npm - @tearleads/client-sdk - Versions diffs - 0.1.63 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.63 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (616) hide show

package/workflows/container-contents/container-state/share/sharePersistence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sharePersistence.js","sourceRoot":"","sources":["sharePersistence.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,wCAAwC,GACzC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,oBAAoB,CAAC;AAgBtE,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,oCAAoC,CAC/D,KAAK,CAAC,cAAc,EACpB,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE,CACjE,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,cAAc,CAAC,SAAS,GAAG;QACzB,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS;QACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACvC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACvC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;KAClC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAAC;QAC/D,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE;YACL,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YAChD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YAC3C,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YACnD,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;SAC7B;QACD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE;YACX,gBAAgB,EAAE;gBAChB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;aAClC;SACF;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,cAAc,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;YACnC,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IACD,gCAAgC,CAC9B,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAC7B,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;QACnC,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,oCAAoC,CAC/D,KAAK,CAAC,cAAc,EACpB,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE,CACjE,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,cAAc,CAAC,SAAS,GAAG;QACzB,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS;QACjC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACvC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,CAAC,CAAC;gBACE,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBACtC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,sBAAsB,GAC1B,cAAc,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,kBAAkB;QACnE,cAAc,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QAC7D,cAAc,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC;IACxE,MAAM,KAAK,GAAoC;QAC7C,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAClD,GAAG,CAAC,sBAAsB;YACxB,CAAC,CAAC;gBACE,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAAC;QAC/D,aAAa,EAAE,cAAc;QAC7B,KAAK;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE;YACX,gBAAgB,EAAE;gBAChB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,cAAc,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;YACnC,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IACD,gCAAgC,CAC9B,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;QACnC,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n ContainerWriterProjectionResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport {\n type ContainerMetadataPatch,\n persistContainerMetadataStateFromRuntime,\n} from \"../../metadata\";\nimport {\n createDetachedContainerMetadataState,\n installDetachedContainerMetadataState,\n} from \"../../metadata/metadataStateIsolation\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport { installContainerWriterProjection } from \"../projectionCache\";\nimport type {\n ContainerWorkflowRuntime,\n SharedContainerStateResult,\n SharedRemoteContainerState,\n} from \"../types\";\n\nexport interface MatchingRemoteContainerGrant {\n accessEpoch: number;\n accessStateHash: string;\n createdAt: string | null;\n metadataDocumentId: string;\n referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n updatedAt: string | null;\n}\n\n// These helpers run only after the remote grant is verified. A skipped local\n// install does not undo that acknowledgement; reconciliation installs it later.\nexport async function persistSharedContainerState(input: {\n containerState: ContainerState;\n persistence: ContainerContentsPersistence;\n runtime: ContainerWorkflowRuntime;\n shared: SharedRemoteContainerState;\n stillCurrent?: (() => boolean) | undefined;\n /** `writerProjectionGeneration` captured before the share flow began. */\n writerProjectionGeneration: number;\n}): Promise<SharedContainerStateResult | null> {\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n const candidateState = await createDetachedContainerMetadataState(\n input.containerState,\n { writerProjectionGeneration: input.writerProjectionGeneration },\n );\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n candidateState.container = {\n ...input.containerState.container,\n createdAt: input.shared.createdAt,\n serverCreatedAt: input.shared.createdAt,\n serverUpdatedAt: input.shared.updatedAt,\n updatedAt: input.shared.updatedAt,\n };\n\n const persisted = await persistContainerMetadataStateFromRuntime({\n metadataState: candidateState,\n patch: {\n accessEpoch: input.shared.accessEpoch,\n accessStateHash: input.shared.accessManifestHash,\n documentId: input.shared.metadataDocumentId,\n metadataDocumentId: input.shared.metadataDocumentId,\n contentKeyBundle: null,\n documentKekTargets: null,\n documentManifestBundle: null,\n },\n persistence: input.persistence,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n saveOptions: {\n serverTimestamps: {\n createdAt: input.shared.createdAt,\n updatedAt: input.shared.updatedAt,\n },\n },\n });\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n if (!persisted) return { status: \"missing\" };\n candidateState.container = persisted.container;\n installDetachedContainerMetadataState(input.containerState, candidateState, {\n candidateRecord: persisted.record,\n preserveConcurrentMetadataEdit: true,\n });\n if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {\n return {\n container: input.containerState.container,\n record: input.containerState.record,\n status: \"identity-superseded\",\n };\n }\n installContainerWriterProjection(\n input.containerState,\n input.shared.writerProjection,\n input.writerProjectionGeneration,\n );\n return {\n container: input.containerState.container,\n record: input.containerState.record,\n status: \"persisted\",\n };\n}\n\nexport async function persistDuplicateContainerShare(input: {\n containerState: ContainerState;\n grant: MatchingRemoteContainerGrant;\n persistence: ContainerContentsPersistence;\n projection: ContainerWriterProjectionResponse;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n /** `writerProjectionGeneration` captured before the share flow began. */\n writerProjectionGeneration: number;\n}): Promise<SharedContainerStateResult | null> {\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n const candidateState = await createDetachedContainerMetadataState(\n input.containerState,\n { writerProjectionGeneration: input.writerProjectionGeneration },\n );\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n candidateState.container = {\n ...input.containerState.container,\n ...(input.grant.createdAt\n ? {\n createdAt: input.grant.createdAt,\n serverCreatedAt: input.grant.createdAt,\n }\n : {}),\n ...(input.grant.updatedAt\n ? {\n serverUpdatedAt: input.grant.updatedAt,\n updatedAt: input.grant.updatedAt,\n }\n : {}),\n };\n const securityContextChanged =\n candidateState.record.documentId !== input.grant.metadataDocumentId ||\n candidateState.record.accessEpoch !== input.grant.accessEpoch ||\n candidateState.record.accessStateHash !== input.grant.accessStateHash;\n const patch: Partial<ContainerMetadataPatch> = {\n accessEpoch: input.grant.accessEpoch,\n accessStateHash: input.grant.accessStateHash,\n documentId: input.grant.metadataDocumentId,\n metadataDocumentId: input.grant.metadataDocumentId,\n ...(securityContextChanged\n ? {\n contentKeyBundle: null,\n documentKekTargets: null,\n documentManifestBundle: null,\n }\n : {}),\n };\n const persisted = await persistContainerMetadataStateFromRuntime({\n metadataState: candidateState,\n patch,\n persistence: input.persistence,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n saveOptions: {\n serverTimestamps: {\n createdAt: input.grant.createdAt,\n updatedAt: input.grant.updatedAt,\n },\n },\n });\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n if (!persisted) return { status: \"missing\" };\n candidateState.container = persisted.container;\n installDetachedContainerMetadataState(input.containerState, candidateState, {\n candidateRecord: persisted.record,\n preserveConcurrentMetadataEdit: true,\n });\n if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {\n return {\n container: input.containerState.container,\n record: input.containerState.record,\n status: \"identity-superseded\",\n };\n }\n installContainerWriterProjection(\n input.containerState,\n input.projection,\n input.writerProjectionGeneration,\n );\n return {\n container: input.containerState.container,\n record: input.containerState.record,\n status: \"persisted\",\n };\n}\n"]}

package/workflows/container-contents/documentDiscovery/documentDiscoveryApply.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { dedupeReferencedPrincipalStates } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { dedupeReferencedPrincipalStates } from "../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
 import { withoutDeferredDocumentLinks } from "../documentLinks/deferredDocumentLinks.js";
 import { settleContainerDocumentTombstones } from "../tombstones/documentTombstoneGate.js";
 import { getApplicableDocumentTombstones } from "./documentDiscoveryInputs.js";

package/workflows/container-contents/documentDiscovery/documentDiscoveryApply.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"documentDiscoveryApply.js","sourceRoot":"","sources":["documentDiscoveryApply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,~~iEAAiE~~,CAAC;~~AAClH~~,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAc5E,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAI3D;IACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,8BAA8B,EAAE,GACpE,KAAK,CAAC;IACR,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,8BAA8B,CAClC,WAAW,EACX,eAAe,CAAC,aAAa,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EACvC,UAAkB,EAClB,eAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,OAAO,CAAC,gCAAgC,EAAE,CAC9C,+BAA+B,CAC7B,eAAe,CAAC,KAAK,CAAC,OAAO,CAC3B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAC5C,CACF,CACF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAC1D,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvC,WAAW,EAAE,QAAQ,CAAC,kBAAkB;QACxC,eAAe,EAAE,QAAQ,CAAC,sBAAsB;QAChD,WAAW;QACX,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;KAChD,CAAC,CAAC,EACH,CAAC,WAAW,CAAC,EACb,UAAU,EACV,+BAA+B,CAAC,eAAe,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC;IAC3C,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM;QAC/C,CAAC,CAAC,MAAM,yBAAyB,CAAC,cAAc,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,cAAc,CAAC,MAAM;QACvB,MAAM,OAAO,CAAC,yBAAyB,CACrC,MAAM,4BAA4B,CAChC,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,YAAY,EAAE,QAAQ,CAAC,kBAAkB;SAC1C,CAAC,CAAC,EACH,mBAAmB,CACpB,CACF,CAAC;IAEJ,MAAM,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;QACzE,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,+BAA+B,CAAC,eAAe,CAAC;KAC7D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,qCAAqC,CAAC;QAC1C,WAAW;QACX,eAAe;QACf,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;KACvE,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,aAAa,EAAE,CAAC;QAClC,4EAA4E;QAC5E,OAAO,CAAC,aAAa,EAAE,CACrB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAQ;QACd,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,0BAA0B,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,0BAA0B,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { dedupeReferencedPrincipalStates } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { withoutDeferredDocumentLinks } from \"../documentLinks/deferredDocumentLinks\";\nimport { settleContainerDocumentTombstones } from \"../tombstones/documentTombstoneGate\";\nimport { getApplicableDocumentTombstones } from \"./documentDiscoveryInputs\";\nimport type {\n DiscoverContainerDocumentsOptions,\n ListedContainerDocuments,\n} from \"./documentDiscoveryTypes\";\n\n/** A discovery lane's local stores; the listing itself is supplied by the caller. /\nexport type ContainerDocumentDiscoveryLane = Omit<\n DiscoverContainerDocumentsOptions,\n \| \"beginDocumentDiscovery\"\n \| \"listContainerDocumentLanes\"\n \| \"loadContainerDocumentWatermark\"\n>;\n\nexport async function saveAppliedContainerDocumentWatermark(input: {\n containerId: string;\n listedDocuments: ListedContainerDocuments;\n saveContainerDocumentWatermark: DiscoverContainerDocumentsOptions[\"saveContainerDocumentWatermark\"];\n}) {\n const { containerId, listedDocuments, saveContainerDocumentWatermark } =\n input;\n if (!listedDocuments.nextWatermark) {\n return;\n }\n\n await saveContainerDocumentWatermark(\n containerId,\n listedDocuments.nextWatermark,\n );\n}\n\n/\n Verifies and applies one container's completed listing under a discovery\n * generation captured before the listing request, then advances its\n * watermark. Returns `null` when nothing was applied.\n */\nexport async function applyListedContainerDocuments(\n options: ContainerDocumentDiscoveryLane,\n generation: number,\n listedDocuments: ListedContainerDocuments,\n): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const { containerId, upsertDiscoveredDocuments } = options;\n await options.cacheReferencedPrincipalPolicies?.(\n dedupeReferencedPrincipalStates(\n listedDocuments.items.flatMap(\n (document) => document.referencedPrincipals,\n ),\n ),\n );\n\n const verification = await options.verifyDiscoveredDocuments(\n listedDocuments.items.map((document) => ({\n accessEpoch: document.currentAccessEpoch,\n accessStateHash: document.currentAccessStateHash,\n containerId,\n listedContainerIds: [containerId],\n createdAt: document.createdAt,\n documentId: document.id,\n effectiveAccessLevel: document.effectiveAccessLevel,\n linkedContainerIds: document.linkedContainerIds,\n })),\n [containerId],\n generation,\n getApplicableDocumentTombstones(listedDocuments),\n );\n if (!(await verification.isCurrent())) return null;\n const verifiedInputs = verification.inputs;\n const discoveredDocuments = verifiedInputs.length\n ? await upsertDiscoveredDocuments(verifiedInputs)\n : [];\n\n if (verifiedInputs.length)\n await options.replaceDocumentLinksBatch(\n await withoutDeferredDocumentLinks(\n verifiedInputs.map((document) => ({\n documentId: document.documentId,\n accessEpoch: document.accessEpoch,\n containerIds: document.linkedContainerIds,\n })),\n discoveredDocuments,\n ),\n );\n\n const tombstoneDocumentSummaries = await settleContainerDocumentTombstones({\n containerIds: [containerId],\n store: options,\n tombstones: getApplicableDocumentTombstones(listedDocuments),\n });\n\n const complete = await verification.commit();\n if (!(await verification.isCurrent())) return null;\n await saveAppliedContainerDocumentWatermark({\n containerId,\n listedDocuments,\n saveContainerDocumentWatermark: options.saveContainerDocumentWatermark,\n });\n\n if (listedDocuments.isFullListing) {\n // Initial probes consume ids as discovery hints and verify their own heads.\n options.onFullListing?.(\n listedDocuments.items.map((document) => document.id),\n );\n }\n\n return !complete &&\n discoveredDocuments.length === 0 &&\n tombstoneDocumentSummaries.length === 0\n ? null\n : [...discoveredDocuments, ...tombstoneDocumentSummaries];\n}\n"]}
1	+ {"version":3,"file":"documentDiscoveryApply.js","sourceRoot":"","sources":["documentDiscoveryApply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAc5E,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAI3D;IACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,8BAA8B,EAAE,GACpE,KAAK,CAAC;IACR,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,8BAA8B,CAClC,WAAW,EACX,eAAe,CAAC,aAAa,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EACvC,UAAkB,EAClB,eAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,OAAO,CAAC,gCAAgC,EAAE,CAC9C,+BAA+B,CAC7B,eAAe,CAAC,KAAK,CAAC,OAAO,CAC3B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAC5C,CACF,CACF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAC1D,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvC,WAAW,EAAE,QAAQ,CAAC,kBAAkB;QACxC,eAAe,EAAE,QAAQ,CAAC,sBAAsB;QAChD,WAAW;QACX,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;KAChD,CAAC,CAAC,EACH,CAAC,WAAW,CAAC,EACb,UAAU,EACV,+BAA+B,CAAC,eAAe,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC;IAC3C,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM;QAC/C,CAAC,CAAC,MAAM,yBAAyB,CAAC,cAAc,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,cAAc,CAAC,MAAM;QACvB,MAAM,OAAO,CAAC,yBAAyB,CACrC,MAAM,4BAA4B,CAChC,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,YAAY,EAAE,QAAQ,CAAC,kBAAkB;SAC1C,CAAC,CAAC,EACH,mBAAmB,CACpB,CACF,CAAC;IAEJ,MAAM,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;QACzE,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,+BAA+B,CAAC,eAAe,CAAC;KAC7D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,qCAAqC,CAAC;QAC1C,WAAW;QACX,eAAe;QACf,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;KACvE,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,aAAa,EAAE,CAAC;QAClC,4EAA4E;QAC5E,OAAO,CAAC,aAAa,EAAE,CACrB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAQ;QACd,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,0BAA0B,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,0BAA0B,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { dedupeReferencedPrincipalStates } from \"../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { withoutDeferredDocumentLinks } from \"../documentLinks/deferredDocumentLinks\";\nimport { settleContainerDocumentTombstones } from \"../tombstones/documentTombstoneGate\";\nimport { getApplicableDocumentTombstones } from \"./documentDiscoveryInputs\";\nimport type {\n DiscoverContainerDocumentsOptions,\n ListedContainerDocuments,\n} from \"./documentDiscoveryTypes\";\n\n/** A discovery lane's local stores; the listing itself is supplied by the caller. /\nexport type ContainerDocumentDiscoveryLane = Omit<\n DiscoverContainerDocumentsOptions,\n \| \"beginDocumentDiscovery\"\n \| \"listContainerDocumentLanes\"\n \| \"loadContainerDocumentWatermark\"\n>;\n\nexport async function saveAppliedContainerDocumentWatermark(input: {\n containerId: string;\n listedDocuments: ListedContainerDocuments;\n saveContainerDocumentWatermark: DiscoverContainerDocumentsOptions[\"saveContainerDocumentWatermark\"];\n}) {\n const { containerId, listedDocuments, saveContainerDocumentWatermark } =\n input;\n if (!listedDocuments.nextWatermark) {\n return;\n }\n\n await saveContainerDocumentWatermark(\n containerId,\n listedDocuments.nextWatermark,\n );\n}\n\n/\n Verifies and applies one container's completed listing under a discovery\n * generation captured before the listing request, then advances its\n * watermark. Returns `null` when nothing was applied.\n */\nexport async function applyListedContainerDocuments(\n options: ContainerDocumentDiscoveryLane,\n generation: number,\n listedDocuments: ListedContainerDocuments,\n): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const { containerId, upsertDiscoveredDocuments } = options;\n await options.cacheReferencedPrincipalPolicies?.(\n dedupeReferencedPrincipalStates(\n listedDocuments.items.flatMap(\n (document) => document.referencedPrincipals,\n ),\n ),\n );\n\n const verification = await options.verifyDiscoveredDocuments(\n listedDocuments.items.map((document) => ({\n accessEpoch: document.currentAccessEpoch,\n accessStateHash: document.currentAccessStateHash,\n containerId,\n listedContainerIds: [containerId],\n createdAt: document.createdAt,\n documentId: document.id,\n effectiveAccessLevel: document.effectiveAccessLevel,\n linkedContainerIds: document.linkedContainerIds,\n })),\n [containerId],\n generation,\n getApplicableDocumentTombstones(listedDocuments),\n );\n if (!(await verification.isCurrent())) return null;\n const verifiedInputs = verification.inputs;\n const discoveredDocuments = verifiedInputs.length\n ? await upsertDiscoveredDocuments(verifiedInputs)\n : [];\n\n if (verifiedInputs.length)\n await options.replaceDocumentLinksBatch(\n await withoutDeferredDocumentLinks(\n verifiedInputs.map((document) => ({\n documentId: document.documentId,\n accessEpoch: document.accessEpoch,\n containerIds: document.linkedContainerIds,\n })),\n discoveredDocuments,\n ),\n );\n\n const tombstoneDocumentSummaries = await settleContainerDocumentTombstones({\n containerIds: [containerId],\n store: options,\n tombstones: getApplicableDocumentTombstones(listedDocuments),\n });\n\n const complete = await verification.commit();\n if (!(await verification.isCurrent())) return null;\n await saveAppliedContainerDocumentWatermark({\n containerId,\n listedDocuments,\n saveContainerDocumentWatermark: options.saveContainerDocumentWatermark,\n });\n\n if (listedDocuments.isFullListing) {\n // Initial probes consume ids as discovery hints and verify their own heads.\n options.onFullListing?.(\n listedDocuments.items.map((document) => document.id),\n );\n }\n\n return !complete &&\n discoveredDocuments.length === 0 &&\n tombstoneDocumentSummaries.length === 0\n ? null\n : [...discoveredDocuments, ...tombstoneDocumentSummaries];\n}\n"]}

package/workflows/container-contents/documentDiscovery/index.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { isDocumentUpdateCreatedEvent } from "../../../data/documents/documentSync.js";
-import { dedupeReferencedPrincipalStates } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { dedupeReferencedPrincipalStates } from "../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
 import { withoutDeferredDocumentLinks } from "../documentLinks/deferredDocumentLinks.js";
 import { settleContainerDocumentTombstones } from "../tombstones/documentTombstoneGate.js";
 import { listContainerDocumentLanesFromApi, listContainerDocumentsFromWatermarks, } from "./containerDocumentListing.js";

package/workflows/container-contents/documentDiscovery/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qCAAqC,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAa1E,MAAM,qCAAqC,GAAG,CAAC,CAAC;AAWhD,KAAK,UAAU,4BAA4B,CACzC,wBAAmF,EACnF,cAA2D;IAE3D,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CACpD,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IACE,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YACpC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI;QACJ,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAoC,EACpC,gBAA6B,EAC7B,YAAsB;IAEtB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA8B,EAC9B,gBAAqC;IAErC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CACR,4BAA4B,CAAC,KAAK,CAAC;QACnC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,wBAAmF;IAEnF,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAE,EAAE;QAClD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,eAAe,CAAC,IAAI,CAAC,CAAC;IAEtB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI;YACJ,OAAO,EAAE;gBACP,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;SACF,CAAC,CAAC,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,4BAA4B,CACpD,wBAAwB,EACxB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,iBAAiB,GAAmC,EAAE,CAAC;QAE7D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,MAAM,WAAW,IAAI,yBAAyB,CACjD,QAAQ,CAAC,KAAK,EACd,gBAAgB,EAChB,YAAY,CACb,EAAE,CAAC;gBACF,eAAe,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,iBAAiB,CAAC,IAAI,CAAC;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,QAAQ,CAAC,aAAa;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,SAA0E;IAE1E,OAAO,yBAAyB,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,GAAG,IAAI,EAC2B;IAClC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,8BAA8B,CAAC;QACrD,UAAU,EAAE,MAAM,sBAAsB,EAAE;QAC1C,KAAK,EAAE,CAAC,IAAI,CAAC;QACb,0BAA0B;QAC1B,8BAA8B;KAC/B,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;IACzD,OAAO,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,EAChD,SAAS,EACT,GAAG,KAAK,EAMT;IACC,OAAO,0BAA0B,CAAC;QAChC,GAAG,KAAK;QACR,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,iCAAiC,CAAC,SAAS,EAAE,KAAK,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAiE;IAEjE,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC9C,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,MAAM,EACJ,gCAAgC,EAChC,YAAY,EACZ,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,GAAG,OAAO,CAAC;IACZ,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CACjE,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAC1D,MAAM,0BAA0B,GAAG,MAAM,kBAAkB,CAAC;QAC1D,YAAY,EAAE,kBAAkB;QAChC,0BAA0B;QAC1B,8BAA8B;KAC/B,CAAC,CAAC;IACH,MAAM,gCAAgC,EAAE,CACtC,+BAA+B,CAC7B,0BAA0B,CAAC,OAAO,CAChC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CACtB,eAAe,EAAE,KAAK,CAAC,OAAO,CAC5B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAC5C,IAAI,EAAE,CACV,CACF,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAC1D,+BAA+B,CAAC,0BAA0B,CAAC,EAC3D,kBAAkB,EAClB,UAAU,EACV,mCAAmC,CAAC,0BAA0B,CAAC,CAChE,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,wBAAwB,GAAG,YAAY,CAAC,MAAM,CAAC;IACrD,MAAM,mBAAmB,GACvB,wBAAwB,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAEhE,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,yBAAyB,CAC7B,MAAM,4BAA4B,CAChC,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,kBAAkB;SACvC,CAAC,CAAC,EACH,mBAAmB,CACpB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;QACzE,YAAY,EAAE,0BAA0B,CAAC,OAAO,CAC9C,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE,CACnC,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACvC;QACD,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,mCAAmC,CAAC,0BAA0B,CAAC;KAC5E,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,OAAO,CAAC,GAAG,CACf,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE,CAClE,eAAe;QACb,CAAC,CAAC,qCAAqC,CAAC;YACpC,WAAW;YACX,eAAe;YACf,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ;QACd,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,0BAA0B,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,0BAA0B,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,EAC1C,wBAAwB,EACxB,GAAG,KAAK,EAC4B;IACpC,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,6BAA6B,CAAC;QACnC,GAAG,KAAK;QACR,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,EAClD,SAAS,EACT,GAAG,KAAK,EACmC;IAC3C,OAAO,4BAA4B,CAAC;QAClC,GAAG,KAAK;QACR,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,iCAAiC,CAAC,SAAS,EAAE,KAAK,CAAC;QACrD,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { isDocumentUpdateCreatedEvent } from \"../../../data/documents/documentSync\";\nimport { dedupeReferencedPrincipalStates } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { withoutDeferredDocumentLinks } from \"../documentLinks/deferredDocumentLinks\";\nimport { settleContainerDocumentTombstones } from \"../tombstones/documentTombstoneGate\";\nimport {\n listContainerDocumentLanesFromApi,\n listContainerDocumentsFromWatermarks,\n} from \"./containerDocumentListing\";\nimport { saveAppliedContainerDocumentWatermark } from \"./documentDiscoveryApply\";\nimport {\n collectApplicableDocumentTombstones,\n collectDiscoveredDocumentInputs,\n} from \"./documentDiscoveryInputs\";\nimport { discoverContainerDocumentLanes } from \"./documentDiscoveryLanes\";\nimport type {\n ContainerDocumentDiscoveryApi,\n ContainerParentDiscoveryLane,\n DiscoverAllContainerDocumentsOptions,\n DiscoverContainerDocumentsOptions,\n ListedContainerDocumentsLane,\n RefreshAllContainerDocumentsFromApiOptions,\n RefreshAllContainerDocumentsOptions,\n} from \"./documentDiscoveryTypes\";\n\nexport type { RefreshAllContainerDocumentsFromApiOptions } from \"./documentDiscoveryTypes\";\n\nconst CONTAINER_PARENT_DISCOVERY_BATCH_SIZE = 4;\n\ntype ContainerParentLaneRequest = Parameters<\n ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"]\n>[0][\"lanes\"][number];\n\ninterface RequestedContainerParentLane {\n lane: ContainerParentDiscoveryLane;\n request: ContainerParentLaneRequest;\n}\n\nasync function listContainerParentLaneBatch(\n listContainerParentLanes: ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"],\n requestedLanes: ReadonlyArray<RequestedContainerParentLane>,\n) {\n const response = await listContainerParentLanes({\n lanes: requestedLanes.map(({ request }) => request),\n });\n if (!response \|\| response.results.length !== requestedLanes.length) {\n return null;\n }\n\n const requestedLaneIds = new Set(\n requestedLanes.map(({ request }) => request.laneId),\n );\n const pagesByLaneId = new Map<\n string,\n (typeof response.results)[number][\"page\"]\n >();\n for (const result of response.results) {\n if (\n !requestedLaneIds.has(result.laneId) \|\|\n pagesByLaneId.has(result.laneId)\n ) {\n return null;\n }\n pagesByLaneId.set(result.laneId, result.page);\n }\n\n return requestedLanes.map(({ lane, request }) => ({\n lane,\n response: pagesByLaneId.get(request.laneId),\n }));\n}\n\nfunction collectRemoteContainerIds(\n items: ReadonlyArray<{ id: string }>,\n seenContainerIds: Set<string>,\n containerIds: string[],\n): ReadonlyArray<string> {\n for (const { id } of items) {\n if (!seenContainerIds.has(id)) {\n seenContainerIds.add(id);\n containerIds.push(id);\n }\n }\n\n return items.map(({ id }) => id);\n}\n\nexport function hasUndiscoveredDocumentUpdateEvent(\n events: ReadonlyArray<unknown>,\n knownDocumentIds: ReadonlySet<string>,\n): boolean {\n return events.some(\n (event) =>\n isDocumentUpdateCreatedEvent(event) &&\n !knownDocumentIds.has(event.documentId),\n );\n}\n\nexport async function listAllRemoteContainerIds(\n listContainerParentLanes: ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"],\n): Promise<ReadonlyArray<string> \| null> {\n const containerIds: string[] = [];\n const queuedParentIds = new Set<string \| null>();\n const seenContainerIds = new Set<string>();\n const lanes: ContainerParentDiscoveryLane[] = [];\n let nextLaneId = 0;\n const queueParentLane = (parentId: string \| null) => {\n if (queuedParentIds.has(parentId)) {\n return;\n }\n\n queuedParentIds.add(parentId);\n lanes.push({ parentId, watermark: null });\n };\n\n queueParentLane(null);\n\n while (lanes.length > 0) {\n const laneBatch = lanes.splice(0, CONTAINER_PARENT_DISCOVERY_BATCH_SIZE);\n const requestedLanes = laneBatch.map((lane) => ({\n lane,\n request: {\n laneId: `container-parent-${nextLaneId++}`,\n parentId: lane.parentId,\n watermark: lane.watermark,\n },\n }));\n const listedLanes = await listContainerParentLaneBatch(\n listContainerParentLanes,\n requestedLanes,\n );\n if (!listedLanes) {\n return null;\n }\n const continuationLanes: ContainerParentDiscoveryLane[] = [];\n\n for (const { lane, response } of listedLanes) {\n if (!response) {\n return null;\n }\n\n for (const containerId of collectRemoteContainerIds(\n response.items,\n seenContainerIds,\n containerIds,\n )) {\n queueParentLane(containerId);\n }\n\n if (response.hasMore) {\n if (!response.nextWatermark) {\n return null;\n }\n continuationLanes.push({\n parentId: lane.parentId,\n watermark: response.nextWatermark,\n });\n }\n }\n\n lanes.unshift(...continuationLanes);\n }\n\n return containerIds;\n}\n\nexport function listAllRemoteContainerIdsFromApi(\n apiClient: Pick<ContainerDocumentDiscoveryApi, \"listContainerParentLanes\">,\n): Promise<ReadonlyArray<string> \| null> {\n return listAllRemoteContainerIds((input) =>\n apiClient.listContainerParentLanes(input),\n );\n}\n\nexport async function discoverContainerDocuments({\n beginDocumentDiscovery,\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n ...lane\n}: DiscoverContainerDocumentsOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const [outcome] = await discoverContainerDocumentLanes({\n generation: await beginDocumentDiscovery(),\n lanes: [lane],\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n });\n if (outcome?.status === \"rejected\") throw outcome.reason;\n return outcome?.value ?? null;\n}\n\nexport function discoverContainerDocumentsFromApi({\n apiClient,\n ...input\n}: Omit<DiscoverContainerDocumentsOptions, \"listContainerDocumentLanes\"> & {\n readonly apiClient: Pick<\n ContainerDocumentDiscoveryApi,\n \"listContainerDocumentLanes\"\n >;\n}): Promise<ReadonlyArray<DocumentSummary> \| null> {\n return discoverContainerDocuments({\n ...input,\n listContainerDocumentLanes: (lanes) =>\n listContainerDocumentLanesFromApi(apiClient, lanes),\n });\n}\n\nasync function listDiscoveryLanes(\n input: Parameters<typeof listContainerDocumentsFromWatermarks>[0],\n): Promise<ListedContainerDocumentsLane[]> {\n const listed = await listContainerDocumentsFromWatermarks(input);\n return input.containerIds.map((containerId) => ({\n containerId,\n listedDocuments: listed.get(containerId) ?? null,\n }));\n}\n\nexport async function discoverAllContainerDocuments(\n options: DiscoverAllContainerDocumentsOptions,\n): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const {\n cacheReferencedPrincipalPolicies,\n containerIds,\n loadContainerDocumentWatermark,\n listContainerDocumentLanes,\n replaceDocumentLinksBatch,\n saveContainerDocumentWatermark,\n upsertDiscoveredDocuments,\n } = options;\n const uniqueContainerIds = Array.from(new Set(containerIds)).filter(\n (containerId): containerId is string =>\n typeof containerId === \"string\" && containerId.length > 0,\n );\n const generation = await options.beginDocumentDiscovery();\n const listedDocumentsByContainer = await listDiscoveryLanes({\n containerIds: uniqueContainerIds,\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n });\n await cacheReferencedPrincipalPolicies?.(\n dedupeReferencedPrincipalStates(\n listedDocumentsByContainer.flatMap(\n ({ listedDocuments }) =>\n listedDocuments?.items.flatMap(\n (document) => document.referencedPrincipals,\n ) ?? [],\n ),\n ),\n );\n const verification = await options.verifyDiscoveredDocuments(\n collectDiscoveredDocumentInputs(listedDocumentsByContainer),\n uniqueContainerIds,\n generation,\n collectApplicableDocumentTombstones(listedDocumentsByContainer),\n );\n if (!(await verification.isCurrent())) return null;\n const discoveredDocumentInputs = verification.inputs;\n const discoveredDocuments =\n discoveredDocumentInputs.length === 0\n ? []\n : await upsertDiscoveredDocuments(discoveredDocumentInputs);\n\n if (discoveredDocumentInputs.length > 0) {\n await replaceDocumentLinksBatch(\n await withoutDeferredDocumentLinks(\n discoveredDocumentInputs.map((input) => ({\n documentId: input.documentId,\n accessEpoch: input.accessEpoch,\n containerIds: input.linkedContainerIds,\n })),\n discoveredDocuments,\n ),\n );\n }\n\n const tombstoneDocumentSummaries = await settleContainerDocumentTombstones({\n containerIds: listedDocumentsByContainer.flatMap(\n ({ containerId, listedDocuments }) =>\n listedDocuments ? [containerId] : [],\n ),\n store: options,\n tombstones: collectApplicableDocumentTombstones(listedDocumentsByContainer),\n });\n\n const complete = await verification.commit();\n if (!(await verification.isCurrent())) return null;\n\n await Promise.all(\n listedDocumentsByContainer.map(({ containerId, listedDocuments }) =>\n listedDocuments\n ? saveAppliedContainerDocumentWatermark({\n containerId,\n listedDocuments,\n saveContainerDocumentWatermark,\n })\n : undefined,\n ),\n );\n\n return !complete &&\n discoveredDocuments.length === 0 &&\n tombstoneDocumentSummaries.length === 0\n ? null\n : [...discoveredDocuments, ...tombstoneDocumentSummaries];\n}\n\nasync function refreshAllContainerDocuments({\n listContainerParentLanes,\n ...input\n}: RefreshAllContainerDocumentsOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const containerIds = await listAllRemoteContainerIds(\n listContainerParentLanes,\n );\n if (!containerIds) {\n return null;\n }\n\n return discoverAllContainerDocuments({\n ...input,\n containerIds,\n });\n}\n\nexport function refreshAllContainerDocumentsFromApi({\n apiClient,\n ...input\n}: RefreshAllContainerDocumentsFromApiOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n return refreshAllContainerDocuments({\n ...input,\n listContainerDocumentLanes: (lanes) =>\n listContainerDocumentLanesFromApi(apiClient, lanes),\n listContainerParentLanes: (input) =>\n apiClient.listContainerParentLanes(input),\n });\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qCAAqC,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAa1E,MAAM,qCAAqC,GAAG,CAAC,CAAC;AAWhD,KAAK,UAAU,4BAA4B,CACzC,wBAAmF,EACnF,cAA2D;IAE3D,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CACpD,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IACE,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YACpC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI;QACJ,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAoC,EACpC,gBAA6B,EAC7B,YAAsB;IAEtB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA8B,EAC9B,gBAAqC;IAErC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CACR,4BAA4B,CAAC,KAAK,CAAC;QACnC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,wBAAmF;IAEnF,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAE,EAAE;QAClD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,eAAe,CAAC,IAAI,CAAC,CAAC;IAEtB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI;YACJ,OAAO,EAAE;gBACP,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;SACF,CAAC,CAAC,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,4BAA4B,CACpD,wBAAwB,EACxB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,iBAAiB,GAAmC,EAAE,CAAC;QAE7D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,MAAM,WAAW,IAAI,yBAAyB,CACjD,QAAQ,CAAC,KAAK,EACd,gBAAgB,EAChB,YAAY,CACb,EAAE,CAAC;gBACF,eAAe,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,iBAAiB,CAAC,IAAI,CAAC;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,QAAQ,CAAC,aAAa;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,SAA0E;IAE1E,OAAO,yBAAyB,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,GAAG,IAAI,EAC2B;IAClC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,8BAA8B,CAAC;QACrD,UAAU,EAAE,MAAM,sBAAsB,EAAE;QAC1C,KAAK,EAAE,CAAC,IAAI,CAAC;QACb,0BAA0B;QAC1B,8BAA8B;KAC/B,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;IACzD,OAAO,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,EAChD,SAAS,EACT,GAAG,KAAK,EAMT;IACC,OAAO,0BAA0B,CAAC;QAChC,GAAG,KAAK;QACR,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,iCAAiC,CAAC,SAAS,EAAE,KAAK,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAiE;IAEjE,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC9C,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,MAAM,EACJ,gCAAgC,EAChC,YAAY,EACZ,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,GAAG,OAAO,CAAC;IACZ,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CACjE,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAC1D,MAAM,0BAA0B,GAAG,MAAM,kBAAkB,CAAC;QAC1D,YAAY,EAAE,kBAAkB;QAChC,0BAA0B;QAC1B,8BAA8B;KAC/B,CAAC,CAAC;IACH,MAAM,gCAAgC,EAAE,CACtC,+BAA+B,CAC7B,0BAA0B,CAAC,OAAO,CAChC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CACtB,eAAe,EAAE,KAAK,CAAC,OAAO,CAC5B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAC5C,IAAI,EAAE,CACV,CACF,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAC1D,+BAA+B,CAAC,0BAA0B,CAAC,EAC3D,kBAAkB,EAClB,UAAU,EACV,mCAAmC,CAAC,0BAA0B,CAAC,CAChE,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,wBAAwB,GAAG,YAAY,CAAC,MAAM,CAAC;IACrD,MAAM,mBAAmB,GACvB,wBAAwB,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAEhE,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,yBAAyB,CAC7B,MAAM,4BAA4B,CAChC,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,kBAAkB;SACvC,CAAC,CAAC,EACH,mBAAmB,CACpB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;QACzE,YAAY,EAAE,0BAA0B,CAAC,OAAO,CAC9C,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE,CACnC,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACvC;QACD,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,mCAAmC,CAAC,0BAA0B,CAAC;KAC5E,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,OAAO,CAAC,GAAG,CACf,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE,CAClE,eAAe;QACb,CAAC,CAAC,qCAAqC,CAAC;YACpC,WAAW;YACX,eAAe;YACf,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ;QACd,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,0BAA0B,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,0BAA0B,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,EAC1C,wBAAwB,EACxB,GAAG,KAAK,EAC4B;IACpC,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,6BAA6B,CAAC;QACnC,GAAG,KAAK;QACR,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,EAClD,SAAS,EACT,GAAG,KAAK,EACmC;IAC3C,OAAO,4BAA4B,CAAC;QAClC,GAAG,KAAK;QACR,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,iCAAiC,CAAC,SAAS,EAAE,KAAK,CAAC;QACrD,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { isDocumentUpdateCreatedEvent } from \"../../../data/documents/documentSync\";\nimport { dedupeReferencedPrincipalStates } from \"../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { withoutDeferredDocumentLinks } from \"../documentLinks/deferredDocumentLinks\";\nimport { settleContainerDocumentTombstones } from \"../tombstones/documentTombstoneGate\";\nimport {\n listContainerDocumentLanesFromApi,\n listContainerDocumentsFromWatermarks,\n} from \"./containerDocumentListing\";\nimport { saveAppliedContainerDocumentWatermark } from \"./documentDiscoveryApply\";\nimport {\n collectApplicableDocumentTombstones,\n collectDiscoveredDocumentInputs,\n} from \"./documentDiscoveryInputs\";\nimport { discoverContainerDocumentLanes } from \"./documentDiscoveryLanes\";\nimport type {\n ContainerDocumentDiscoveryApi,\n ContainerParentDiscoveryLane,\n DiscoverAllContainerDocumentsOptions,\n DiscoverContainerDocumentsOptions,\n ListedContainerDocumentsLane,\n RefreshAllContainerDocumentsFromApiOptions,\n RefreshAllContainerDocumentsOptions,\n} from \"./documentDiscoveryTypes\";\n\nexport type { RefreshAllContainerDocumentsFromApiOptions } from \"./documentDiscoveryTypes\";\n\nconst CONTAINER_PARENT_DISCOVERY_BATCH_SIZE = 4;\n\ntype ContainerParentLaneRequest = Parameters<\n ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"]\n>[0][\"lanes\"][number];\n\ninterface RequestedContainerParentLane {\n lane: ContainerParentDiscoveryLane;\n request: ContainerParentLaneRequest;\n}\n\nasync function listContainerParentLaneBatch(\n listContainerParentLanes: ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"],\n requestedLanes: ReadonlyArray<RequestedContainerParentLane>,\n) {\n const response = await listContainerParentLanes({\n lanes: requestedLanes.map(({ request }) => request),\n });\n if (!response \|\| response.results.length !== requestedLanes.length) {\n return null;\n }\n\n const requestedLaneIds = new Set(\n requestedLanes.map(({ request }) => request.laneId),\n );\n const pagesByLaneId = new Map<\n string,\n (typeof response.results)[number][\"page\"]\n >();\n for (const result of response.results) {\n if (\n !requestedLaneIds.has(result.laneId) \|\|\n pagesByLaneId.has(result.laneId)\n ) {\n return null;\n }\n pagesByLaneId.set(result.laneId, result.page);\n }\n\n return requestedLanes.map(({ lane, request }) => ({\n lane,\n response: pagesByLaneId.get(request.laneId),\n }));\n}\n\nfunction collectRemoteContainerIds(\n items: ReadonlyArray<{ id: string }>,\n seenContainerIds: Set<string>,\n containerIds: string[],\n): ReadonlyArray<string> {\n for (const { id } of items) {\n if (!seenContainerIds.has(id)) {\n seenContainerIds.add(id);\n containerIds.push(id);\n }\n }\n\n return items.map(({ id }) => id);\n}\n\nexport function hasUndiscoveredDocumentUpdateEvent(\n events: ReadonlyArray<unknown>,\n knownDocumentIds: ReadonlySet<string>,\n): boolean {\n return events.some(\n (event) =>\n isDocumentUpdateCreatedEvent(event) &&\n !knownDocumentIds.has(event.documentId),\n );\n}\n\nexport async function listAllRemoteContainerIds(\n listContainerParentLanes: ContainerDocumentDiscoveryApi[\"listContainerParentLanes\"],\n): Promise<ReadonlyArray<string> \| null> {\n const containerIds: string[] = [];\n const queuedParentIds = new Set<string \| null>();\n const seenContainerIds = new Set<string>();\n const lanes: ContainerParentDiscoveryLane[] = [];\n let nextLaneId = 0;\n const queueParentLane = (parentId: string \| null) => {\n if (queuedParentIds.has(parentId)) {\n return;\n }\n\n queuedParentIds.add(parentId);\n lanes.push({ parentId, watermark: null });\n };\n\n queueParentLane(null);\n\n while (lanes.length > 0) {\n const laneBatch = lanes.splice(0, CONTAINER_PARENT_DISCOVERY_BATCH_SIZE);\n const requestedLanes = laneBatch.map((lane) => ({\n lane,\n request: {\n laneId: `container-parent-${nextLaneId++}`,\n parentId: lane.parentId,\n watermark: lane.watermark,\n },\n }));\n const listedLanes = await listContainerParentLaneBatch(\n listContainerParentLanes,\n requestedLanes,\n );\n if (!listedLanes) {\n return null;\n }\n const continuationLanes: ContainerParentDiscoveryLane[] = [];\n\n for (const { lane, response } of listedLanes) {\n if (!response) {\n return null;\n }\n\n for (const containerId of collectRemoteContainerIds(\n response.items,\n seenContainerIds,\n containerIds,\n )) {\n queueParentLane(containerId);\n }\n\n if (response.hasMore) {\n if (!response.nextWatermark) {\n return null;\n }\n continuationLanes.push({\n parentId: lane.parentId,\n watermark: response.nextWatermark,\n });\n }\n }\n\n lanes.unshift(...continuationLanes);\n }\n\n return containerIds;\n}\n\nexport function listAllRemoteContainerIdsFromApi(\n apiClient: Pick<ContainerDocumentDiscoveryApi, \"listContainerParentLanes\">,\n): Promise<ReadonlyArray<string> \| null> {\n return listAllRemoteContainerIds((input) =>\n apiClient.listContainerParentLanes(input),\n );\n}\n\nexport async function discoverContainerDocuments({\n beginDocumentDiscovery,\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n ...lane\n}: DiscoverContainerDocumentsOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const [outcome] = await discoverContainerDocumentLanes({\n generation: await beginDocumentDiscovery(),\n lanes: [lane],\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n });\n if (outcome?.status === \"rejected\") throw outcome.reason;\n return outcome?.value ?? null;\n}\n\nexport function discoverContainerDocumentsFromApi({\n apiClient,\n ...input\n}: Omit<DiscoverContainerDocumentsOptions, \"listContainerDocumentLanes\"> & {\n readonly apiClient: Pick<\n ContainerDocumentDiscoveryApi,\n \"listContainerDocumentLanes\"\n >;\n}): Promise<ReadonlyArray<DocumentSummary> \| null> {\n return discoverContainerDocuments({\n ...input,\n listContainerDocumentLanes: (lanes) =>\n listContainerDocumentLanesFromApi(apiClient, lanes),\n });\n}\n\nasync function listDiscoveryLanes(\n input: Parameters<typeof listContainerDocumentsFromWatermarks>[0],\n): Promise<ListedContainerDocumentsLane[]> {\n const listed = await listContainerDocumentsFromWatermarks(input);\n return input.containerIds.map((containerId) => ({\n containerId,\n listedDocuments: listed.get(containerId) ?? null,\n }));\n}\n\nexport async function discoverAllContainerDocuments(\n options: DiscoverAllContainerDocumentsOptions,\n): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const {\n cacheReferencedPrincipalPolicies,\n containerIds,\n loadContainerDocumentWatermark,\n listContainerDocumentLanes,\n replaceDocumentLinksBatch,\n saveContainerDocumentWatermark,\n upsertDiscoveredDocuments,\n } = options;\n const uniqueContainerIds = Array.from(new Set(containerIds)).filter(\n (containerId): containerId is string =>\n typeof containerId === \"string\" && containerId.length > 0,\n );\n const generation = await options.beginDocumentDiscovery();\n const listedDocumentsByContainer = await listDiscoveryLanes({\n containerIds: uniqueContainerIds,\n listContainerDocumentLanes,\n loadContainerDocumentWatermark,\n });\n await cacheReferencedPrincipalPolicies?.(\n dedupeReferencedPrincipalStates(\n listedDocumentsByContainer.flatMap(\n ({ listedDocuments }) =>\n listedDocuments?.items.flatMap(\n (document) => document.referencedPrincipals,\n ) ?? [],\n ),\n ),\n );\n const verification = await options.verifyDiscoveredDocuments(\n collectDiscoveredDocumentInputs(listedDocumentsByContainer),\n uniqueContainerIds,\n generation,\n collectApplicableDocumentTombstones(listedDocumentsByContainer),\n );\n if (!(await verification.isCurrent())) return null;\n const discoveredDocumentInputs = verification.inputs;\n const discoveredDocuments =\n discoveredDocumentInputs.length === 0\n ? []\n : await upsertDiscoveredDocuments(discoveredDocumentInputs);\n\n if (discoveredDocumentInputs.length > 0) {\n await replaceDocumentLinksBatch(\n await withoutDeferredDocumentLinks(\n discoveredDocumentInputs.map((input) => ({\n documentId: input.documentId,\n accessEpoch: input.accessEpoch,\n containerIds: input.linkedContainerIds,\n })),\n discoveredDocuments,\n ),\n );\n }\n\n const tombstoneDocumentSummaries = await settleContainerDocumentTombstones({\n containerIds: listedDocumentsByContainer.flatMap(\n ({ containerId, listedDocuments }) =>\n listedDocuments ? [containerId] : [],\n ),\n store: options,\n tombstones: collectApplicableDocumentTombstones(listedDocumentsByContainer),\n });\n\n const complete = await verification.commit();\n if (!(await verification.isCurrent())) return null;\n\n await Promise.all(\n listedDocumentsByContainer.map(({ containerId, listedDocuments }) =>\n listedDocuments\n ? saveAppliedContainerDocumentWatermark({\n containerId,\n listedDocuments,\n saveContainerDocumentWatermark,\n })\n : undefined,\n ),\n );\n\n return !complete &&\n discoveredDocuments.length === 0 &&\n tombstoneDocumentSummaries.length === 0\n ? null\n : [...discoveredDocuments, ...tombstoneDocumentSummaries];\n}\n\nasync function refreshAllContainerDocuments({\n listContainerParentLanes,\n ...input\n}: RefreshAllContainerDocumentsOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n const containerIds = await listAllRemoteContainerIds(\n listContainerParentLanes,\n );\n if (!containerIds) {\n return null;\n }\n\n return discoverAllContainerDocuments({\n ...input,\n containerIds,\n });\n}\n\nexport function refreshAllContainerDocumentsFromApi({\n apiClient,\n ...input\n}: RefreshAllContainerDocumentsFromApiOptions): Promise<ReadonlyArray<DocumentSummary> \| null> {\n return refreshAllContainerDocuments({\n ...input,\n listContainerDocumentLanes: (lanes) =>\n listContainerDocumentLanesFromApi(apiClient, lanes),\n listContainerParentLanes: (input) =>\n apiClient.listContainerParentLanes(input),\n });\n}\n"]}

package/workflows/container-contents/metadata/metadataSyncErrors.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { isDocumentSyncUpdateIsolationError } from "../../../data/documents/shared/documentSyncUpdateIsolation.js";
 import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, } from "../../../data/keyingProjectionVerification/error.js";
-import { isPrincipalPolicyNotCachedError } from "../../../data/keyingProjectionVerification/principalPolicyVerification.js";
+import { isPrincipalPolicyNotCachedError } from "../../../data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js";
 function isStaleContainerMetadataSecurityStateError(error) {
     // Signed-state verification failures are terminal integrity incidents, even
     // when their diagnostic message resembles an ordinary stale-key condition.

package/workflows/container-contents/metadata/metadataSyncErrors.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"metadataSyncErrors.js","sourceRoot":"","sources":["metadataSyncErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,4DAA4D,CAAC;AAChH,OAAO,EACL,yBAAyB,EACzB,yCAAyC,GAC1C,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,+BAA+B,EAAE,MAAM,~~wEAAwE~~,CAAC;~~AAGzH~~,SAAS,0CAA0C,CAAC,KAAc;IAChE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO,CACL,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE;QACD,OAAO,CAAC,UAAU,CAAC,6CAA6C,CAAC;QACjE,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC;QAC1D,OAAO,CAAC,UAAU,CAAC,iDAAiD,CAAC;QACrE,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACpD,OAAO,KAAK,oCAAoC;QAChD,OAAO,KAAK,4CAA4C,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,IAAI,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,yCAAyC,CAC7C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;SAClD,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iEAAiE,KAAK,CAAC,WAAW,kEAAkE,CACrJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,0CAA0C,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,6CAA6C,CACjH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,2DAA2D,CAC/H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { isDocumentSyncUpdateIsolationError } from \"../../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n isKeyingVerificationError,\n reportKeyingVerificationErrorInCauseChain,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { isPrincipalPolicyNotCachedError } from \"../../../data/keyingProjectionVerification/principalPolicyVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\n\nfunction isStaleContainerMetadataSecurityStateError(error: unknown): boolean {\n // Signed-state verification failures are terminal integrity incidents, even\n // when their diagnostic message resembles an ordinary stale-key condition.\n if (isKeyingVerificationError(error)) return false;\n const message = error instanceof Error ? error.message : \"\";\n\n return (\n message.startsWith(\n \"Document authorizing container KEK path could not be unwrapped\",\n ) \|\|\n message.startsWith(\"Document content key could not be unwrapped\") \|\|\n message.startsWith(\"Document content-key bundle is stale\") \|\|\n message.startsWith(\"Document content-key re-wrap KEK is unavailable\") \|\|\n message.startsWith(\"Document stale-bundle recovery\") \|\|\n message === \"Document sync target hash mismatch\" \|\|\n message === \"Document sync content-key targets mismatch\"\n );\n}\n\nexport async function deferRecoverableMetadataSyncError(input: {\n containerId: string;\n error: unknown;\n runtime: {\n auth: { organizationId: string \| null };\n util: {\n log: (message: string) => void;\n reportSecurityIncident: SecurityIncidentReporter;\n };\n };\n}): Promise<null> {\n if (isDocumentSyncUpdateIsolationError(input.error)) {\n await reportKeyingVerificationErrorInCauseChain(\n input.error,\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.containerId,\n objectKind: \"container\",\n operation: \"container.metadata.sync\",\n organizationId: input.runtime.auth.organizationId,\n },\n );\n input.runtime.util.log(\n `Container contents: quarantined incoming metadata updates for ${input.containerId}; deferred this container without blocking later metadata syncs.`,\n );\n return null;\n }\n\n if (isStaleContainerMetadataSecurityStateError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because its content-key targets are stale.`,\n );\n return null;\n }\n\n // A cold principal-policy cache is transient: warming already ran and failed\n // within this attempt. Keep the needing-sync state set for the next trigger.\n if (isPrincipalPolicyNotCachedError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because a referenced principal policy is not cached yet.`,\n );\n return null;\n }\n\n throw input.error;\n}\n"]}
1	+ {"version":3,"file":"metadataSyncErrors.js","sourceRoot":"","sources":["metadataSyncErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,4DAA4D,CAAC;AAChH,OAAO,EACL,yBAAyB,EACzB,yCAAyC,GAC1C,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wFAAwF,CAAC;AAGzI,SAAS,0CAA0C,CAAC,KAAc;IAChE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO,CACL,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE;QACD,OAAO,CAAC,UAAU,CAAC,6CAA6C,CAAC;QACjE,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC;QAC1D,OAAO,CAAC,UAAU,CAAC,iDAAiD,CAAC;QACrE,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACpD,OAAO,KAAK,oCAAoC;QAChD,OAAO,KAAK,4CAA4C,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,IAAI,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,yCAAyC,CAC7C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;SAClD,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iEAAiE,KAAK,CAAC,WAAW,kEAAkE,CACrJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,0CAA0C,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,6CAA6C,CACjH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kDAAkD,KAAK,CAAC,WAAW,2DAA2D,CAC/H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { isDocumentSyncUpdateIsolationError } from \"../../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n isKeyingVerificationError,\n reportKeyingVerificationErrorInCauseChain,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { isPrincipalPolicyNotCachedError } from \"../../../data/keyingProjectionVerification/principalPolicy/principalPolicyVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\n\nfunction isStaleContainerMetadataSecurityStateError(error: unknown): boolean {\n // Signed-state verification failures are terminal integrity incidents, even\n // when their diagnostic message resembles an ordinary stale-key condition.\n if (isKeyingVerificationError(error)) return false;\n const message = error instanceof Error ? error.message : \"\";\n\n return (\n message.startsWith(\n \"Document authorizing container KEK path could not be unwrapped\",\n ) \|\|\n message.startsWith(\"Document content key could not be unwrapped\") \|\|\n message.startsWith(\"Document content-key bundle is stale\") \|\|\n message.startsWith(\"Document content-key re-wrap KEK is unavailable\") \|\|\n message.startsWith(\"Document stale-bundle recovery\") \|\|\n message === \"Document sync target hash mismatch\" \|\|\n message === \"Document sync content-key targets mismatch\"\n );\n}\n\nexport async function deferRecoverableMetadataSyncError(input: {\n containerId: string;\n error: unknown;\n runtime: {\n auth: { organizationId: string \| null };\n util: {\n log: (message: string) => void;\n reportSecurityIncident: SecurityIncidentReporter;\n };\n };\n}): Promise<null> {\n if (isDocumentSyncUpdateIsolationError(input.error)) {\n await reportKeyingVerificationErrorInCauseChain(\n input.error,\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.containerId,\n objectKind: \"container\",\n operation: \"container.metadata.sync\",\n organizationId: input.runtime.auth.organizationId,\n },\n );\n input.runtime.util.log(\n `Container contents: quarantined incoming metadata updates for ${input.containerId}; deferred this container without blocking later metadata syncs.`,\n );\n return null;\n }\n\n if (isStaleContainerMetadataSecurityStateError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because its content-key targets are stale.`,\n );\n return null;\n }\n\n // A cold principal-policy cache is transient: warming already ran and failed\n // within this attempt. Keep the needing-sync state set for the next trigger.\n if (isPrincipalPolicyNotCachedError(input.error)) {\n input.runtime.util.log(\n `Container contents: deferred metadata sync for ${input.containerId} because a referenced principal policy is not cached yet.`,\n );\n return null;\n }\n\n throw input.error;\n}\n"]}

package/workflows/container-contents/remoteHydration/destination/destinationPrefetch.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"destinationPrefetch.js","sourceRoot":"","sources":["destinationPrefetch.ts"],"names":[],"mappings":"AAQA,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2C,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,KACE,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,EACjC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAC1D,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,EAC7B,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE;oBAC1B,UAAU,EACR,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACxD,WAAW,CACZ;iBACJ,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { RemoteContainerHydrationState } from \"../types\";\n\n/** A projection fetched ahead of sequential verification. */\nexport interface PrefetchedDestinationProjection {\n readonly projection: ContainerWriterProjectionResponse | null;\n}\n\nconst DESTINATION_PREFETCH_CONCURRENCY = 4;\n\n/**\n * Fetch the writer projections of newly discovered folders with bounded\n * concurrency, so a fresh device does not pay one round trip per folder in\n * series. Verification stays sequential and consumes these results. A failed\n * fetch is omitted: verification refetches and reports it.\n */\nexport async function prefetchDestinationProjections(input: {\n containerIds: ReadonlyArray<string>;\n isCurrent?: (() => boolean) | undefined;\n runtime: RemoteContainerHydrationState[\"runtime\"];\n}): Promise<ReadonlyMap<string, PrefetchedDestinationProjection>> {\n const prefetched = new Map<string, PrefetchedDestinationProjection>();\n const pending = [...input.containerIds];\n const fetchNext = async (): Promise<void> => {\n for (\n let containerId = pending.shift();\n containerId !== undefined && input.isCurrent?.() !== false;\n containerId = pending.shift()\n ) {\n try {\n prefetched.set(containerId, {\n projection:\n await input.runtime.apiClient.getContainerWriterProjection(\n containerId,\n ),\n });\n } catch {\n // Verification refetches this folder and reports the failure.\n }\n }\n };\n await Promise.all(\n Array.from(\n { length: Math.min(DESTINATION_PREFETCH_CONCURRENCY, pending.length) },\n fetchNext,\n ),\n );\n return prefetched;\n}\n"]}

package/workflows/container-contents/remoteHydration/destination/destinationRoleCache.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"destinationRoleCache.js","sourceRoot":"","sources":["destinationRoleCache.ts"],"names":[],"mappings":"AAmBA,MAAM,eAAe,GAAG,IAAI,OAAO,EAA6B,CAAC;AACjE,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,SAAS,cAAc,CAAC,QAA6B;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,MAA2B;IAE3B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,MAA2B,EAC3B,IAAqB;IAErB,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,6DAA6D;IAC7D,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;QAC3B,IAAI,CAAC,QAAQ,KAAK,IAAI;QACtB,IAAI,CAAC,UAAU,KAAK,IAAI,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAClD,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACvB,CAAC","sourcesContent":["import type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { RemoteContainer } from \"../types\";\n\nexport interface DestinationRole\n extends Pick<RemoteContainer, \"metadataDocumentId\" | \"systemSlot\"> {\n /** Fixed parent only for roots/system slots; ordinary parent edges can move. */\n readonly parentId?: string | null;\n /** Signer of the epoch-1 `container.create`; immutable through successors. */\n readonly createSignerUserId: string;\n readonly rootContainerId: string;\n readonly rootCreateManifestHash: string;\n readonly rootMetadataDocumentId: string;\n}\n/** Roles are verified and cached under the container's id and organization. */\ntype DestinationIdentity = Pick<RemoteContainer, \"id\" | \"organizationId\">;\ninterface DestinationRoles {\n fixed: Map<string, DestinationRole>;\n ordinary: Map<string, DestinationRole>;\n}\nconst rolesByDatabase = new WeakMap<ExecSql, DestinationRoles>();\nconst MAX_ROLES = 1_000;\n\nfunction destinationKey(identity: DestinationIdentity): string {\n return JSON.stringify([identity.organizationId, identity.id]);\n}\n\nexport function cachedDestinationRole(\n execSql: ExecSql,\n listed: DestinationIdentity,\n): DestinationRole | undefined {\n const roles = rolesByDatabase.get(execSql);\n const key = destinationKey(listed);\n return roles?.fixed.get(key) ?? roles?.ordinary.get(key);\n}\n\nexport function rememberDestinationRole(\n execSql: ExecSql,\n listed: DestinationIdentity,\n role: DestinationRole,\n): void {\n // Shared verification forbids moves of roots and system containers, and all\n // successors preserve the signed slot, metadata id and creator. Cache only\n // these immutable fields; authority, key material and ordinary parent edges\n // remain outside this cache. Reuse does not authorize any read or write\n // operation, so logout and identity switches do not need to invalidate these\n // roles: the session-root creator check runs on every reuse.\n if (\n role.parentId !== undefined &&\n role.parentId !== null &&\n role.systemSlot === null\n ) {\n throw new Error(\n \"Ordinary container parents cannot enter the immutable binding cache\",\n );\n }\n let cache = rolesByDatabase.get(execSql);\n if (!cache) {\n cache = { fixed: new Map(), ordinary: new Map() };\n rolesByDatabase.set(execSql, cache);\n }\n // Ordinary directory growth must not evict root/system reconciliation roles.\n // Both buckets are bounded independently.\n const roles = role.parentId === undefined ? cache.ordinary : cache.fixed;\n const key = destinationKey(listed);\n if (roles.size >= MAX_ROLES && !roles.has(key)) {\n const oldest = roles.keys().next().value;\n if (oldest !== undefined) roles.delete(oldest);\n }\n roles.set(key, role);\n}\n"]}

package/workflows/container-contents/remoteHydration/{destinationRootReload.js → destination/destinationRootReload.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { withMetadataRootReload } from "../../organizations/groupMetadata/groupMetadataErrors.js";
+import { withMetadataRootReload } from "../../../organizations/groupMetadata/groupMetadataErrors.js";
 /**
  * Reads a destination again once when its metadata root was behind the
  * directory. A prefetched projection is that same stale root, so the reread

package/workflows/container-contents/remoteHydration/destination/destinationRootReload.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"destinationRootReload.js","sourceRoot":"","sources":["destinationRootReload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAElG;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAI3C,KAAY,EACZ,OAA0C,EAC1C,SAAqB;IAErB,OAAO,sBAAsB,CAC3B,CAAC,MAAM,EAAE,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EACzE,SAAS,CACV,CAAC;AACJ,CAAC","sourcesContent":["import { withMetadataRootReload } from \"../../../organizations/groupMetadata/groupMetadataErrors\";\n\n/**\n * Reads a destination again once when its metadata root was behind the\n * directory. A prefetched projection is that same stale root, so the reread\n * drops it and fetches after `evictRoot` clears the cached one.\n */\nexport function resolveWithMetadataRootReload<\n Input extends { readonly prefetchedProjection?: unknown },\n Result,\n>(\n input: Input,\n resolve: (input: Input) => Promise<Result>,\n evictRoot: () => void,\n): Promise<Result> {\n return withMetadataRootReload(\n (reread) =>\n resolve(reread ? { ...input, prefetchedProjection: undefined } : input),\n evictRoot,\n );\n}\n"]}

package/workflows/container-contents/remoteHydration/{replacementBinding.js → destination/replacementBinding.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
-import { assertHeldContainerBinding, } from "../../../data/containers/containerBinding.js";
-import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { loadOrganizationFounder } from "../../../data/persistence/organizationFounderPersistence.js";
-import { persistOrganizationReplacementCheckpoints } from "../../../data/persistence/organizationReplacementCheckpointPersistence.js";
+import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../../internal/crypto/index.js";
+import { assertHeldContainerBinding, } from "../../../../data/containers/containerBinding.js";
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { loadOrganizationFounder } from "../../../../data/persistence/organizationFounderPersistence.js";
+import { persistOrganizationReplacementCheckpoints } from "../../../../data/persistence/organizationReplacementCheckpointPersistence.js";
 async function acceptsSharedReplacement(input, oldOrganizationId) {
     const { listed, role, runtime } = input;
     const founder = await loadOrganizationFounder(runtime.infra.execSql, oldOrganizationId);

package/workflows/container-contents/remoteHydration/destination/replacementBinding.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"replacementBinding.js","sourceRoot":"","sources":["replacementBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2EAA2E,CAAC;AAYtI,KAAK,UAAU,wBAAwB,CACrC,KAAmB,EACnB,iBAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;IACJ,IAAI,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;QAClE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,QAAQ,GACZ,MAAM,OAAO,CAAC,SAAS,CAAC,2CAA2C,CACjE,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,oCAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAC5B,iBAAiB,EACjB,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,IACE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,cAAc;QAC9C,kBAAkB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM;QAC7C,kBAAkB,CAAC,qBAAqB;YACtC,OAAO,CAAC,qBAAqB;QAC/B,kBAAkB,CAAC,gBAAgB,KAAK,IAAI,CAAC,qBAAqB;QAClE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;QAC7C,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,gBAAgB;QACrD,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,sBAAsB;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,yCAAyC,CAAC;QAC9C,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAkC,EAClC,iBAAyB,EACzB,MAAc,EACd,gBAA4B;IAE5B,IAAI,QAAQ,GAAG,iBAAiB,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,IAES,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,0CAA0C,CACtD,SAAS,EACT,gBAAgB,CACjB,CAAC;QACF,IACE,KAAK,CAAC,sBAAsB,KAAK,QAAQ;YACzC,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;YAEjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;QACJ,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO;IAC5D,IAAI,IAAI,EAAE,kBAAkB,KAAK,IAAI;QACnC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,IAAI,EAAE,cAAc;QACpB,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,UAAU,KAAK,IAAI;QACxB,CAAC,MAAM,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO;IACT,0BAA0B,CAAC,IAAI,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n assertHeldContainerBinding,\n type HeldContainerBinding,\n} from \"../../../../data/containers/containerBinding\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { loadOrganizationFounder } from \"../../../../data/persistence/organizationFounderPersistence\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../../../data/persistence/organizationReplacementCheckpointPersistence\";\nimport type { RemoteContainer, RemoteContainerHydrationState } from \"../types\";\nimport type { DestinationRole } from \"./destinationRoleCache\";\n\nexport interface BindingInput {\n readonly stillCurrent?: (() => boolean) | undefined;\n readonly heldBinding: HeldContainerBinding | null;\n readonly listed: Pick<RemoteContainer, \"id\" | \"organizationId\">;\n readonly role: DestinationRole;\n readonly runtime: RemoteContainerHydrationState[\"runtime\"];\n}\n\nasync function acceptsSharedReplacement(\n input: BindingInput,\n oldOrganizationId: string,\n): Promise<boolean> {\n const { listed, role, runtime } = input;\n const founder = await loadOrganizationFounder(\n runtime.infra.execSql,\n oldOrganizationId,\n );\n if (!founder || role.createSignerUserId !== founder.userId) return false;\n const identity = await runtime.resolveTrustedUserIdentity(founder.userId);\n if (!identity)\n throw new ProjectionDependencyUnavailableError(\n \"Replacement founder identity is unavailable\",\n );\n if (identity.signingKeyFingerprint !== founder.signingKeyFingerprint)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"Replacement founder differs from the held organization's pinned identity\",\n );\n const response =\n await runtime.apiClient.getContainerReplacementAuthorizationsResult(\n listed.id,\n oldOrganizationId,\n );\n if (!response.ok) {\n if (response.status === 404) return false;\n throw new ProjectionDependencyUnavailableError(response.message);\n }\n const last = verifyReplacementLineage(\n response.data.authorizations,\n oldOrganizationId,\n founder.userId,\n identity.signingPublicKey,\n );\n const replacementFounder = await loadOrganizationFounder(\n runtime.infra.execSql,\n listed.organizationId,\n );\n if (\n last?.organizationId !== listed.organizationId ||\n replacementFounder?.userId !== founder.userId ||\n replacementFounder.signingKeyFingerprint !==\n founder.signingKeyFingerprint ||\n replacementFounder.genesisStateHash !== last.organizationStateHash ||\n role.rootContainerId !== last.rootContainerId ||\n role.rootCreateManifestHash !== last.rootManifestHash ||\n role.rootMetadataDocumentId !== last.rootMetadataDocumentId\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization does not bind the destination genesis\",\n );\n // The founder also commits the reserved groups' genesis. Pin those even\n // when the readable folder's projection does not cite both groups yet.\n await persistOrganizationReplacementCheckpoints({\n authorization: last,\n execSql: runtime.infra.execSql,\n stillCurrent: input.stillCurrent,\n });\n return true;\n}\n\nfunction verifyReplacementLineage(\n authorizations: readonly unknown[],\n oldOrganizationId: string,\n userId: string,\n signingPublicKey: Uint8Array,\n) {\n let expected = oldOrganizationId;\n const visited = new Set([expected]);\n let last:\n | ReturnType<typeof verifyOrganizationReplacementAuthorization>\n | undefined;\n for (const candidate of authorizations) {\n const proof = verifyOrganizationReplacementAuthorization(\n candidate,\n signingPublicKey,\n );\n if (\n proof.replacesOrganizationId !== expected ||\n proof.userId !== userId ||\n visited.has(proof.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization lineage does not extend the held organization\",\n );\n expected = proof.organizationId;\n visited.add(expected);\n last = proof;\n }\n return last;\n}\n\n/** A foreign creator needs the held organization's pinned founder to authorize rehome. */\nexport async function assertPermittedDestinationBinding(\n input: BindingInput,\n): Promise<void> {\n const { heldBinding: held, listed, role, runtime } = input;\n if (role.createSignerUserId === runtime.auth.userId) return;\n if (held?.metadataDocumentId === null)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"a local folder can bind only to its own signed create\",\n );\n if (\n held?.organizationId &&\n held.organizationId !== listed.organizationId &&\n role.systemSlot === null &&\n (await acceptsSharedReplacement(input, held.organizationId))\n )\n return;\n assertHeldContainerBinding(held, {\n organizationId: listed.organizationId,\n metadataDocumentIds: [role.metadataDocumentId],\n });\n}\n"]}

package/workflows/container-contents/remoteHydration/{verifiedDestination.js → destination/verifiedDestination.js} RENAMED Viewed

@@ -1,12 +1,12 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "../../../internal/validators/containerSystemSlot.js";
-import { listingRepeatsHeldOrdinaryBinding, } from "../../../data/containers/containerBinding.js";
-import { verifiedContainerCreateManifest } from "../../../data/keyingProjectionVerification/containerCreateManifest.js";
-import { verifyContainerDestinationProjection } from "../../../data/keyingProjectionVerification/containerDestinationVerification.js";
-import { verifyContainerWriterProjection } from "../../../data/keyingProjectionVerification/containerProjectionVerification.js";
-import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, runWithSecurityIncidentReporting, } from "../../../data/keyingProjectionVerification/error.js";
-import { verifyRuntimeGroupMetadataAuthority } from "../../organizations/groupMetadata/runtimeGroupMetadataAuthority.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../../../../internal/validators/containerSystemSlot.js";
+import { listingRepeatsHeldOrdinaryBinding, } from "../../../../data/containers/containerBinding.js";
+import { verifiedContainerCreateManifest } from "../../../../data/keyingProjectionVerification/container/containerCreateManifest.js";
+import { verifyContainerDestinationProjection } from "../../../../data/keyingProjectionVerification/container/containerDestinationVerification.js";
+import { verifyContainerWriterProjection } from "../../../../data/keyingProjectionVerification/container/containerProjectionVerification.js";
+import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, runWithSecurityIncidentReporting, } from "../../../../data/keyingProjectionVerification/error.js";
+import { verifyRuntimeGroupMetadataAuthority } from "../../../organizations/groupMetadata/runtimeGroupMetadataAuthority.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
 import { cachedDestinationRole, rememberDestinationRole, } from "./destinationRoleCache.js";
 import { resolveWithMetadataRootReload } from "./destinationRootReload.js";
 import { assertPermittedDestinationBinding } from "./replacementBinding.js";

package/workflows/container-contents/remoteHydration/destination/verifiedDestination.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"verifiedDestination.js","sourceRoot":"","sources":["verifiedDestination.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAC1G,OAAO,EAEL,iCAAiC,GAClC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,oCAAoC,EAAE,MAAM,0FAA0F,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,yFAAyF,CAAC;AAC1I,OAAO,EACL,yBAAyB,EACzB,yCAAyC,EACzC,gCAAgC,GACjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAO7F,OAAO,EACL,qBAAqB,EAErB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAKzE,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6CAA6C,CAAC;QACvE,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,+BAA+B,CAAC;QAClD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QACtC,IAAI,EAAE;YACJ,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;YACpD,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW;YAC9C,sBAAsB,EAAE,WAAW,CAAC,YAAY;YAChD,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,kBAAkB;YAC5D,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;gBACzC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CACrC,IAAqB,EACrB,OAAiD;IAEjD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IACE,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE;QACpC,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,0BAA0B;QAClD,YAAY,EAAE,SAAS;QACvB,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAC5B,MAAM,oCAAoC,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,MAAM;QACN,IAAI;QACJ,cAAc;KACf,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;IAC7B,uEAAuE;IACvE,MAAM,iCAAiC,CAAC;QACtC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,MAAM,mCAAmC,CAAC;YACxC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,8EAA8E;QAC9E,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC;YACxD,GAAG,iBAAiB;YACpB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,KAAK,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAiBD,iFAAiF;AACjF,KAAK,UAAU,sBAAsB,CACnC,KAA4C;IAM5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB;QAClE,SAAS;QACT,MAAM;QACN,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EACN,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,8BAA8B;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,EACD,KAAK,IAAI,EAAE;QACT,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,IACE,CAAC,KAAK,CAAC,OAAO;YACd,iCAAiC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAC5D,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YACf,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,sBAAsB,EACtB,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAClE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,+DAA+D;YAC/D,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QACpC,qEAAqE;QACrE,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC3B,MAAM,iCAAiC,CAAC;gBACtC,YAAY,EAAE,SAAS;gBACvB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM;gBACN,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,IAAI,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,QAAQ,CAAC,eAAe;YAC1B,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,4BAA4B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,GAAG,MAAM;YACT,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC7D,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAChC,eAA+B,EAC/B,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,OAAO,CACL,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,CAAC,SAAS,CAAC,UAAU;QACrB,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe;QACrC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAG7D;IACC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,0BAA0B;YACrC,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CACF,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import {\n type AccessManifestCheckpoint,\n KeyingVerificationError,\n type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport {\n type HeldContainerBinding,\n listingRepeatsHeldOrdinaryBinding,\n} from \"../../../../data/containers/containerBinding\";\nimport { verifiedContainerCreateManifest } from \"../../../../data/keyingProjectionVerification/container/containerCreateManifest\";\nimport { verifyContainerDestinationProjection } from \"../../../../data/keyingProjectionVerification/container/containerDestinationVerification\";\nimport { verifyContainerWriterProjection } from \"../../../../data/keyingProjectionVerification/container/containerProjectionVerification\";\nimport {\n isKeyingVerificationError,\n reportKeyingVerificationErrorInCauseChain,\n runWithSecurityIncidentReporting,\n} from \"../../../../data/keyingProjectionVerification/error\";\nimport { verifyRuntimeGroupMetadataAuthority } from \"../../../organizations/groupMetadata/runtimeGroupMetadataAuthority\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type {\n ContainerState,\n RemoteContainer,\n RemoteContainerHydrationState,\n} from \"../types\";\nimport type { PrefetchedDestinationProjection } from \"./destinationPrefetch\";\nimport {\n cachedDestinationRole,\n type DestinationRole,\n rememberDestinationRole,\n} from \"./destinationRoleCache\";\nimport { resolveWithMetadataRootReload } from \"./destinationRootReload\";\nimport { assertPermittedDestinationBinding } from \"./replacementBinding\";\n\n/** The identity a role is verified and cached under. */\ntype DestinationIdentity = Pick<RemoteContainer, \"id\" | \"organizationId\">;\n\nasync function destinationRoleFromPath(input: {\n listed: DestinationIdentity;\n path: readonly VerifiedContainerAccessManifest[];\n verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<{ role: DestinationRole; parentId: string | null }> {\n const { listed, path } = input;\n const head = path.at(-1);\n if (\n !head ||\n head.state.containerId !== listed.id ||\n head.state.organizationId !== listed.organizationId\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"container destination manifest has the wrong identity\",\n );\n }\n const metadataSlot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: listed.organizationId,\n });\n if (\n head.state.systemSlot !== null &&\n path.length !== (head.state.systemSlot === metadataSlot ? 1 : 2)\n ) {\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"system destination has the wrong signed topology\",\n );\n }\n // The head may be a later grant signed by any admin; only the epoch-1\n // create names the creator, and roots are always created by the org owner.\n const created = verifiedContainerCreateManifest({\n head,\n label: \"Container destination\",\n verifiedByHash: input.verifiedByHash,\n });\n const root = path[0];\n if (!root) throw new Error(\"Destination root is unavailable\");\n const rootCreated = verifiedContainerCreateManifest({\n head: root,\n label: \"Destination root\",\n verifiedByHash: input.verifiedByHash,\n });\n return {\n parentId: head.state.parentContainerId,\n role: {\n createSignerUserId: created.event.event.signerUserId,\n rootContainerId: rootCreated.state.containerId,\n rootCreateManifestHash: rootCreated.manifestHash,\n rootMetadataDocumentId: rootCreated.state.metadataDocumentId,\n metadataDocumentId: head.state.metadataDocumentId,\n ...(head.state.parentContainerId === null ||\n head.state.systemSlot !== null\n ? { parentId: head.state.parentContainerId }\n : {}),\n systemSlot: head.state.systemSlot,\n },\n };\n}\n\n/**\n * The session's root id arrives in an unsigned login response, so the root it\n * names must prove it belongs to this user: every acknowledged organization was\n * created by the session user, whose device signed the root's `container.create`.\n * A verified root created by anyone else is a substitution, never the merge\n * target for pre-login local content, whatever grants it carries. The check\n * runs on cache reuse too, since the cache is not scoped to the session user.\n */\nfunction assertRootCreatedBySessionUser(\n role: DestinationRole,\n runtime: RemoteContainerHydrationState[\"runtime\"],\n): void {\n if (role.systemSlot !== null) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"acknowledged session root cannot be a system container\",\n );\n }\n if (role.createSignerUserId !== runtime.auth.userId) {\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"acknowledged session root was not created by the session user\",\n );\n }\n}\n\nfunction assertAcknowledgedRootSigner(input: {\n listed: DestinationIdentity;\n role: DestinationRole;\n runtime: RemoteContainerHydrationState[\"runtime\"];\n}): void {\n const { listed, role, runtime } = input;\n if (role.parentId !== null || listed.id !== runtime.auth.rootContainerId) {\n return;\n }\n assertRootCreatedBySessionUser(role, runtime);\n}\n\n/**\n * Authenticate destination roles before admitting a binding or advancing any\n * placement pin. Shared rehomes additionally require signed replacement evidence.\n */\nasync function verifyDestinationRole(input: {\n heldBinding: HeldContainerBinding | null;\n prefetched: PrefetchedDestinationProjection | undefined;\n verifyCurrentPlacement: boolean;\n onVerifiedCheckpoint:\n | ((checkpoint: AccessManifestCheckpoint) => void)\n | undefined;\n isCurrent?: (() => boolean) | undefined;\n listed: DestinationIdentity;\n runtime: RemoteContainerHydrationState[\"runtime\"];\n}): Promise<{ role: DestinationRole; parentId: string | null } | null> {\n const { isCurrent, listed, runtime } = input;\n const projection = input.prefetched\n ? input.prefetched.projection\n : await runtime.apiClient.getContainerWriterProjection(listed.id);\n if (!projection || isCurrent?.() === false) return null;\n if (\n projection.containerId !== listed.id ||\n projection.organizationId !== listed.organizationId\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"container destination projection has the wrong identity\",\n );\n }\n const verificationInput = {\n execSql: runtime.infra.execSql,\n projection,\n resolveUserKey: runtime.resolveTrustedUserIdentity,\n stillCurrent: isCurrent,\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n };\n const { path, verifiedByHash } =\n await verifyContainerDestinationProjection(verificationInput);\n if (isCurrent?.() === false) return null;\n const destination = await destinationRoleFromPath({\n listed,\n path,\n verifiedByHash,\n });\n const { role } = destination;\n // Refuse a rebinding before group checks or placement pins run for it.\n await assertPermittedDestinationBinding({\n stillCurrent: isCurrent,\n heldBinding: input.heldBinding,\n listed,\n role,\n runtime,\n });\n if (isCurrent?.() === false) return null;\n if (role.parentId === null && role.systemSlot !== null) {\n const head = path.at(-1);\n if (!head) throw new Error(\"Metadata root manifest is unavailable\");\n await verifyRuntimeGroupMetadataAuthority({\n runtime,\n organizationId: listed.organizationId,\n organizationReference: projection.policyEvidence.organization?.head,\n state: head.state,\n stillCurrent: isCurrent ?? (() => true),\n });\n }\n if (isCurrent?.() === false) return null;\n if (input.verifyCurrentPlacement) {\n // Check the immutable role before allowing current placement to advance pins.\n assertAcknowledgedRootSigner({ listed, role, runtime });\n const currentPath = await verifyContainerWriterProjection({\n ...verificationInput,\n stillCurrent: isCurrent,\n });\n const currentHead = currentPath.at(-1);\n if (!currentHead)\n throw new Error(\"Recovery placement manifest is unavailable\");\n input.onVerifiedCheckpoint?.(currentHead.checkpoint);\n }\n if (isCurrent?.() === false) return null;\n return destination;\n}\n\ntype VerifyRemoteContainerDestinationInput = {\n heldBinding: HeldContainerBinding | null;\n /** The held folder was re-homed away from the listed organization. */\n supersededListing?: boolean | undefined;\n /** Fetched ahead by page hydration; ignored when placement is refreshed. */\n prefetchedProjection?: PrefetchedDestinationProjection | undefined;\n refresh?: boolean;\n onVerifiedCheckpoint?:\n | ((checkpoint: AccessManifestCheckpoint) => void)\n | undefined;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n isCurrent?: (() => boolean) | undefined;\n};\n\n/** A cached immutable role, or a freshly verified one with its signed parent. */\nasync function resolveDestinationRole(\n input: VerifyRemoteContainerDestinationInput,\n): Promise<{\n freshlyVerified: boolean;\n parentId: string | null | undefined;\n role: DestinationRole;\n} | null> {\n const { remoteContainer: listed, isCurrent } = input;\n const runtime = input.state.runtime;\n const cached = input.refresh\n ? undefined\n : cachedDestinationRole(runtime.infra.execSql, listed);\n // Ordinary parent edges are not immutable. A refresh authenticates current\n // placement; a forged root hint must also be corrected from a signed path.\n if (cached && !(cached.parentId === undefined && listed.parentId === null)) {\n return { freshlyVerified: false, parentId: cached.parentId, role: cached };\n }\n const verified = await verifyDestinationRole({\n heldBinding: input.heldBinding,\n prefetched: input.refresh ? undefined : input.prefetchedProjection,\n isCurrent,\n listed,\n runtime,\n verifyCurrentPlacement: input.refresh === true,\n onVerifiedCheckpoint: input.onVerifiedCheckpoint,\n });\n if (!verified) return null;\n return {\n freshlyVerified: true,\n parentId:\n input.refresh || listed.parentId === null\n ? verified.parentId\n : verified.role.parentId,\n role: verified.role,\n };\n}\n\n/**\n * Listing hints never establish a metadata target or a system/root role, and a\n * held folder keeps its organization and metadata target unless its own user\n * re-created it or its pinned founder authorized a verified replacement.\n * A conflicting proof is refused before placement pins\n * advance or its role is cached.\n */\nexport async function verifyRemoteContainerDestination(\n input: VerifyRemoteContainerDestinationInput,\n): Promise<RemoteContainer | null> {\n const { remoteContainer: listed, state, isCurrent } = input;\n const runtime = state.runtime;\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: listed.id,\n objectKind: \"container\",\n operation: \"container.destination.verify\",\n organizationId: listed.organizationId,\n },\n async () => {\n if (input.supersededListing) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"container was re-homed away from the listed organization\",\n );\n }\n // A held ordinary binding was verified (or signed by this device) when\n // it was stored; a listing that repeats it needs no second proof.\n if (\n !input.refresh &&\n listingRepeatsHeldOrdinaryBinding(input.heldBinding, listed)\n ) {\n return { ...listed, systemSlot: null };\n }\n if (input.refresh)\n runtime.apiClient.evictContainerWriterProjection(listed.id);\n // A metadata root read before a reserved-group commit is reloaded once.\n const resolved = await resolveWithMetadataRootReload(\n input,\n resolveDestinationRole,\n () => runtime.apiClient.evictContainerWriterProjection(listed.id),\n ).catch((error: unknown) => {\n // Never re-serve a cached projection that failed verification.\n if (isKeyingVerificationError(error))\n runtime.apiClient.evictContainerWriterProjection(listed.id);\n throw error;\n });\n if (!resolved || isCurrent?.() === false) return null;\n const { role, parentId } = resolved;\n // Fresh verification checked this binding before any placement pins.\n // A cached role still needs the held binding and replacement proof checked.\n if (!resolved.freshlyVerified)\n await assertPermittedDestinationBinding({\n stillCurrent: isCurrent,\n heldBinding: input.heldBinding,\n listed,\n role,\n runtime,\n });\n if (isCurrent?.() === false) return null;\n if (resolved.freshlyVerified)\n rememberDestinationRole(runtime.infra.execSql, listed, role);\n assertAcknowledgedRootSigner({ listed, role, runtime });\n return {\n ...listed,\n metadataDocumentId: role.metadataDocumentId,\n parentId: parentId === undefined ? listed.parentId : parentId,\n systemSlot: role.systemSlot,\n };\n },\n );\n}\n\n/** The root the unsigned login answer named, in the expected organization. */\nexport function isSessionRootState(\n remoteRootState: ContainerState,\n state: RemoteContainerHydrationState,\n): boolean {\n const { container } = remoteRootState;\n const { auth } = state.runtime;\n return (\n container.parentId === null &&\n !container.systemSlot &&\n container.id === auth.rootContainerId &&\n container.organizationId === auth.organizationId\n );\n}\n\n/**\n * Whether the session root may absorb the pre-login local roots. The unsigned\n * login answer only names the root; the merge target must also be the verified\n * root whose epoch-1 `container.create` the session user signed. A row persisted\n * earlier as an ordinary shared container (another user's root this device once\n * hydrated) never passed that check for this session, so the creator is checked\n * here, at the reconciliation boundary itself, before any local content is\n * re-parented. The role comes only from the cache remote hydration fills when\n * it verifies the destination: this gate never fetches, so a local refresh stays\n * independent of the network. Without a cached role the merge is left pending\n * (no incident) until hydration verifies the root and reconciles from the\n * cache. A different creator is a `signer_mismatch` incident and never a merge;\n * the refusal is the \"no merge\" outcome, so the refresh that carried it\n * completes with the local content left in place.\n */\nexport async function isVerifiedLocalRootReconciliationTarget(input: {\n remoteRootState: ContainerState;\n state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n const { remoteRootState, state } = input;\n const { container } = remoteRootState;\n const runtime = state.runtime;\n if (!isSessionRootState(remoteRootState, state)) return false;\n const role = cachedDestinationRole(runtime.infra.execSql, container);\n if (!role) return false;\n try {\n if (role.parentId !== null) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"session root reconciliation target is not a verified root\",\n );\n }\n assertRootCreatedBySessionUser(role, runtime);\n return true;\n } catch (error) {\n const reported = await reportKeyingVerificationErrorInCauseChain(\n error,\n runtime.util.reportSecurityIncident,\n {\n objectId: container.id,\n objectKind: \"container\",\n operation: \"container.root.reconcile\",\n organizationId: container.organizationId,\n },\n );\n if (!reported) throw error;\n return false;\n }\n}\n"]}

package/workflows/container-contents/remoteHydration/index.js CHANGED Viewed

@@ -1,10 +1,10 @@
 import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { createContainerChildIndex } from "./childIndex.js";
 import { finishRemoteHydration } from "./completeHydration.js";
-import { createContainerParentHydrationQueue } from "./parentLaneQueue.js";
+import { createContainerChildIndex } from "./lanes/childIndex.js";
+import { createContainerParentHydrationQueue } from "./lanes/parentLaneQueue.js";
 import { cacheRemoteContainerPrincipalPolicies } from "./principalPolicyCache.js";
-import { canHydrateRemoteContainers, hydrateContainerParentLanes, } from "./remoteContainerPageHydration.js";
-import { listRemoteContainerIdsWithPendingMetadataUpdates, listRemoteContainerIdsWithPendingStructuralIntents, upsertIsolatedRemoteContainerState, } from "./remoteContainerState.js";
+import { canHydrateRemoteContainers, hydrateContainerParentLanes, } from "./remoteContainers/remoteContainerPageHydration.js";
+import { listRemoteContainerIdsWithPendingMetadataUpdates, listRemoteContainerIdsWithPendingStructuralIntents, upsertIsolatedRemoteContainerState, } from "./remoteContainers/remoteContainerState.js";
 export class StaleRemoteHydrationError extends Error {
 }
 export function createGenerationGuardedHydrationHost(input) {

package/workflows/container-contents/remoteHydration/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,gDAAgD,EAChD,kDAAkD,EAClD,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAgBhC,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAEvD,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,qBAAqB,EAAE,KAAK,EAC1B,cAAc,EACd,KAAK,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,EAAE;YACF,MAAM,eAAe,GAAG,eAAe,EAAE,SAAS,CAAC;YACnD,MAAM,SAAS,GAAG,eAAe;gBAC/B,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,eAAe,EAAE;gBAC9C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CACnD,cAAc,EACd,KAAK,EACL,UAAU,EACV,WAAW,EACX,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,CAClC,CAAC;YACF,aAAa,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB;YACnC,CAAC,CAAC;gBACE,sBAAsB,EAAE,GAAG,EAAE;oBAC3B,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;wBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;oBACxC,CAAC;gBACH,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE,GAAG,EAAE;YACnB,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAS,+BAA+B,CACtC,KAAoC;IAEpC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,mBAAmB;QACpC,UAAU,EAAE,KAAK,CAAC,oBAAoB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,IAAiD,EACjD,KAAsC;IAEtC,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,UAA2C,EAC3C,uBAA2D,EAC3D,KAAiC,EACjC,eAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,eAAe;QACjD,qCAAqC,CACnC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,EAC/C,UAAU,CACX,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAU1C;IACC,MAAM,EACJ,sCAAsC,EACtC,wCAAwC,EACxC,UAAU,EACV,uBAAuB,EACvB,IAAI,EACJ,KAAK,EACL,qBAAqB,EACrB,KAAK,GACN,GAAG,KAAK,CAAC;IACV,IACE,CAAC,KAAK,CAAC,SAAS,EAAE;QAClB,CAAC,8BAA8B,CAC7B,UAAU,EACV,uBAAuB,EACvB,KAAK,EACL,qBAAqB,CACtB,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,gCAAgC,CACzE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CAAC;IACF,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC;QACxD,0BAA0B,EACxB,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,qBAAqB,CAAC,EAAE,CAAC;YACtE,IAAI;QACN,sCAAsC;QACtC,wCAAwC;QACxC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,qBAAqB;QACtC,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qCAAqC,CAAC,KAM9C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,qBAAqB,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjE,IACE,8BAA8B,CAC5B,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,uBAAuB,EAC7B,KAAK,CAAC,KAAK,EACX,qBAAqB,CACtB,EACD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAO9C;IACC,MAAM,EAAE,UAAU,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1E,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,MAAM,sBAAsB,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC9D,CAAC,eAAe,EAAE,EAAE,CAClB,qCAAqC,CACnC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,EAC/C,UAAU,CACX,CACJ,CAAC;YACF,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,qCAAqC,CAAC;gBAC1C,gCAAgC,EAAE,kCAAkC,CAClE,KAAK,CAAC,OAAO,CACd;gBACD,gBAAgB,EAAE,sBAAsB;gBACxC,YAAY,EAAE,KAAK,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,CACJ,sCAAsC,EACtC,wCAAwC,EACzC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpB,gDAAgD,CAAC;oBAC/C,gBAAgB,EAAE,sBAAsB;oBACxC,KAAK;iBACN,CAAC;gBACF,kDAAkD,CAAC;oBACjD,gBAAgB,EAAE,sBAAsB;oBACxC,KAAK;iBACN,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,qBAAqB,IAAI,sBAAsB,EAAE,CAAC;gBAC3D,oBAAoB;oBAClB,CAAC,MAAM,2BAA2B,CAAC;wBACjC,sCAAsC;wBACtC,wCAAwC;wBACxC,UAAU;wBACV,uBAAuB;wBACvB,IAAI;wBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,KAAK;wBACL,qBAAqB;wBACrB,KAAK;qBACN,CAAC,CAAC,IAAI,oBAAoB,CAAC;YAChC,CAAC;YACD,qCAAqC,CAAC;gBACpC,UAAU;gBACV,uBAAuB;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK;gBACL,sBAAsB;aACvB,CAAC,CAAC;YAEH,IAAI,oBAAoB,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wCAAwC,CAC/C,KAAoC,EACpC,UAA2C;IAE3C,OAAO,qCAAqC,CAC1C,+BAA+B,CAAC,KAAK,CAAC,EACtC,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAS,0CAA0C,CAAC,KAKnD;IACC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,YAAY,GAChB,iBAAiB,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS;QAC1D,iBAAiB,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/D,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACtE,IAAI,CAAC,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9B,MAAM,2BAA2B,GAA+B,IAAI,GAAG,EAAE,CAAC;IAC1E,MAAM,uBAAuB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAC9E,IAAI,6BAA6B,GAAyB,IAAI,CAAC;IAE/D,MAAM,iBAAiB,GAAG,GAAkB,EAAE;QAC5C,IAAI,6BAA6B,EAAE,CAAC;YAClC,OAAO,6BAA6B,CAAC,IAAI,CACvC,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,IACE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EACxC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,oBAAoB,GAAG,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/D,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxE,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,2BAA2B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACpD,OAAO,iBAAiB,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,oCAAoC,CAAC;YACvD,IAAI;YACJ,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE;aAClC,IAAI,CAAC,GAAG,EAAE,CACT,+BAA+B,CAAC;YAC9B,UAAU;YACV,uBAAuB;YACvB,IAAI,EAAE,WAAW;YACjB,SAAS;YACT,KAAK,EAAE,2BAA2B;YAClC,KAAK;SACN,CAAC,CACH;aACA,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjB,0CAA0C,CAAC;oBACzC,UAAU;oBACV,uBAAuB;oBACvB,KAAK,EAAE,2BAA2B;oBAClC,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/D,0CAA0C,CAAC;oBACzC,UAAU;oBACV,uBAAuB;oBACvB,KAAK,EAAE,2BAA2B;oBAClC,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,6BAA6B,KAAK,WAAW,EAAE,CAAC;gBAClD,6BAA6B,GAAG,IAAI,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,6BAA6B,GAAG,WAAW,CAAC;QAC5C,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAC3B,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CACvE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAAC,eAAgC,EAAE,EAAE;QACjE,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrE,uBAAuB,CAAC,GAAG,CACzB,eAAe,CAAC,EAAE,EAClB,+BAA+B,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,qBAAqB,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9E,qBAAqB,CAAC,MAAM,GAAG,iBAAiB,CAAC;IACjD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,mCAAmC,CAAC;QACrE,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC,CAAC;IACH,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,yBAAyB,GAA6B,CAAC,WAAW,EAAE,EAAE;QAC1E,IACE,KAAK,CAAC,2BAA2B;YACjC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACvE,CAAC;YACD,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,kBAAkB;QAClB,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,eAAe,EAAE,yBAAyB;QAC1C,gBAAgB;QAChB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChC,MAAM,qBAAqB,CAAC;QAC1B,YAAY;QACZ,QAAQ,EACN,MAAM,CAAC,QAAQ;YACf,0BAA0B,CAAC,KAAK,CAAC;YACjC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAC/B,2BAA2B;QAC3B,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB;QAChB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport { createContainerChildIndex } from \"./childIndex\";\nimport { finishRemoteHydration } from \"./completeHydration\";\nimport { createContainerParentHydrationQueue } from \"./parentLaneQueue\";\nimport { cacheRemoteContainerPrincipalPolicies } from \"./principalPolicyCache\";\nimport {\n canHydrateRemoteContainers,\n hydrateContainerParentLanes,\n} from \"./remoteContainerPageHydration\";\nimport {\n listRemoteContainerIdsWithPendingMetadataUpdates,\n listRemoteContainerIdsWithPendingStructuralIntents,\n upsertIsolatedRemoteContainerState,\n} from \"./remoteContainerState\";\nimport type {\n QueueContainerParentLane,\n RemoteContainer,\n RemoteContainerHydrationHost,\n RemoteContainerHydrationState,\n RemoteContainerIngestQueue,\n} from \"./types\";\n\nexport type {\n ContainerState,\n PersistContainerStateResult,\n RemoteContainer,\n RemoteContainerHydrationHost,\n} from \"./types\";\n\nexport class StaleRemoteHydrationError extends Error {}\n\nexport function createGenerationGuardedHydrationHost(input: {\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n}): RemoteContainerHydrationHost {\n const assertCurrent = () => {\n if (!input.isCurrent()) {\n throw new StaleRemoteHydrationError();\n }\n };\n\n return {\n persistContainerState: async (\n containerState,\n patch,\n updateView,\n saveOptions,\n mutationOptions,\n ) => {\n const callerIsCurrent = mutationOptions?.isCurrent;\n const isCurrent = callerIsCurrent\n ? () => input.isCurrent() && callerIsCurrent()\n : input.isCurrent;\n assertCurrent();\n const record = await input.host.persistContainerState(\n containerState,\n patch,\n updateView,\n saveOptions,\n { ...mutationOptions, isCurrent },\n );\n assertCurrent();\n return record;\n },\n ...(input.host.requestDocumentPriming\n ? {\n requestDocumentPriming: () => {\n if (input.isCurrent()) {\n input.host.requestDocumentPriming?.();\n }\n },\n }\n : {}),\n updateSnapshot: () => {\n if (input.isCurrent()) {\n input.host.updateSnapshot();\n }\n },\n };\n}\n\ninterface RemoteContainerIngestGeneration {\n readonly lifecycle: number \| undefined;\n readonly structural: number \| undefined;\n}\ntype RemoteContainerIngestGenerationMap = Map<\n string,\n RemoteContainerIngestGeneration\n>;\n\nfunction remoteContainerIngestGeneration(\n state: RemoteContainerHydrationState,\n): RemoteContainerIngestGeneration {\n return {\n lifecycle: state.lifecycleGeneration,\n structural: state.structuralGeneration,\n };\n}\n\nfunction remoteContainerIngestGenerationsMatch(\n left: RemoteContainerIngestGeneration \| undefined,\n right: RemoteContainerIngestGeneration,\n): boolean {\n return (\n left !== undefined &&\n left.lifecycle === right.lifecycle &&\n left.structural === right.structural\n );\n}\n\nfunction isCurrentQueuedRemoteContainer(\n generation: RemoteContainerIngestGeneration,\n generationByContainerId: RemoteContainerIngestGenerationMap,\n queue: RemoteContainerIngestQueue,\n remoteContainer: RemoteContainer,\n): boolean {\n return (\n queue.get(remoteContainer.id) === remoteContainer &&\n remoteContainerIngestGenerationsMatch(\n generationByContainerId.get(remoteContainer.id),\n generation,\n )\n );\n}\n\nasync function upsertQueuedRemoteContainer(input: {\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n queuedRemoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n const {\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n generation,\n generationByContainerId,\n host,\n queue,\n queuedRemoteContainer,\n state,\n } = input;\n if (\n !input.isCurrent() \|\|\n !isCurrentQueuedRemoteContainer(\n generation,\n generationByContainerId,\n queue,\n queuedRemoteContainer,\n )\n ) {\n return false;\n }\n\n const tombstones = await state.persistence.loadContainerHydrationTombstones(\n state.runtime.infra.execSql,\n );\n // A refused folder is reported and acknowledged; the batch continues.\n const upserted = await upsertIsolatedRemoteContainerState({\n expectedHydrationTombstone:\n tombstones.find((row) => row.containerId === queuedRemoteContainer.id) ??\n null,\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n host,\n isCurrent: input.isCurrent,\n remoteContainer: queuedRemoteContainer,\n state,\n });\n if (!upserted) {\n return false;\n }\n return true;\n}\n\nfunction acknowledgeRemoteContainerIngestBatch(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n queuedRemoteContainers: ReadonlyArray<RemoteContainer>;\n}): void {\n if (!input.isCurrent()) {\n return;\n }\n for (const queuedRemoteContainer of input.queuedRemoteContainers) {\n if (\n isCurrentQueuedRemoteContainer(\n input.generation,\n input.generationByContainerId,\n input.queue,\n queuedRemoteContainer,\n )\n ) {\n input.queue.delete(queuedRemoteContainer.id);\n input.generationByContainerId.delete(queuedRemoteContainer.id);\n }\n }\n}\n\nasync function drainRemoteContainerIngestQueue(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n state: RemoteContainerHydrationState;\n}) {\n const { generation, generationByContainerId, host, queue, state } = input;\n let shouldUpdateSnapshot = false;\n\n try {\n while (input.isCurrent()) {\n const queuedRemoteContainers = Array.from(queue.values()).filter(\n (remoteContainer) =>\n remoteContainerIngestGenerationsMatch(\n generationByContainerId.get(remoteContainer.id),\n generation,\n ),\n );\n if (queuedRemoteContainers.length === 0) {\n return;\n }\n await cacheRemoteContainerPrincipalPolicies({\n cacheReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n state.runtime,\n ),\n remoteContainers: queuedRemoteContainers,\n stillCurrent: input.isCurrent,\n });\n if (!input.isCurrent()) {\n return;\n }\n const [\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n ] = await Promise.all([\n listRemoteContainerIdsWithPendingMetadataUpdates({\n remoteContainers: queuedRemoteContainers,\n state,\n }),\n listRemoteContainerIdsWithPendingStructuralIntents({\n remoteContainers: queuedRemoteContainers,\n state,\n }),\n ]);\n if (!input.isCurrent()) {\n return;\n }\n\n for (const queuedRemoteContainer of queuedRemoteContainers) {\n shouldUpdateSnapshot =\n (await upsertQueuedRemoteContainer({\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n generation,\n generationByContainerId,\n host,\n isCurrent: input.isCurrent,\n queue,\n queuedRemoteContainer,\n state,\n })) \|\| shouldUpdateSnapshot;\n }\n acknowledgeRemoteContainerIngestBatch({\n generation,\n generationByContainerId,\n isCurrent: input.isCurrent,\n queue,\n queuedRemoteContainers,\n });\n\n if (shouldUpdateSnapshot) {\n host.updateSnapshot();\n shouldUpdateSnapshot = false;\n }\n }\n } catch (error) {\n if (shouldUpdateSnapshot) {\n host.updateSnapshot();\n }\n throw error;\n }\n}\n\nfunction isRemoteContainerIngestGenerationCurrent(\n state: RemoteContainerHydrationState,\n generation: RemoteContainerIngestGeneration,\n): boolean {\n return remoteContainerIngestGenerationsMatch(\n remoteContainerIngestGeneration(state),\n generation,\n );\n}\n\nfunction settleStaleRemoteContainerIngestGeneration(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n queue: RemoteContainerIngestQueue;\n state: RemoteContainerHydrationState;\n}): void {\n const currentGeneration = remoteContainerIngestGeneration(input.state);\n const shouldReplay =\n currentGeneration.lifecycle !== input.generation.lifecycle &&\n currentGeneration.structural === input.generation.structural;\n for (const [containerId, generation] of input.generationByContainerId) {\n if (!remoteContainerIngestGenerationsMatch(generation, input.generation)) {\n continue;\n }\n if (shouldReplay) {\n input.generationByContainerId.set(containerId, currentGeneration);\n } else {\n input.generationByContainerId.delete(containerId);\n input.queue.delete(containerId);\n }\n }\n}\n\ninterface RemoteContainerIngestor {\n (remoteContainer: RemoteContainer): Promise<void>;\n hasPending: () => boolean;\n resume: () => Promise<void>;\n}\n\nexport function createRemoteContainerIngestor(input: {\n getSerializationBarrier?: (() => Promise<void> \| null) \| undefined;\n host: RemoteContainerHydrationHost;\n state: RemoteContainerHydrationState;\n}): RemoteContainerIngestor {\n const { host, state } = input;\n const pendingRemoteContainersById: RemoteContainerIngestQueue = new Map();\n const generationByContainerId: RemoteContainerIngestGenerationMap = new Map();\n let ingestRemoteContainersPromise: Promise<void> \| null = null;\n\n const runNextGeneration = (): Promise<void> => {\n if (ingestRemoteContainersPromise) {\n return ingestRemoteContainersPromise.then(\n runNextGeneration,\n runNextGeneration,\n );\n }\n if (\n state.runtime.infra.dbStatus !== undefined &&\n state.runtime.infra.dbStatus !== \"ready\"\n ) {\n return Promise.resolve();\n }\n const serializationBarrier = input.getSerializationBarrier?.();\n if (serializationBarrier) {\n return serializationBarrier.then(runNextGeneration);\n }\n const nextContainerId = pendingRemoteContainersById.keys().next().value;\n if (typeof nextContainerId !== \"string\") {\n return Promise.resolve();\n }\n const generation = generationByContainerId.get(nextContainerId);\n if (!generation) {\n pendingRemoteContainersById.delete(nextContainerId);\n return runNextGeneration();\n }\n const isCurrent = () =>\n isRemoteContainerIngestGenerationCurrent(state, generation);\n const guardedHost = createGenerationGuardedHydrationHost({\n host,\n isCurrent,\n });\n const nextPromise = Promise.resolve()\n .then(() =>\n drainRemoteContainerIngestQueue({\n generation,\n generationByContainerId,\n host: guardedHost,\n isCurrent,\n queue: pendingRemoteContainersById,\n state,\n }),\n )\n .then(() => {\n if (!isCurrent()) {\n settleStaleRemoteContainerIngestGeneration({\n generation,\n generationByContainerId,\n queue: pendingRemoteContainersById,\n state,\n });\n }\n })\n .catch((error: unknown) => {\n if (!isCurrent() \|\| error instanceof StaleRemoteHydrationError) {\n settleStaleRemoteContainerIngestGeneration({\n generation,\n generationByContainerId,\n queue: pendingRemoteContainersById,\n state,\n });\n return;\n }\n throw error;\n })\n .finally(() => {\n if (ingestRemoteContainersPromise === nextPromise) {\n ingestRemoteContainersPromise = null;\n }\n });\n ingestRemoteContainersPromise = nextPromise;\n return nextPromise.then(() =>\n pendingRemoteContainersById.size > 0 ? runNextGeneration() : undefined,\n );\n };\n\n const ingestRemoteContainer = (remoteContainer: RemoteContainer) => {\n pendingRemoteContainersById.set(remoteContainer.id, remoteContainer);\n generationByContainerId.set(\n remoteContainer.id,\n remoteContainerIngestGeneration(state),\n );\n return runNextGeneration();\n };\n ingestRemoteContainer.hasPending = () => pendingRemoteContainersById.size > 0;\n ingestRemoteContainer.resume = runNextGeneration;\n return ingestRemoteContainer;\n}\n\nexport async function hydrateRemoteContainers(input: {\n followDiscoveredParentLanes?: boolean \| undefined;\n host: RemoteContainerHydrationHost;\n isCurrent?: (() => boolean) \| undefined;\n onFullyHydrated?: (() => Promise<void> \| void) \| undefined;\n parentIds?: ReadonlyArray<string \| null> \| undefined;\n resetAllLaneWatermarks?: boolean \| undefined;\n resetRootLaneWatermark?: boolean \| undefined;\n state: RemoteContainerHydrationState;\n}): Promise<number> {\n const { host, state } = input;\n if (!canHydrateRemoteContainers(state) \|\| input.isCurrent?.() === false) {\n return 0;\n }\n\n const seenContainerIds = new Set<string>();\n const containerIdsBeforeHydration = new Set(state.containersById.keys());\n const childIdsByParentId = createContainerChildIndex(state.containersById);\n const { lanes, queueParentLane } = createContainerParentHydrationQueue({\n containerIds: state.containersById.keys(),\n parentIds: input.parentIds,\n resetAllLaneWatermarks: input.resetAllLaneWatermarks,\n resetRootLaneWatermark: input.resetRootLaneWatermark,\n });\n // Follow child lanes during an explicit recursive crawl or for containers first\n // discovered in this pass. The latter lets a newly authorized root populate its\n // descendants immediately, while routine ticks keep known subtrees cache-first.\n const queueDiscoveredParentLane: QueueContainerParentLane = (containerId) => {\n if (\n input.followDiscoveredParentLanes \|\|\n (containerId !== null && !containerIdsBeforeHydration.has(containerId))\n ) {\n queueParentLane(containerId);\n }\n };\n const result = await hydrateContainerParentLanes({\n childIdsByParentId,\n host,\n isCurrent: input.isCurrent,\n lanes,\n queueParentLane: queueDiscoveredParentLane,\n seenContainerIds,\n state,\n });\n const { changedCount } = result;\n await finishRemoteHydration({\n changedCount,\n complete:\n result.complete &&\n canHydrateRemoteContainers(state) &&\n input.isCurrent?.() !== false,\n containerIdsBeforeHydration,\n host,\n isCurrent: input.isCurrent,\n onFullyHydrated: input.onFullyHydrated,\n seenContainerIds,\n state,\n });\n return changedCount;\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gDAAgD,EAChD,kDAAkD,EAClD,kCAAkC,GACnC,MAAM,yCAAyC,CAAC;AAgBjD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAEvD,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,qBAAqB,EAAE,KAAK,EAC1B,cAAc,EACd,KAAK,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,EAAE;YACF,MAAM,eAAe,GAAG,eAAe,EAAE,SAAS,CAAC;YACnD,MAAM,SAAS,GAAG,eAAe;gBAC/B,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,eAAe,EAAE;gBAC9C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CACnD,cAAc,EACd,KAAK,EACL,UAAU,EACV,WAAW,EACX,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,CAClC,CAAC;YACF,aAAa,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB;YACnC,CAAC,CAAC;gBACE,sBAAsB,EAAE,GAAG,EAAE;oBAC3B,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;wBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;oBACxC,CAAC;gBACH,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE,GAAG,EAAE;YACnB,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAS,+BAA+B,CACtC,KAAoC;IAEpC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,mBAAmB;QACpC,UAAU,EAAE,KAAK,CAAC,oBAAoB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,IAAiD,EACjD,KAAsC;IAEtC,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,UAA2C,EAC3C,uBAA2D,EAC3D,KAAiC,EACjC,eAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,eAAe;QACjD,qCAAqC,CACnC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,EAC/C,UAAU,CACX,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAU1C;IACC,MAAM,EACJ,sCAAsC,EACtC,wCAAwC,EACxC,UAAU,EACV,uBAAuB,EACvB,IAAI,EACJ,KAAK,EACL,qBAAqB,EACrB,KAAK,GACN,GAAG,KAAK,CAAC;IACV,IACE,CAAC,KAAK,CAAC,SAAS,EAAE;QAClB,CAAC,8BAA8B,CAC7B,UAAU,EACV,uBAAuB,EACvB,KAAK,EACL,qBAAqB,CACtB,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,gCAAgC,CACzE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CAAC;IACF,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC;QACxD,0BAA0B,EACxB,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,qBAAqB,CAAC,EAAE,CAAC;YACtE,IAAI;QACN,sCAAsC;QACtC,wCAAwC;QACxC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,qBAAqB;QACtC,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qCAAqC,CAAC,KAM9C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,qBAAqB,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjE,IACE,8BAA8B,CAC5B,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,uBAAuB,EAC7B,KAAK,CAAC,KAAK,EACX,qBAAqB,CACtB,EACD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAO9C;IACC,MAAM,EAAE,UAAU,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1E,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,MAAM,sBAAsB,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC9D,CAAC,eAAe,EAAE,EAAE,CAClB,qCAAqC,CACnC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,EAC/C,UAAU,CACX,CACJ,CAAC;YACF,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,qCAAqC,CAAC;gBAC1C,gCAAgC,EAAE,kCAAkC,CAClE,KAAK,CAAC,OAAO,CACd;gBACD,gBAAgB,EAAE,sBAAsB;gBACxC,YAAY,EAAE,KAAK,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,CACJ,sCAAsC,EACtC,wCAAwC,EACzC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpB,gDAAgD,CAAC;oBAC/C,gBAAgB,EAAE,sBAAsB;oBACxC,KAAK;iBACN,CAAC;gBACF,kDAAkD,CAAC;oBACjD,gBAAgB,EAAE,sBAAsB;oBACxC,KAAK;iBACN,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,qBAAqB,IAAI,sBAAsB,EAAE,CAAC;gBAC3D,oBAAoB;oBAClB,CAAC,MAAM,2BAA2B,CAAC;wBACjC,sCAAsC;wBACtC,wCAAwC;wBACxC,UAAU;wBACV,uBAAuB;wBACvB,IAAI;wBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,KAAK;wBACL,qBAAqB;wBACrB,KAAK;qBACN,CAAC,CAAC,IAAI,oBAAoB,CAAC;YAChC,CAAC;YACD,qCAAqC,CAAC;gBACpC,UAAU;gBACV,uBAAuB;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK;gBACL,sBAAsB;aACvB,CAAC,CAAC;YAEH,IAAI,oBAAoB,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wCAAwC,CAC/C,KAAoC,EACpC,UAA2C;IAE3C,OAAO,qCAAqC,CAC1C,+BAA+B,CAAC,KAAK,CAAC,EACtC,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAS,0CAA0C,CAAC,KAKnD;IACC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,YAAY,GAChB,iBAAiB,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS;QAC1D,iBAAiB,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/D,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACtE,IAAI,CAAC,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9B,MAAM,2BAA2B,GAA+B,IAAI,GAAG,EAAE,CAAC;IAC1E,MAAM,uBAAuB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAC9E,IAAI,6BAA6B,GAAyB,IAAI,CAAC;IAE/D,MAAM,iBAAiB,GAAG,GAAkB,EAAE;QAC5C,IAAI,6BAA6B,EAAE,CAAC;YAClC,OAAO,6BAA6B,CAAC,IAAI,CACvC,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,IACE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EACxC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,oBAAoB,GAAG,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/D,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxE,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,2BAA2B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACpD,OAAO,iBAAiB,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,oCAAoC,CAAC;YACvD,IAAI;YACJ,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE;aAClC,IAAI,CAAC,GAAG,EAAE,CACT,+BAA+B,CAAC;YAC9B,UAAU;YACV,uBAAuB;YACvB,IAAI,EAAE,WAAW;YACjB,SAAS;YACT,KAAK,EAAE,2BAA2B;YAClC,KAAK;SACN,CAAC,CACH;aACA,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjB,0CAA0C,CAAC;oBACzC,UAAU;oBACV,uBAAuB;oBACvB,KAAK,EAAE,2BAA2B;oBAClC,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/D,0CAA0C,CAAC;oBACzC,UAAU;oBACV,uBAAuB;oBACvB,KAAK,EAAE,2BAA2B;oBAClC,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,6BAA6B,KAAK,WAAW,EAAE,CAAC;gBAClD,6BAA6B,GAAG,IAAI,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,6BAA6B,GAAG,WAAW,CAAC;QAC5C,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAC3B,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CACvE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAAC,eAAgC,EAAE,EAAE;QACjE,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrE,uBAAuB,CAAC,GAAG,CACzB,eAAe,CAAC,EAAE,EAClB,+BAA+B,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,qBAAqB,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9E,qBAAqB,CAAC,MAAM,GAAG,iBAAiB,CAAC;IACjD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,mCAAmC,CAAC;QACrE,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC,CAAC;IACH,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,yBAAyB,GAA6B,CAAC,WAAW,EAAE,EAAE;QAC1E,IACE,KAAK,CAAC,2BAA2B;YACjC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACvE,CAAC;YACD,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,kBAAkB;QAClB,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,eAAe,EAAE,yBAAyB;QAC1C,gBAAgB;QAChB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChC,MAAM,qBAAqB,CAAC;QAC1B,YAAY;QACZ,QAAQ,EACN,MAAM,CAAC,QAAQ;YACf,0BAA0B,CAAC,KAAK,CAAC;YACjC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAC/B,2BAA2B;QAC3B,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB;QAChB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport { finishRemoteHydration } from \"./completeHydration\";\nimport { createContainerChildIndex } from \"./lanes/childIndex\";\nimport { createContainerParentHydrationQueue } from \"./lanes/parentLaneQueue\";\nimport { cacheRemoteContainerPrincipalPolicies } from \"./principalPolicyCache\";\nimport {\n canHydrateRemoteContainers,\n hydrateContainerParentLanes,\n} from \"./remoteContainers/remoteContainerPageHydration\";\nimport {\n listRemoteContainerIdsWithPendingMetadataUpdates,\n listRemoteContainerIdsWithPendingStructuralIntents,\n upsertIsolatedRemoteContainerState,\n} from \"./remoteContainers/remoteContainerState\";\nimport type {\n QueueContainerParentLane,\n RemoteContainer,\n RemoteContainerHydrationHost,\n RemoteContainerHydrationState,\n RemoteContainerIngestQueue,\n} from \"./types\";\n\nexport type {\n ContainerState,\n PersistContainerStateResult,\n RemoteContainer,\n RemoteContainerHydrationHost,\n} from \"./types\";\n\nexport class StaleRemoteHydrationError extends Error {}\n\nexport function createGenerationGuardedHydrationHost(input: {\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n}): RemoteContainerHydrationHost {\n const assertCurrent = () => {\n if (!input.isCurrent()) {\n throw new StaleRemoteHydrationError();\n }\n };\n\n return {\n persistContainerState: async (\n containerState,\n patch,\n updateView,\n saveOptions,\n mutationOptions,\n ) => {\n const callerIsCurrent = mutationOptions?.isCurrent;\n const isCurrent = callerIsCurrent\n ? () => input.isCurrent() && callerIsCurrent()\n : input.isCurrent;\n assertCurrent();\n const record = await input.host.persistContainerState(\n containerState,\n patch,\n updateView,\n saveOptions,\n { ...mutationOptions, isCurrent },\n );\n assertCurrent();\n return record;\n },\n ...(input.host.requestDocumentPriming\n ? {\n requestDocumentPriming: () => {\n if (input.isCurrent()) {\n input.host.requestDocumentPriming?.();\n }\n },\n }\n : {}),\n updateSnapshot: () => {\n if (input.isCurrent()) {\n input.host.updateSnapshot();\n }\n },\n };\n}\n\ninterface RemoteContainerIngestGeneration {\n readonly lifecycle: number \| undefined;\n readonly structural: number \| undefined;\n}\ntype RemoteContainerIngestGenerationMap = Map<\n string,\n RemoteContainerIngestGeneration\n>;\n\nfunction remoteContainerIngestGeneration(\n state: RemoteContainerHydrationState,\n): RemoteContainerIngestGeneration {\n return {\n lifecycle: state.lifecycleGeneration,\n structural: state.structuralGeneration,\n };\n}\n\nfunction remoteContainerIngestGenerationsMatch(\n left: RemoteContainerIngestGeneration \| undefined,\n right: RemoteContainerIngestGeneration,\n): boolean {\n return (\n left !== undefined &&\n left.lifecycle === right.lifecycle &&\n left.structural === right.structural\n );\n}\n\nfunction isCurrentQueuedRemoteContainer(\n generation: RemoteContainerIngestGeneration,\n generationByContainerId: RemoteContainerIngestGenerationMap,\n queue: RemoteContainerIngestQueue,\n remoteContainer: RemoteContainer,\n): boolean {\n return (\n queue.get(remoteContainer.id) === remoteContainer &&\n remoteContainerIngestGenerationsMatch(\n generationByContainerId.get(remoteContainer.id),\n generation,\n )\n );\n}\n\nasync function upsertQueuedRemoteContainer(input: {\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n queuedRemoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): Promise<boolean> {\n const {\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n generation,\n generationByContainerId,\n host,\n queue,\n queuedRemoteContainer,\n state,\n } = input;\n if (\n !input.isCurrent() \|\|\n !isCurrentQueuedRemoteContainer(\n generation,\n generationByContainerId,\n queue,\n queuedRemoteContainer,\n )\n ) {\n return false;\n }\n\n const tombstones = await state.persistence.loadContainerHydrationTombstones(\n state.runtime.infra.execSql,\n );\n // A refused folder is reported and acknowledged; the batch continues.\n const upserted = await upsertIsolatedRemoteContainerState({\n expectedHydrationTombstone:\n tombstones.find((row) => row.containerId === queuedRemoteContainer.id) ??\n null,\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n host,\n isCurrent: input.isCurrent,\n remoteContainer: queuedRemoteContainer,\n state,\n });\n if (!upserted) {\n return false;\n }\n return true;\n}\n\nfunction acknowledgeRemoteContainerIngestBatch(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n queuedRemoteContainers: ReadonlyArray<RemoteContainer>;\n}): void {\n if (!input.isCurrent()) {\n return;\n }\n for (const queuedRemoteContainer of input.queuedRemoteContainers) {\n if (\n isCurrentQueuedRemoteContainer(\n input.generation,\n input.generationByContainerId,\n input.queue,\n queuedRemoteContainer,\n )\n ) {\n input.queue.delete(queuedRemoteContainer.id);\n input.generationByContainerId.delete(queuedRemoteContainer.id);\n }\n }\n}\n\nasync function drainRemoteContainerIngestQueue(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n host: RemoteContainerHydrationHost;\n isCurrent: () => boolean;\n queue: RemoteContainerIngestQueue;\n state: RemoteContainerHydrationState;\n}) {\n const { generation, generationByContainerId, host, queue, state } = input;\n let shouldUpdateSnapshot = false;\n\n try {\n while (input.isCurrent()) {\n const queuedRemoteContainers = Array.from(queue.values()).filter(\n (remoteContainer) =>\n remoteContainerIngestGenerationsMatch(\n generationByContainerId.get(remoteContainer.id),\n generation,\n ),\n );\n if (queuedRemoteContainers.length === 0) {\n return;\n }\n await cacheRemoteContainerPrincipalPolicies({\n cacheReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n state.runtime,\n ),\n remoteContainers: queuedRemoteContainers,\n stillCurrent: input.isCurrent,\n });\n if (!input.isCurrent()) {\n return;\n }\n const [\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n ] = await Promise.all([\n listRemoteContainerIdsWithPendingMetadataUpdates({\n remoteContainers: queuedRemoteContainers,\n state,\n }),\n listRemoteContainerIdsWithPendingStructuralIntents({\n remoteContainers: queuedRemoteContainers,\n state,\n }),\n ]);\n if (!input.isCurrent()) {\n return;\n }\n\n for (const queuedRemoteContainer of queuedRemoteContainers) {\n shouldUpdateSnapshot =\n (await upsertQueuedRemoteContainer({\n containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents,\n generation,\n generationByContainerId,\n host,\n isCurrent: input.isCurrent,\n queue,\n queuedRemoteContainer,\n state,\n })) \|\| shouldUpdateSnapshot;\n }\n acknowledgeRemoteContainerIngestBatch({\n generation,\n generationByContainerId,\n isCurrent: input.isCurrent,\n queue,\n queuedRemoteContainers,\n });\n\n if (shouldUpdateSnapshot) {\n host.updateSnapshot();\n shouldUpdateSnapshot = false;\n }\n }\n } catch (error) {\n if (shouldUpdateSnapshot) {\n host.updateSnapshot();\n }\n throw error;\n }\n}\n\nfunction isRemoteContainerIngestGenerationCurrent(\n state: RemoteContainerHydrationState,\n generation: RemoteContainerIngestGeneration,\n): boolean {\n return remoteContainerIngestGenerationsMatch(\n remoteContainerIngestGeneration(state),\n generation,\n );\n}\n\nfunction settleStaleRemoteContainerIngestGeneration(input: {\n generation: RemoteContainerIngestGeneration;\n generationByContainerId: RemoteContainerIngestGenerationMap;\n queue: RemoteContainerIngestQueue;\n state: RemoteContainerHydrationState;\n}): void {\n const currentGeneration = remoteContainerIngestGeneration(input.state);\n const shouldReplay =\n currentGeneration.lifecycle !== input.generation.lifecycle &&\n currentGeneration.structural === input.generation.structural;\n for (const [containerId, generation] of input.generationByContainerId) {\n if (!remoteContainerIngestGenerationsMatch(generation, input.generation)) {\n continue;\n }\n if (shouldReplay) {\n input.generationByContainerId.set(containerId, currentGeneration);\n } else {\n input.generationByContainerId.delete(containerId);\n input.queue.delete(containerId);\n }\n }\n}\n\ninterface RemoteContainerIngestor {\n (remoteContainer: RemoteContainer): Promise<void>;\n hasPending: () => boolean;\n resume: () => Promise<void>;\n}\n\nexport function createRemoteContainerIngestor(input: {\n getSerializationBarrier?: (() => Promise<void> \| null) \| undefined;\n host: RemoteContainerHydrationHost;\n state: RemoteContainerHydrationState;\n}): RemoteContainerIngestor {\n const { host, state } = input;\n const pendingRemoteContainersById: RemoteContainerIngestQueue = new Map();\n const generationByContainerId: RemoteContainerIngestGenerationMap = new Map();\n let ingestRemoteContainersPromise: Promise<void> \| null = null;\n\n const runNextGeneration = (): Promise<void> => {\n if (ingestRemoteContainersPromise) {\n return ingestRemoteContainersPromise.then(\n runNextGeneration,\n runNextGeneration,\n );\n }\n if (\n state.runtime.infra.dbStatus !== undefined &&\n state.runtime.infra.dbStatus !== \"ready\"\n ) {\n return Promise.resolve();\n }\n const serializationBarrier = input.getSerializationBarrier?.();\n if (serializationBarrier) {\n return serializationBarrier.then(runNextGeneration);\n }\n const nextContainerId = pendingRemoteContainersById.keys().next().value;\n if (typeof nextContainerId !== \"string\") {\n return Promise.resolve();\n }\n const generation = generationByContainerId.get(nextContainerId);\n if (!generation) {\n pendingRemoteContainersById.delete(nextContainerId);\n return runNextGeneration();\n }\n const isCurrent = () =>\n isRemoteContainerIngestGenerationCurrent(state, generation);\n const guardedHost = createGenerationGuardedHydrationHost({\n host,\n isCurrent,\n });\n const nextPromise = Promise.resolve()\n .then(() =>\n drainRemoteContainerIngestQueue({\n generation,\n generationByContainerId,\n host: guardedHost,\n isCurrent,\n queue: pendingRemoteContainersById,\n state,\n }),\n )\n .then(() => {\n if (!isCurrent()) {\n settleStaleRemoteContainerIngestGeneration({\n generation,\n generationByContainerId,\n queue: pendingRemoteContainersById,\n state,\n });\n }\n })\n .catch((error: unknown) => {\n if (!isCurrent() \|\| error instanceof StaleRemoteHydrationError) {\n settleStaleRemoteContainerIngestGeneration({\n generation,\n generationByContainerId,\n queue: pendingRemoteContainersById,\n state,\n });\n return;\n }\n throw error;\n })\n .finally(() => {\n if (ingestRemoteContainersPromise === nextPromise) {\n ingestRemoteContainersPromise = null;\n }\n });\n ingestRemoteContainersPromise = nextPromise;\n return nextPromise.then(() =>\n pendingRemoteContainersById.size > 0 ? runNextGeneration() : undefined,\n );\n };\n\n const ingestRemoteContainer = (remoteContainer: RemoteContainer) => {\n pendingRemoteContainersById.set(remoteContainer.id, remoteContainer);\n generationByContainerId.set(\n remoteContainer.id,\n remoteContainerIngestGeneration(state),\n );\n return runNextGeneration();\n };\n ingestRemoteContainer.hasPending = () => pendingRemoteContainersById.size > 0;\n ingestRemoteContainer.resume = runNextGeneration;\n return ingestRemoteContainer;\n}\n\nexport async function hydrateRemoteContainers(input: {\n followDiscoveredParentLanes?: boolean \| undefined;\n host: RemoteContainerHydrationHost;\n isCurrent?: (() => boolean) \| undefined;\n onFullyHydrated?: (() => Promise<void> \| void) \| undefined;\n parentIds?: ReadonlyArray<string \| null> \| undefined;\n resetAllLaneWatermarks?: boolean \| undefined;\n resetRootLaneWatermark?: boolean \| undefined;\n state: RemoteContainerHydrationState;\n}): Promise<number> {\n const { host, state } = input;\n if (!canHydrateRemoteContainers(state) \|\| input.isCurrent?.() === false) {\n return 0;\n }\n\n const seenContainerIds = new Set<string>();\n const containerIdsBeforeHydration = new Set(state.containersById.keys());\n const childIdsByParentId = createContainerChildIndex(state.containersById);\n const { lanes, queueParentLane } = createContainerParentHydrationQueue({\n containerIds: state.containersById.keys(),\n parentIds: input.parentIds,\n resetAllLaneWatermarks: input.resetAllLaneWatermarks,\n resetRootLaneWatermark: input.resetRootLaneWatermark,\n });\n // Follow child lanes during an explicit recursive crawl or for containers first\n // discovered in this pass. The latter lets a newly authorized root populate its\n // descendants immediately, while routine ticks keep known subtrees cache-first.\n const queueDiscoveredParentLane: QueueContainerParentLane = (containerId) => {\n if (\n input.followDiscoveredParentLanes \|\|\n (containerId !== null && !containerIdsBeforeHydration.has(containerId))\n ) {\n queueParentLane(containerId);\n }\n };\n const result = await hydrateContainerParentLanes({\n childIdsByParentId,\n host,\n isCurrent: input.isCurrent,\n lanes,\n queueParentLane: queueDiscoveredParentLane,\n seenContainerIds,\n state,\n });\n const { changedCount } = result;\n await finishRemoteHydration({\n changedCount,\n complete:\n result.complete &&\n canHydrateRemoteContainers(state) &&\n input.isCurrent?.() !== false,\n containerIdsBeforeHydration,\n host,\n isCurrent: input.isCurrent,\n onFullyHydrated: input.onFullyHydrated,\n seenContainerIds,\n state,\n });\n return changedCount;\n}\n"]}

package/workflows/container-contents/remoteHydration/lanes/childIndex.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"childIndex.js","sourceRoot":"","sources":["childIndex.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,wBAAwB,CACtC,kBAAuC,EACvC,WAAmB,EACnB,QAAuB;IAEvB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,kBAAuC,EACvC,WAAmB,EACnB,QAAuB;IAEvB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,kBAAmD,EACnD,WAAmB,EACnB,gBAA+B,EAC/B,YAA2B;IAE3B,IAAI,CAAC,kBAAkB,IAAI,gBAAgB,KAAK,YAAY,EAAE,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,2BAA2B,CACzB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,CACjB,CAAC;IACF,wBAAwB,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,cAAmD;IAEnD,MAAM,kBAAkB,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,KAAK,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,cAAc,EAAE,CAAC;QAC3D,wBAAwB,CACtB,kBAAkB,EAClB,WAAW,EACX,cAAc,CAAC,SAAS,CAAC,QAAQ,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { ContainerChildIndex, ContainerState } from \"../types\";\n\nexport function addIndexedContainerChild(\n childIdsByParentId: ContainerChildIndex,\n containerId: string,\n parentId: string | null,\n) {\n if (parentId === null) {\n return;\n }\n\n const childIds = childIdsByParentId.get(parentId) ?? new Set<string>();\n childIds.add(containerId);\n childIdsByParentId.set(parentId, childIds);\n}\n\nexport function removeIndexedContainerChild(\n childIdsByParentId: ContainerChildIndex,\n containerId: string,\n parentId: string | null,\n) {\n if (parentId === null) {\n return;\n }\n\n const childIds = childIdsByParentId.get(parentId);\n if (!childIds) {\n return;\n }\n\n childIds.delete(containerId);\n if (childIds.size === 0) {\n childIdsByParentId.delete(parentId);\n }\n}\n\nexport function moveIndexedContainerChild(\n childIdsByParentId: ContainerChildIndex | undefined,\n containerId: string,\n previousParentId: string | null,\n nextParentId: string | null,\n) {\n if (!childIdsByParentId || previousParentId === nextParentId) {\n return;\n }\n\n removeIndexedContainerChild(\n childIdsByParentId,\n containerId,\n previousParentId,\n );\n addIndexedContainerChild(childIdsByParentId, containerId, nextParentId);\n}\n\nexport function createContainerChildIndex(\n containersById: ReadonlyMap<string, ContainerState>,\n): ContainerChildIndex {\n const childIdsByParentId: ContainerChildIndex = new Map();\n\n for (const [containerId, containerState] of containersById) {\n addIndexedContainerChild(\n childIdsByParentId,\n containerId,\n containerState.container.parentId,\n );\n }\n\n return childIdsByParentId;\n}\n"]}

package/workflows/container-contents/remoteHydration/{laneFetchMarkers.js → lanes/laneFetchMarkers.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { recordContainerSyncLaneFetchIfCurrent, } from "../containerPersistence.js";
+import { recordContainerSyncLaneFetchIfCurrent, } from "../../containerPersistence.js";
 export async function markContainerParentLaneFetched(input) {
     const { response, state, syncLane } = input;
     if (response.hasMore && !response.nextWatermark) {

package/workflows/container-contents/remoteHydration/lanes/laneFetchMarkers.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"laneFetchMarkers.js","sourceRoot":"","sources":["laneFetchMarkers.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AAGpC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,QAAQ,EACR,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,EACjE,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,OAAO;QACjB,QAAQ,CAAC,IAAI,KAAK,kBAAkB;QACpC,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAC1B,CAAC;QACD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { ListContainersResponse } from \"@tearleads/validators/response\";\nimport {\n type ContainerSyncWatermarkLane,\n recordContainerSyncLaneFetchIfCurrent,\n} from \"../../containerPersistence\";\nimport type { RemoteContainerHydrationState } from \"../types\";\n\nexport async function markContainerParentLaneFetched(input: {\n isCurrent?: (() => boolean) | undefined;\n response: ListContainersResponse;\n state: RemoteContainerHydrationState;\n syncLane: ContainerSyncWatermarkLane;\n}): Promise<boolean> {\n const { response, state, syncLane } = input;\n if (response.hasMore && !response.nextWatermark) {\n return false;\n }\n\n // A check marker suppresses startup polling, so record it only after the\n // server confirms this parent lane is fully drained. The cursor and marker\n // share one row and land in one guarded statement.\n const recorded = await recordContainerSyncLaneFetchIfCurrent(\n state.runtime.infra.execSql,\n syncLane,\n { checked: !response.hasMore, watermark: response.nextWatermark },\n input.isCurrent,\n );\n if (!recorded || input.isCurrent?.() === false) {\n return false;\n }\n if (\n !response.hasMore &&\n syncLane.kind === \"container_parent\" &&\n syncLane.parentId === null\n ) {\n state.rootLaneHydrated = true;\n }\n\n return true;\n}\n"]}

package/workflows/container-contents/remoteHydration/{parentLaneFetch.js → lanes/parentLaneFetch.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { createContainerParentSyncLane, loadContainerSyncWatermark, } from "../containerPersistence.js";
-import { createContainerStateFingerprint } from "./containerStateFingerprint.js";
+import { createContainerParentSyncLane, loadContainerSyncWatermark, } from "../../containerPersistence.js";
+import { createContainerStateFingerprint } from "../remoteContainers/containerStateFingerprint.js";
 async function prepareContainerParentLanePage(input) {
     const { lane, laneId, state } = input;
     const syncLane = createContainerParentSyncLane(lane.parentId);

package/workflows/container-contents/remoteHydration/lanes/parentLaneFetch.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"parentLaneFetch.js","sourceRoot":"","sources":["parentLaneFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAOhG,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACrB,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE;QACvD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;QAClE,WAAW;QACX;YACE,SAAS,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE;YAC1C,WAAW,EAAE,+BAA+B,CAAC,cAAc,CAAC;SAC7D;KACF,CAAC,CACH,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,8BAA8B,CAAC;QAC7B,IAAI;QACJ,MAAM,EAAE,QAAQ,KAAK,EAAE;QACvB,KAAK;KACN,CAAC,CACH,CACF,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,2BAA2B,GAAG,IAAI,GAAG,CACzC,CACE,MAAM,KAAK,CAAC,WAAW,CAAC,gCAAgC,CACtD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CACF,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CACzD,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC;QACtE,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAC;IACF,IACE,aAAa,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM;QAC3C,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO;YACL,uBAAuB;YACvB,2BAA2B;YAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,YAAY,CAAC,QAAQ;SAChC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n createContainerParentSyncLane,\n loadContainerSyncWatermark,\n} from \"../../containerPersistence\";\nimport { createContainerStateFingerprint } from \"../remoteContainers/containerStateFingerprint\";\nimport type {\n ContainerParentHydrationLane,\n FetchedContainerParentLanePage,\n RemoteContainerHydrationState,\n} from \"../types\";\n\nasync function prepareContainerParentLanePage(input: {\n lane: ContainerParentHydrationLane;\n laneId: string;\n state: RemoteContainerHydrationState;\n}) {\n const { lane, laneId, state } = input;\n const syncLane = createContainerParentSyncLane(lane.parentId);\n const watermark =\n lane.watermark === undefined\n ? await loadContainerSyncWatermark(state.runtime.infra.execSql, syncLane)\n : lane.watermark;\n return {\n lane,\n request: { laneId, parentId: lane.parentId, watermark },\n syncLane,\n };\n}\n\nexport async function fetchContainerParentLaneBatch(input: {\n batch: ReadonlyArray<ContainerParentHydrationLane>;\n isCurrent?: (() => boolean) | undefined;\n state: RemoteContainerHydrationState;\n}): Promise<ReadonlyArray<FetchedContainerParentLanePage> | null> {\n const { batch, state } = input;\n const expectedContainerStates = new Map(\n Array.from(state.containersById, ([containerId, containerState]) => [\n containerId,\n {\n container: { ...containerState.container },\n fingerprint: createContainerStateFingerprint(containerState),\n },\n ]),\n );\n const preparedPages = await Promise.all(\n batch.map((lane, index) =>\n prepareContainerParentLanePage({\n lane,\n laneId: `lane-${index}`,\n state,\n }),\n ),\n );\n if (input.isCurrent?.() === false) {\n return null;\n }\n const expectedHydrationTombstones = new Map(\n (\n await state.persistence.loadContainerHydrationTombstones(\n state.runtime.infra.execSql,\n )\n ).map((tombstone) => [tombstone.containerId, tombstone]),\n );\n if (input.isCurrent?.() === false) {\n return null;\n }\n const response = await state.runtime.apiClient.listContainerParentLanes({\n lanes: preparedPages.map((page) => page.request),\n });\n if (!response) {\n return null;\n }\n\n const pagesByLaneId = new Map(\n response.results.map((result) => [result.laneId, result.page]),\n );\n if (\n pagesByLaneId.size !== preparedPages.length ||\n response.results.length !== preparedPages.length\n ) {\n throw new Error(\"Container parent lane batch response mismatch\");\n }\n\n return preparedPages.map((preparedPage) => {\n const page = pagesByLaneId.get(preparedPage.request.laneId);\n if (!page) {\n throw new Error(\"Container parent lane batch response mismatch\");\n }\n return {\n expectedContainerStates,\n expectedHydrationTombstones,\n lane: preparedPage.lane,\n response: page,\n syncLane: preparedPage.syncLane,\n };\n });\n}\n"]}

package/workflows/container-contents/remoteHydration/lanes/parentLaneQueue.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"parentLaneQueue.js","sourceRoot":"","sources":["parentLaneQueue.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,mCAAmC,CAAC,KAKnD;IAIC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,QAAQ,EAAE,CAAC;QACrE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,cAAc,GAClB,KAAK,CAAC,sBAAsB;YAC5B,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACvC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import type {\n ContainerParentHydrationLane,\n QueueContainerParentLane,\n} from \"../types\";\n\nexport function createContainerParentHydrationQueue(input: {\n containerIds: Iterable<string>;\n parentIds?: Iterable<string | null> | undefined;\n resetAllLaneWatermarks?: boolean | undefined;\n resetRootLaneWatermark?: boolean | undefined;\n}): {\n lanes: ContainerParentHydrationLane[];\n queueParentLane: QueueContainerParentLane;\n} {\n const queuedParentIds = new Set<string>();\n const lanes: ContainerParentHydrationLane[] = [];\n const queueParentLane = (parentId: string | null) => {\n const laneKey = parentId === null ? \"root\" : `container:${parentId}`;\n if (queuedParentIds.has(laneKey)) {\n return;\n }\n\n queuedParentIds.add(laneKey);\n // A restoration crawl resets every lane: a newly re-granted descendant\n // does not advance its parent's persisted watermark. Ordinary discovery\n // refreshes only need to reset the top-level lane.\n const resetWatermark =\n input.resetAllLaneWatermarks ||\n (parentId === null && input.resetRootLaneWatermark);\n lanes.push(resetWatermark ? { parentId, watermark: null } : { parentId });\n };\n\n if (input.parentIds) {\n for (const parentId of input.parentIds) {\n queueParentLane(parentId);\n }\n } else {\n queueParentLane(null);\n for (const containerId of input.containerIds) {\n queueParentLane(containerId);\n }\n }\n\n return { lanes, queueParentLane };\n}\n"]}

package/workflows/container-contents/remoteHydration/principalPolicyCache.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { referencedPrincipalPolicyKey } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { referencedPrincipalPolicyKey } from "../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
 export async function cacheRemoteContainerPrincipalPolicies(input) {
     const cacheReferencedPrincipalPolicies = input.cacheReferencedPrincipalPolicies;
     if (!cacheReferencedPrincipalPolicies) {