildContainerMoveRequest({\n      body: input.body,\n      destinationParentKek: input.destinationParentKek,\n      destinationParentProjection: input.destinationParentProjection,\n      event: input.event,\n      keyEpoch: input.keyEpoch,\n      keyring: input.keyring,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      predecessorBridge: input.predecessorBridge,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\ntype MaterializedContainerMoveInput =\n  BuildMaterializedContainerMovePlanInput & {\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    stillCurrent?: (() => boolean) | undefined;\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  };\n\nasync function collectAuthorizedMovePolicies(\n  input: MaterializedContainerMoveInput,\n) {\n  const principalPolicies = await collectContainerMovePrincipalPolicies({\n    ...input,\n    resolveUserKey: input.resolveProjectionUserKey,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.destinationParentProjection,\n    principalPolicies,\n    minimumAccess: \"write\",\n  });\n  return principalPolicies;\n}\n\nasync function buildMaterializedContainerMovePlan(\n  input: MaterializedContainerMoveInput,\n): Promise<MaterializedContainerMovePlan> {\n  const {\n    containerKey: predecessorContainerKey,\n    destinationParent,\n    source,\n  } = await unwrapMoveContainerKeys({\n    destinationParentProjection: input.destinationParentProjection,\n    execSql: input.execSql,\n    previousProjection: input.previousProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // Only a verified path is a final depth refusal; a padded unverified path\n  // must fail verification (an incident), never look like an honest refusal.\n  assertContainerChildPathFits(input.destinationParentProjection.path);\n  const { destinationState, previousState } = readContainerMoveStates({\n    authorOrganizationId: input.author.organizationId,\n    destinationParent,\n    source,\n  });\n  const principalPolicies = await collectAuthorizedMovePolicies(input);\n  const {\n    body,\n    containerKey,\n    containerKeyEpochId,\n    keyring,\n    predecessorBridge,\n  } = await buildMoveRotationWithBody({\n    destinationParent,\n    destinationState,\n    override: input.containerKeyEpochId,\n    predecessorContainerKey,\n    previousState,\n    source,\n  });\n  const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveMoveManifestArtifacts({\n      body,\n      containerKeyEpochId,\n      destinationParent,\n      previousState,\n      signing: {\n        author: input.author,\n        dependencyManifestHashes: containerMoveDependencyManifestHashes(input),\n        eventId: input.eventId,\n        signedAt: input.signedAt,\n      },\n      source,\n    });\n  const { userRecipientKeys, wraps } = await buildContainerMoveWraps({\n    principalPolicies,\n    containerKey,\n    containerKeyEpochId,\n    destinationParentKek: destinationParent.kek,\n    destinationParentProjection: input.destinationParentProjection,\n    execSql: input.execSql,\n    manifestHash,\n    previousProjection: input.previousProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    state,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n\n  return buildContainerMovePlanResult({\n    body,\n    containerKey,\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    destinationParentKek: destinationParent.kek,\n    destinationParentProjection: input.destinationParentProjection,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(source.manifest),\n    previousProjection: input.previousProjection,\n    predecessorBridge,\n    principalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n}\n\nexport async function moveRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerMoveApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  destinationParentContainerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerMovePlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container move\",\n  );\n  const [previousProjection, destinationParentProjection] = await Promise.all([\n    input.apiClient.getContainerWriterProjection(input.containerId),\n    input.apiClient.getContainerWriterProjection(\n      input.destinationParentContainerId,\n    ),\n  ]);\n  if (!previousProjection || !destinationParentProjection) {\n    return null;\n  }\n\n  const materializedPlan = await nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerMovePlan({\n      author: input.author,\n      eventId: input.eventId,\n      execSql: input.execSql,\n      previousProjection,\n      destinationParentProjection,\n      resolveProjectionUserKey,\n      signedAt: input.signedAt,\n      stillCurrent: input.stillCurrent,\n      targetSecretKey: input.targetSecretKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: () =>\n        containerWriterProjectionFromRotationPlan({\n          ancestors: destinationParentProjection,\n          plan: materializedPlan.plan,\n          previousProjection,\n        }),\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { moveContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.moveContainer(input.containerId, request, options),\n        result: moveContainerResult\n          ? () =>\n              moveContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}