npm - @tearleads/client-sdk - Versions diffs - 0.1.64 → 0.1.66 - Mend

@tearleads/client-sdk 0.1.64 → 0.1.66

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (646) hide show

package/workflows/container-contents/remoteHydration/destination/replacementBinding.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../../internal/crypto/index.js";
 import { assertHeldContainerBinding, } from "../../../../data/containers/containerBinding.js";
 import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { persistOrganizationReplacementCheckpoints } from "../../../../data/persistence/keyingCheckpoints/organizationReplacementCheckpointPersistence.js";
 import { loadOrganizationFounder } from "../../../../data/persistence/organizationFounderPersistence.js";
-import { persistOrganizationReplacementCheckpoints } from "../../../../data/persistence/organizationReplacementCheckpointPersistence.js";
 async function acceptsSharedReplacement(input, oldOrganizationId) {
     const { listed, role, runtime } = input;
     const founder = await loadOrganizationFounder(runtime.infra.execSql, oldOrganizationId);

package/workflows/container-contents/remoteHydration/destination/replacementBinding.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"replacementBinding.js","sourceRoot":"","sources":["replacementBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,~~uBAAuB~~,EAAE,MAAM,~~6DAA6D~~,CAAC;~~AACtG~~,OAAO,EAAE,~~yCAAyC~~,EAAE,MAAM,~~2EAA2E~~,CAAC;~~AAYtI~~,KAAK,UAAU,wBAAwB,CACrC,KAAmB,EACnB,iBAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;IACJ,IAAI,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;QAClE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,QAAQ,GACZ,MAAM,OAAO,CAAC,SAAS,CAAC,2CAA2C,CACjE,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,oCAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAC5B,iBAAiB,EACjB,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,IACE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,cAAc;QAC9C,kBAAkB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM;QAC7C,kBAAkB,CAAC,qBAAqB;YACtC,OAAO,CAAC,qBAAqB;QAC/B,kBAAkB,CAAC,gBAAgB,KAAK,IAAI,CAAC,qBAAqB;QAClE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;QAC7C,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,gBAAgB;QACrD,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,sBAAsB;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,yCAAyC,CAAC;QAC9C,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAkC,EAClC,iBAAyB,EACzB,MAAc,EACd,gBAA4B;IAE5B,IAAI,QAAQ,GAAG,iBAAiB,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,IAES,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,0CAA0C,CACtD,SAAS,EACT,gBAAgB,CACjB,CAAC;QACF,IACE,KAAK,CAAC,sBAAsB,KAAK,QAAQ;YACzC,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;YAEjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;QACJ,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO;IAC5D,IAAI,IAAI,EAAE,kBAAkB,KAAK,IAAI;QACnC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,IAAI,EAAE,cAAc;QACpB,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,UAAU,KAAK,IAAI;QACxB,CAAC,MAAM,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO;IACT,0BAA0B,CAAC,IAAI,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n assertHeldContainerBinding,\n type HeldContainerBinding,\n} from \"../../../../data/containers/containerBinding\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { ~~loadOrganizationFounder~~ } from \"../../../../data/persistence/~~organizationFounderPersistence~~\";\nimport { ~~persistOrganizationReplacementCheckpoints~~ } from \"../../../../data/persistence/~~organizationReplacementCheckpointPersistence~~\";\nimport type { RemoteContainer, RemoteContainerHydrationState } from \"../types\";\nimport type { DestinationRole } from \"./destinationRoleCache\";\n\nexport interface BindingInput {\n readonly stillCurrent?: (() => boolean) \| undefined;\n readonly heldBinding: HeldContainerBinding \| null;\n readonly listed: Pick<RemoteContainer, \"id\" \| \"organizationId\">;\n readonly role: DestinationRole;\n readonly runtime: RemoteContainerHydrationState[\"runtime\"];\n}\n\nasync function acceptsSharedReplacement(\n input: BindingInput,\n oldOrganizationId: string,\n): Promise<boolean> {\n const { listed, role, runtime } = input;\n const founder = await loadOrganizationFounder(\n runtime.infra.execSql,\n oldOrganizationId,\n );\n if (!founder \|\| role.createSignerUserId !== founder.userId) return false;\n const identity = await runtime.resolveTrustedUserIdentity(founder.userId);\n if (!identity)\n throw new ProjectionDependencyUnavailableError(\n \"Replacement founder identity is unavailable\",\n );\n if (identity.signingKeyFingerprint !== founder.signingKeyFingerprint)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"Replacement founder differs from the held organization's pinned identity\",\n );\n const response =\n await runtime.apiClient.getContainerReplacementAuthorizationsResult(\n listed.id,\n oldOrganizationId,\n );\n if (!response.ok) {\n if (response.status === 404) return false;\n throw new ProjectionDependencyUnavailableError(response.message);\n }\n const last = verifyReplacementLineage(\n response.data.authorizations,\n oldOrganizationId,\n founder.userId,\n identity.signingPublicKey,\n );\n const replacementFounder = await loadOrganizationFounder(\n runtime.infra.execSql,\n listed.organizationId,\n );\n if (\n last?.organizationId !== listed.organizationId \|\|\n replacementFounder?.userId !== founder.userId \|\|\n replacementFounder.signingKeyFingerprint !==\n founder.signingKeyFingerprint \|\|\n replacementFounder.genesisStateHash !== last.organizationStateHash \|\|\n role.rootContainerId !== last.rootContainerId \|\|\n role.rootCreateManifestHash !== last.rootManifestHash \|\|\n role.rootMetadataDocumentId !== last.rootMetadataDocumentId\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization does not bind the destination genesis\",\n );\n // The founder also commits the reserved groups' genesis. Pin those even\n // when the readable folder's projection does not cite both groups yet.\n await persistOrganizationReplacementCheckpoints({\n authorization: last,\n execSql: runtime.infra.execSql,\n stillCurrent: input.stillCurrent,\n });\n return true;\n}\n\nfunction verifyReplacementLineage(\n authorizations: readonly unknown[],\n oldOrganizationId: string,\n userId: string,\n signingPublicKey: Uint8Array,\n) {\n let expected = oldOrganizationId;\n const visited = new Set([expected]);\n let last:\n \| ReturnType<typeof verifyOrganizationReplacementAuthorization>\n \| undefined;\n for (const candidate of authorizations) {\n const proof = verifyOrganizationReplacementAuthorization(\n candidate,\n signingPublicKey,\n );\n if (\n proof.replacesOrganizationId !== expected \|\|\n proof.userId !== userId \|\|\n visited.has(proof.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization lineage does not extend the held organization\",\n );\n expected = proof.organizationId;\n visited.add(expected);\n last = proof;\n }\n return last;\n}\n\n/** A foreign creator needs the held organization's pinned founder to authorize rehome. */\nexport async function assertPermittedDestinationBinding(\n input: BindingInput,\n): Promise<void> {\n const { heldBinding: held, listed, role, runtime } = input;\n if (role.createSignerUserId === runtime.auth.userId) return;\n if (held?.metadataDocumentId === null)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"a local folder can bind only to its own signed create\",\n );\n if (\n held?.organizationId &&\n held.organizationId !== listed.organizationId &&\n role.systemSlot === null &&\n (await acceptsSharedReplacement(input, held.organizationId))\n )\n return;\n assertHeldContainerBinding(held, {\n organizationId: listed.organizationId,\n metadataDocumentIds: [role.metadataDocumentId],\n });\n}\n"]}
1	+ {"version":3,"file":"replacementBinding.js","sourceRoot":"","sources":["replacementBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,6FAA6F,CAAC;AACxJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AAYtG,KAAK,UAAU,wBAAwB,CACrC,KAAmB,EACnB,iBAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;IACJ,IAAI,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;QAClE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,QAAQ,GACZ,MAAM,OAAO,CAAC,SAAS,CAAC,2CAA2C,CACjE,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,oCAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAC5B,iBAAiB,EACjB,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,IACE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,cAAc;QAC9C,kBAAkB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM;QAC7C,kBAAkB,CAAC,qBAAqB;YACtC,OAAO,CAAC,qBAAqB;QAC/B,kBAAkB,CAAC,gBAAgB,KAAK,IAAI,CAAC,qBAAqB;QAClE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;QAC7C,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,gBAAgB;QACrD,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,sBAAsB;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,yCAAyC,CAAC;QAC9C,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAkC,EAClC,iBAAyB,EACzB,MAAc,EACd,gBAA4B;IAE5B,IAAI,QAAQ,GAAG,iBAAiB,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,IAES,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,0CAA0C,CACtD,SAAS,EACT,gBAAgB,CACjB,CAAC;QACF,IACE,KAAK,CAAC,sBAAsB,KAAK,QAAQ;YACzC,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;YAEjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;QACJ,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO;IAC5D,IAAI,IAAI,EAAE,kBAAkB,KAAK,IAAI;QACnC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,IAAI,EAAE,cAAc;QACpB,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,UAAU,KAAK,IAAI;QACxB,CAAC,MAAM,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO;IACT,0BAA0B,CAAC,IAAI,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n assertHeldContainerBinding,\n type HeldContainerBinding,\n} from \"../../../../data/containers/containerBinding\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../../../data/persistence/keyingCheckpoints/organizationReplacementCheckpointPersistence\";\nimport { loadOrganizationFounder } from \"../../../../data/persistence/organizationFounderPersistence\";\nimport type { RemoteContainer, RemoteContainerHydrationState } from \"../types\";\nimport type { DestinationRole } from \"./destinationRoleCache\";\n\nexport interface BindingInput {\n readonly stillCurrent?: (() => boolean) \| undefined;\n readonly heldBinding: HeldContainerBinding \| null;\n readonly listed: Pick<RemoteContainer, \"id\" \| \"organizationId\">;\n readonly role: DestinationRole;\n readonly runtime: RemoteContainerHydrationState[\"runtime\"];\n}\n\nasync function acceptsSharedReplacement(\n input: BindingInput,\n oldOrganizationId: string,\n): Promise<boolean> {\n const { listed, role, runtime } = input;\n const founder = await loadOrganizationFounder(\n runtime.infra.execSql,\n oldOrganizationId,\n );\n if (!founder \|\| role.createSignerUserId !== founder.userId) return false;\n const identity = await runtime.resolveTrustedUserIdentity(founder.userId);\n if (!identity)\n throw new ProjectionDependencyUnavailableError(\n \"Replacement founder identity is unavailable\",\n );\n if (identity.signingKeyFingerprint !== founder.signingKeyFingerprint)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"Replacement founder differs from the held organization's pinned identity\",\n );\n const response =\n await runtime.apiClient.getContainerReplacementAuthorizationsResult(\n listed.id,\n oldOrganizationId,\n );\n if (!response.ok) {\n if (response.status === 404) return false;\n throw new ProjectionDependencyUnavailableError(response.message);\n }\n const last = verifyReplacementLineage(\n response.data.authorizations,\n oldOrganizationId,\n founder.userId,\n identity.signingPublicKey,\n );\n const replacementFounder = await loadOrganizationFounder(\n runtime.infra.execSql,\n listed.organizationId,\n );\n if (\n last?.organizationId !== listed.organizationId \|\|\n replacementFounder?.userId !== founder.userId \|\|\n replacementFounder.signingKeyFingerprint !==\n founder.signingKeyFingerprint \|\|\n replacementFounder.genesisStateHash !== last.organizationStateHash \|\|\n role.rootContainerId !== last.rootContainerId \|\|\n role.rootCreateManifestHash !== last.rootManifestHash \|\|\n role.rootMetadataDocumentId !== last.rootMetadataDocumentId\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization does not bind the destination genesis\",\n );\n // The founder also commits the reserved groups' genesis. Pin those even\n // when the readable folder's projection does not cite both groups yet.\n await persistOrganizationReplacementCheckpoints({\n authorization: last,\n execSql: runtime.infra.execSql,\n stillCurrent: input.stillCurrent,\n });\n return true;\n}\n\nfunction verifyReplacementLineage(\n authorizations: readonly unknown[],\n oldOrganizationId: string,\n userId: string,\n signingPublicKey: Uint8Array,\n) {\n let expected = oldOrganizationId;\n const visited = new Set([expected]);\n let last:\n \| ReturnType<typeof verifyOrganizationReplacementAuthorization>\n \| undefined;\n for (const candidate of authorizations) {\n const proof = verifyOrganizationReplacementAuthorization(\n candidate,\n signingPublicKey,\n );\n if (\n proof.replacesOrganizationId !== expected \|\|\n proof.userId !== userId \|\|\n visited.has(proof.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Replacement authorization lineage does not extend the held organization\",\n );\n expected = proof.organizationId;\n visited.add(expected);\n last = proof;\n }\n return last;\n}\n\n/** A foreign creator needs the held organization's pinned founder to authorize rehome. */\nexport async function assertPermittedDestinationBinding(\n input: BindingInput,\n): Promise<void> {\n const { heldBinding: held, listed, role, runtime } = input;\n if (role.createSignerUserId === runtime.auth.userId) return;\n if (held?.metadataDocumentId === null)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"a local folder can bind only to its own signed create\",\n );\n if (\n held?.organizationId &&\n held.organizationId !== listed.organizationId &&\n role.systemSlot === null &&\n (await acceptsSharedReplacement(input, held.organizationId))\n )\n return;\n assertHeldContainerBinding(held, {\n organizationId: listed.organizationId,\n metadataDocumentIds: [role.metadataDocumentId],\n });\n}\n"]}

package/workflows/container-contents/remoteHydration/reattachMetadata.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"reattachMetadata.js","sourceRoot":"","sources":["reattachMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAKhG;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IASC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAClD,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,IACE,aAAa,EAAE,UAAU,IAAI,IAAI;QACjC,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,wBAAwB,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,eAAe,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrD,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,WAAW;YACjB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;QAClC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,eAAe,EACb,aAAa,CAAC,eAAe,IAAI,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvE,aAAa,EAAE,aAAa,CAAC,aAAa,IAAI,IAAI;QAClD,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,aAAa,CAAC,gCAAgC;YAC9D,CAAC,CAAC,aAAa,CAAC,gBAAgB;YAChC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAC5C,GAAG,CAAC,aAAa,CAAC,gCAAgC;YAChD,CAAC,CAAC,EAAE,gCAAgC,EAAE,IAAa,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;KACrD,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport { readContainerMetadataValue } from \"../../../data/containers/containerMetadataDocument\";\nimport type { DocumentSyncPullContinuation } from \"../../../data/documents/shared/pullContinuation\";\nimport type { ContainerMetadataRecord } from \"../containerPersistence\";\nimport type { ContainerMetadataDocumentState } from \"./types\";\n\n/*\n Resolve a freshly discovered container's metadata content against dormant\n * retained state (docs/sync-edge-cases.md row 4, access_revoked branch). A\n * dormant record makes this a re-attach: its content is imported into the\n * live document and projected, so a queued local rename or icon edit renders\n * immediately instead of a default name until sync succeeds. Without one, the\n * document seeds fresh with the default projection.\n */\nexport function reattachDormantContainerMetadata(input: {\n defaultName: string;\n doc: ContainerMetadataDocumentState;\n dormantRecord: ContainerMetadataRecord \| null;\n remoteMetadataDocumentId: string;\n}): {\n icon: string \| null;\n initialSnapshot: string;\n lastCommitLsn: string \| null;\n name: string;\n pullContinuation: DocumentSyncPullContinuation \| null \| undefined;\n pullContinuationRecoveryRequired?: true \| undefined;\n snapshotEndVersion: string;\n} {\n const { defaultName, doc, dormantRecord } = input;\n // The signed metadata document id never changes, and hydration refuses a\n // relisting that conflicts with the retained binding before reaching here.\n // A null id is a lost-response create retained via its own tombstone.\n if (\n dormantRecord?.documentId != null &&\n dormantRecord.documentId !== input.remoteMetadataDocumentId\n ) {\n throw new Error(\"Dormant container metadata binding was not verified\");\n }\n if (!dormantRecord) {\n return {\n icon: null,\n initialSnapshot: bytesToBase64(exportAllUpdates(doc)),\n lastCommitLsn: null,\n name: defaultName,\n pullContinuation: null,\n snapshotEndVersion: \"\",\n };\n }\n\n if (dormantRecord.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(dormantRecord.metadataUpdates)]);\n }\n const metadata = readContainerMetadataValue(doc, defaultName);\n return {\n icon: metadata.icon,\n initialSnapshot:\n dormantRecord.metadataUpdates \|\| bytesToBase64(exportAllUpdates(doc)),\n lastCommitLsn: dormantRecord.lastCommitLsn ?? null,\n name: metadata.name,\n pullContinuation: dormantRecord.pullContinuationRecoveryRequired\n ? dormantRecord.pullContinuation\n : (dormantRecord.pullContinuation ?? null),\n ...(dormantRecord.pullContinuationRecoveryRequired\n ? { pullContinuationRecoveryRequired: true as const }\n : {}),\n snapshotEndVersion: dormantRecord.snapshotEndVersion,\n };\n}\n"]}
1	+ {"version":3,"file":"reattachMetadata.js","sourceRoot":"","sources":["reattachMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAKhG;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IASC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAClD,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,IACE,aAAa,EAAE,UAAU,IAAI,IAAI;QACjC,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,wBAAwB,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,eAAe,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrD,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,WAAW;YACjB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;QAClC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,eAAe,EACb,aAAa,CAAC,eAAe,IAAI,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvE,aAAa,EAAE,aAAa,CAAC,aAAa,IAAI,IAAI;QAClD,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,aAAa,CAAC,gCAAgC;YAC9D,CAAC,CAAC,aAAa,CAAC,gBAAgB;YAChC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAC5C,GAAG,CAAC,aAAa,CAAC,gCAAgC;YAChD,CAAC,CAAC,EAAE,gCAAgC,EAAE,IAAa,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;KACrD,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport { readContainerMetadataValue } from \"../../../data/containers/containerMetadataDocument\";\nimport type { DocumentSyncPullContinuation } from \"../../../data/documents/shared/sync/pullContinuation\";\nimport type { ContainerMetadataRecord } from \"../containerPersistence\";\nimport type { ContainerMetadataDocumentState } from \"./types\";\n\n/*\n Resolve a freshly discovered container's metadata content against dormant\n * retained state (docs/sync-edge-cases.md row 4, access_revoked branch). A\n * dormant record makes this a re-attach: its content is imported into the\n * live document and projected, so a queued local rename or icon edit renders\n * immediately instead of a default name until sync succeeds. Without one, the\n * document seeds fresh with the default projection.\n */\nexport function reattachDormantContainerMetadata(input: {\n defaultName: string;\n doc: ContainerMetadataDocumentState;\n dormantRecord: ContainerMetadataRecord \| null;\n remoteMetadataDocumentId: string;\n}): {\n icon: string \| null;\n initialSnapshot: string;\n lastCommitLsn: string \| null;\n name: string;\n pullContinuation: DocumentSyncPullContinuation \| null \| undefined;\n pullContinuationRecoveryRequired?: true \| undefined;\n snapshotEndVersion: string;\n} {\n const { defaultName, doc, dormantRecord } = input;\n // The signed metadata document id never changes, and hydration refuses a\n // relisting that conflicts with the retained binding before reaching here.\n // A null id is a lost-response create retained via its own tombstone.\n if (\n dormantRecord?.documentId != null &&\n dormantRecord.documentId !== input.remoteMetadataDocumentId\n ) {\n throw new Error(\"Dormant container metadata binding was not verified\");\n }\n if (!dormantRecord) {\n return {\n icon: null,\n initialSnapshot: bytesToBase64(exportAllUpdates(doc)),\n lastCommitLsn: null,\n name: defaultName,\n pullContinuation: null,\n snapshotEndVersion: \"\",\n };\n }\n\n if (dormantRecord.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(dormantRecord.metadataUpdates)]);\n }\n const metadata = readContainerMetadataValue(doc, defaultName);\n return {\n icon: metadata.icon,\n initialSnapshot:\n dormantRecord.metadataUpdates \|\| bytesToBase64(exportAllUpdates(doc)),\n lastCommitLsn: dormantRecord.lastCommitLsn ?? null,\n name: metadata.name,\n pullContinuation: dormantRecord.pullContinuationRecoveryRequired\n ? dormantRecord.pullContinuation\n : (dormantRecord.pullContinuation ?? null),\n ...(dormantRecord.pullContinuationRecoveryRequired\n ? { pullContinuationRecoveryRequired: true as const }\n : {}),\n snapshotEndVersion: dormantRecord.snapshotEndVersion,\n };\n}\n"]}

package/workflows/container-contents/syncLane.d.ts CHANGED Viewed

@@ -10,3 +10,5 @@ export declare function registerContainerContentsSyncLane(input: {
     readonly logError?: ((message: string, error: unknown) => void) | undefined;
     readonly run: () => Promise<void>;
 }): ContainerContentsSyncLane;
+/** The lane's run counters, for work that waits on a pass it requested. */
+export declare function readContainerContentsSyncLane(domainScope: DomainScope): import("../sync/index.js").SyncLaneSnapshot | null;

package/workflows/container-contents/syncLane.js CHANGED Viewed

@@ -17,4 +17,11 @@ export function registerContainerContentsSyncLane(input) {
         shouldIgnoreError: isDatabaseUnavailableError,
     });
 }
+/** The lane's run counters, for work that waits on a pass it requested. */
+export function readContainerContentsSyncLane(domainScope) {
+    return (getOrCreateDomainSyncCoordinator(domainScope)
+        .getSnapshot()
+        .lanes.find((lane) => lane.key === CONTAINER_CONTENTS_SYNC_LANE_KEY) ??
+        null);
+}
 //# sourceMappingURL=syncLane.js.map

package/workflows/container-contents/syncLane.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"syncLane.js","sourceRoot":"","sources":["syncLane.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAGzC,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;AAErE,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,OAAO,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CACrE,gCAAgC,EAChC;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,YAAY;QACnB,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ,EAAE,CAAC,sCAAsC,EAAE,KAAK,CAAC;QACjE,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,iBAAiB,EAAE,0BAA0B;KAC9C,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n getOrCreateDomainSyncCoordinator,\n isDatabaseUnavailableError,\n type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\n\nexport { sequenceUnchanged } from \"../../data/sync/sequence\";\n// Facade re-exports: container-contents stores must reach these shared sync\n// helpers through this workflow boundary, not by importing data/sync directly.\nexport {\n didRegainSyncPrerequisites,\n isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\n\nexport type ContainerContentsSyncLane = SyncLane;\nexport const CONTAINER_CONTENTS_SYNC_LANE_KEY = \"container-contents\";\n\nexport function registerContainerContentsSyncLane(input: {\n readonly domainScope: DomainScope;\n /** Host diagnostics sink; bare runtimes do not structure errors. */\n readonly logError?: ((message: string, error: unknown) => void) \| undefined;\n readonly run: () => Promise<void>;\n}): ContainerContentsSyncLane {\n return getOrCreateDomainSyncCoordinator(input.domainScope).registerLane(\n CONTAINER_CONTENTS_SYNC_LANE_KEY,\n {\n label: \"Container contents\",\n phase: \"structural\",\n // Fixed literal: no container or identity id may reach a report. The\n // mapped stack identifies which lane body threw. Returning the host's\n // result hands a rejection to the lane reporter's wrapper; discarding it\n // would surface as an unhandled rejection instead.\n reportUnexpectedError: (error) =>\n input.logError?.(\"Container contents: sync lane failed\", error),\n run: input.run,\n shouldIgnoreError: isDatabaseUnavailableError,\n },\n );\n}\n"]}
1	+ {"version":3,"file":"syncLane.js","sourceRoot":"","sources":["syncLane.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAGzC,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;AAErE,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,OAAO,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CACrE,gCAAgC,EAChC;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,YAAY;QACnB,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ,EAAE,CAAC,sCAAsC,EAAE,KAAK,CAAC;QACjE,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,iBAAiB,EAAE,0BAA0B;KAC9C,CACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAAC,WAAwB;IACpE,OAAO,CACL,gCAAgC,CAAC,WAAW,CAAC;SAC1C,WAAW,EAAE;SACb,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,CAAC;QACtE,IAAI,CACL,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n getOrCreateDomainSyncCoordinator,\n isDatabaseUnavailableError,\n type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\n\nexport { sequenceUnchanged } from \"../../data/sync/sequence\";\n// Facade re-exports: container-contents stores must reach these shared sync\n// helpers through this workflow boundary, not by importing data/sync directly.\nexport {\n didRegainSyncPrerequisites,\n isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\n\nexport type ContainerContentsSyncLane = SyncLane;\nexport const CONTAINER_CONTENTS_SYNC_LANE_KEY = \"container-contents\";\n\nexport function registerContainerContentsSyncLane(input: {\n readonly domainScope: DomainScope;\n /** Host diagnostics sink; bare runtimes do not structure errors. /\n readonly logError?: ((message: string, error: unknown) => void) \| undefined;\n readonly run: () => Promise<void>;\n}): ContainerContentsSyncLane {\n return getOrCreateDomainSyncCoordinator(input.domainScope).registerLane(\n CONTAINER_CONTENTS_SYNC_LANE_KEY,\n {\n label: \"Container contents\",\n phase: \"structural\",\n // Fixed literal: no container or identity id may reach a report. The\n // mapped stack identifies which lane body threw. Returning the host's\n // result hands a rejection to the lane reporter's wrapper; discarding it\n // would surface as an unhandled rejection instead.\n reportUnexpectedError: (error) =>\n input.logError?.(\"Container contents: sync lane failed\", error),\n run: input.run,\n shouldIgnoreError: isDatabaseUnavailableError,\n },\n );\n}\n\n/* The lane's run counters, for work that waits on a pass it requested. */\nexport function readContainerContentsSyncLane(domainScope: DomainScope) {\n return (\n getOrCreateDomainSyncCoordinator(domainScope)\n .getSnapshot()\n .lanes.find((lane) => lane.key === CONTAINER_CONTENTS_SYNC_LANE_KEY) ??\n null\n );\n}\n"]}

package/workflows/container-contents/tombstones/documentTombstoneEvidence.js CHANGED Viewed

@@ -1,10 +1,10 @@
 import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../../internal/validators/response/index.js";
-import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection/index.js";
 import { uniqueSortedStrings } from "../../../data/documents/shared/readers.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { reportKeyingVerificationErrorInCauseChain } from "../../../data/keyingProjectionVerification/error.js";
 import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
-import { loadDocumentPurgeCheckpoint } from "../../../data/persistence/documentPurgeCheckpointPersistence.js";
+import { loadDocumentPurgeCheckpoint } from "../../../data/persistence/keyingCheckpoints/documentPurgeCheckpointPersistence.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
 import { documentHeadMatchesOrganization } from "../documentDiscovery/documentHeadScope.js";
 export const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;

package/workflows/container-contents/tombstones/documentTombstoneEvidence.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"documentTombstoneEvidence.js","sourceRoot":"","sources":["documentTombstoneEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,GAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAC7G,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAM1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AA+BzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,KAAK,UAAU,mBAAmB,CAChC,OAAyC,EACzC,IAAmC,EACnC,UAAkB,EAClB,UAA4C;IAE5C,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,IAAI,CAAC,wCAAwC,CAAC,UAAU,EAAE;QAC9D,wEAAwE;QACxE,iCAAiC;QACjC,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACnD,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzC,CAAC;YACF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACjD,QAAQ,CAAC,KAAK,GAAG;oBACf,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBAC7B,eAAe,EAAE,IAAI,CAAC,YAAY;oBAClC,kBAAkB,EAAE,mBAAmB,CACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAyC,EACzC,UAAkB,EAClB,KAAc;IAEd,MAAM,gBAAgB,GAAG,MAAM,yCAAyC,CACtE,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,6BAA6B;KACzC,CACF,CAAC;IACF,IAAI,CAAC;QACH,IACE,CAAC,gBAAgB;YACjB,KAAK,YAAY,oCAAoC,EACrD,CAAC;YACD,uEAAuE;YACvE,gEAAgE;YAChE,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,qCAAqC,CACvG,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CACrB,uDAAuD,EACvD,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAyC,EACzC,OAAsC;IACpC,wCAAwC;IACxC,2BAA2B;CAC5B;IAED,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,uEAAuE;YACvE,0BAA0B;YAC1B,IACE,MAAM,IAAI,CAAC,2BAA2B,CACpC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,UAAU,CACX,EACD,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,MAAM,CAAC,gBAAgB;oBACpC,kBAAkB,EAAE,EAAE;iBACvB,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,oBAAoB;gBACvB,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CACpE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACF,IACE,oBAAoB;gBACpB,MAAM,CAAC,EAAE;gBACT,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,KAAK,oBAAoB,EAClE,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;gBAC5D,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CAChE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IACE,MAAM,CAAC,MAAM,KAAK,GAAG;oBACrB,MAAM,CAAC,IAAI,KAAK,6BAA6B;oBAE7C,OAAO,WAAW,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,oBAAoB,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CACnH,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAqD,EACrD,IAAwC;IAExC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAqC,EAAE;QACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,SAAS;aACV,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE;gBACT,GAAG,SAAS;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAkC,EAClC,uBAAkD,EAClD,4BAA4D;IAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE;QAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAA0C,MAAM,CAAC,GAAG,CAChE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAuC,EAAE,CACxD,KAAK,GAAG,2BAA2B;YACjC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAClE,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAClB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACpD,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,cAAc,CAAC;oBAAE,SAAS;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;gBACF,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU;oBAAE,SAAS;gBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACnE,MAAM,CACP,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n DOCUMENT_NOT_FOUND_ERROR_CODE,\n type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../../data/keyingProjectionVerification/error\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport { loadDocumentPurgeCheckpoint } from \"../../../data/persistence/documentPurgeCheckpointPersistence\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type {\n ContainerDocumentTombstone,\n ContainerDocumentTombstoneVerdict,\n ContainerDocumentTombstoneVerifier,\n} from \"../documentDiscovery/documentDiscoveryTypes\";\nimport { documentHeadMatchesOrganization } from \"../documentDiscovery/documentHeadScope\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport interface VerifiedDocumentHeadLinkSet {\n readonly organizationId: string \| null;\n readonly accessEpoch: number;\n /** Present for a signed head; a terminal purge has no live access state. /\n readonly accessStateHash?: string;\n readonly linkedContainerIds: ReadonlyArray<string>;\n}\n\n/\n The document's verified head link set, or `null` when no verified head is\n * available: the projection could not be fetched (the requester may no\n * longer read the document, or it was purged) or failed verification.\n /\nexport type DocumentHeadLinkSetLoader = (\n documentId: string,\n expectedManifestHash?: string,\n) => Promise<VerifiedDocumentHeadLinkSet \| \"not-found\" \| null>;\n\n/* The highest access epoch local state records for the document. /\nexport type LocalDocumentAccessEpochLoader = (\n documentId: string,\n) => Promise<number>;\n\nexport interface DocumentHeadLinkSetLoaderDeps {\n readonly assertDocumentWriterProjectionConsistent: typeof assertDocumentWriterProjectionConsistent;\n readonly loadDocumentPurgeCheckpoint: typeof loadDocumentPurgeCheckpoint;\n}\n\nexport const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;\n/\n Head loads per settle. Tombstones beyond it stay unverified and are held\n * for a later, backed-off retry, so a bulk move out of a folder does not cost\n * every device an unbounded burst of fetches before the watermark advances.\n /\nexport const HEAD_LINK_SET_LOADS_PER_RUN = 32;\n\nasync function verifiedHeadLinkSet(\n runtime: ContainerContentsWorkflowRuntime,\n deps: DocumentHeadLinkSetLoaderDeps,\n documentId: string,\n projection: DocumentWriterProjectionResponse,\n): Promise<VerifiedDocumentHeadLinkSet> {\n const verified: { value?: VerifiedDocumentHeadLinkSet } = {};\n await deps.assertDocumentWriterProjectionConsistent(projection, {\n // Only the link set is read; a bundle wrapped to superseded KEK targets\n // still carries the signed head.\n allowStaleContentKeyBundle: true,\n execSql: runtime.infra.execSql,\n onVerifiedAuthorization: (authorization) => {\n const head = authorization.documentManifestByHash.get(\n projection.documentManifest.manifestHash,\n );\n if (head && head.state.documentId === documentId) {\n verified.value = {\n organizationId: head.state.organizationId,\n accessEpoch: head.state.epoch,\n accessStateHash: head.manifestHash,\n linkedContainerIds: uniqueSortedStrings(\n head.state.linkedContainerIds,\n ),\n };\n }\n },\n resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n });\n if (!verified.value) {\n throw new Error(\"Tombstone evidence lacks a verified document head\");\n }\n return verified.value;\n}\n\nasync function reportUnavailableHead(\n runtime: ContainerContentsWorkflowRuntime,\n documentId: string,\n error: unknown,\n): Promise<void> {\n const integrityFailure = await reportKeyingVerificationErrorInCauseChain(\n error,\n runtime.util.reportSecurityIncident,\n {\n objectId: documentId,\n objectKind: \"document\",\n operation: \"document.tombstone-evidence\",\n },\n );\n try {\n if (\n !integrityFailure &&\n error instanceof ProjectionDependencyUnavailableError\n ) {\n // A policy can advance without changing this document's hash. Drop its\n // cached evidence so the held head can recover on the next run.\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n runtime.util.log(\n `Container contents: tombstone evidence for document ${documentId} is awaiting current policy history`,\n );\n return;\n }\n runtime.util.logError?.(\n \"Container contents: tombstone evidence is unavailable\",\n error,\n );\n } catch {\n // A host logger that throws must not fail the discovery pass.\n }\n}\n\nexport function createDocumentHeadLinkSetLoader(\n runtime: ContainerContentsWorkflowRuntime,\n deps: DocumentHeadLinkSetLoaderDeps = {\n assertDocumentWriterProjectionConsistent,\n loadDocumentPurgeCheckpoint,\n },\n): DocumentHeadLinkSetLoader {\n return async (documentId, expectedManifestHash) => {\n try {\n // A verified purge proof is terminal signed evidence that the document\n // links nothing any more.\n if (\n await deps.loadDocumentPurgeCheckpoint(\n runtime.infra.execSql,\n documentId,\n )\n ) {\n return {\n organizationId: null,\n accessEpoch: Number.MAX_SAFE_INTEGER,\n linkedContainerIds: [],\n };\n }\n // Tombstones require a fresh head. Listings can reuse a matching cached\n // projection, whose signature and local checkpoint are still verified.\n if (!expectedManifestHash)\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n let result = await runtime.apiClient.getDocumentWriterProjectionResult(\n documentId,\n { reportErrors: false },\n );\n if (\n expectedManifestHash &&\n result.ok &&\n result.data.documentManifest.manifestHash !== expectedManifestHash\n ) {\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n result = await runtime.apiClient.getDocumentWriterProjectionResult(\n documentId,\n { reportErrors: false },\n );\n }\n if (!result.ok) {\n if (\n result.status === 404 &&\n result.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n )\n return \"not-found\";\n runtime.util.log(\n `Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? \"offline\"})`,\n );\n return null;\n }\n return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);\n } catch (error) {\n // Any failure leaves the tombstone unverified (held and retried); a\n // thrown error here must not fail the whole discovery pass.\n await reportUnavailableHead(runtime, documentId, error);\n return null;\n }\n };\n}\n\nfunction judgeTombstones(\n tombstones: ReadonlyArray<ContainerDocumentTombstone>,\n head: VerifiedDocumentHeadLinkSet \| null,\n): ContainerDocumentTombstoneVerdict[] {\n return tombstones.map((tombstone): ContainerDocumentTombstoneVerdict => {\n if (head === null) {\n return { kind: \"unverified\", tombstone };\n }\n if (head.linkedContainerIds.includes(tombstone.containerId)) {\n return {\n kind: \"refuted\",\n linkedContainerIds: head.linkedContainerIds,\n tombstone,\n };\n }\n return {\n kind: \"verified\",\n tombstone: {\n ...tombstone,\n accessEpoch: head.accessEpoch,\n linkedContainerIds: head.linkedContainerIds,\n },\n };\n });\n}\n\n/\n Judge listing tombstones against each document's verified head link set,\n * fetched once per document with bounded concurrency and a per-run cap. A\n * head whose epoch is below local document state is no evidence: it may be a\n * lagging replica or a replay, and applying it could delete rows a newer\n * listing or settled move wrote.\n */\nexport function createContainerDocumentTombstoneVerifier(\n organizationId: string \| undefined,\n loadDocumentHeadLinkSet: DocumentHeadLinkSetLoader,\n loadLocalDocumentAccessEpoch: LocalDocumentAccessEpochLoader,\n): ContainerDocumentTombstoneVerifier {\n return async (tombstones) => {\n const byDocumentId = new Map<string, ContainerDocumentTombstone[]>();\n for (const tombstone of tombstones) {\n const group = byDocumentId.get(tombstone.documentId) ?? [];\n group.push(tombstone);\n byDocumentId.set(tombstone.documentId, group);\n }\n const groups = [...byDocumentId.entries()];\n const verdicts: ContainerDocumentTombstoneVerdict[][] = groups.map(\n ([, group], index): ContainerDocumentTombstoneVerdict[] =>\n index < HEAD_LINK_SET_LOADS_PER_RUN\n ? judgeTombstones(group, null)\n : group.map((tombstone) => ({ kind: \"deferred\", tombstone })),\n );\n let next = 0;\n const worker = async () => {\n while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {\n const index = next++;\n const entry = groups[index];\n if (!entry) break;\n const [documentId, group] = entry;\n const head = await loadDocumentHeadLinkSet(documentId);\n if (head === null \|\| head === \"not-found\") continue;\n if (!documentHeadMatchesOrganization(head, organizationId)) continue;\n // A local-state read that fails is treated like an unavailable head:\n // the tombstones stay held rather than failing the discovery pass.\n const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(\n () => Number.MAX_SAFE_INTEGER,\n );\n if (head.accessEpoch < localEpoch) continue;\n verdicts[index] = judgeTombstones(group, head);\n }\n };\n await Promise.all(\n Array.from(\n { length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) },\n worker,\n ),\n );\n return verdicts.flat();\n };\n}\n"]}
1	+ {"version":3,"file":"documentTombstoneEvidence.js","sourceRoot":"","sources":["documentTombstoneEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,GAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAC7G,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,gFAAgF,CAAC;AAC7H,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAM1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AA+BzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,KAAK,UAAU,mBAAmB,CAChC,OAAyC,EACzC,IAAmC,EACnC,UAAkB,EAClB,UAA4C;IAE5C,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,IAAI,CAAC,wCAAwC,CAAC,UAAU,EAAE;QAC9D,wEAAwE;QACxE,iCAAiC;QACjC,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACnD,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzC,CAAC;YACF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACjD,QAAQ,CAAC,KAAK,GAAG;oBACf,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBAC7B,eAAe,EAAE,IAAI,CAAC,YAAY;oBAClC,kBAAkB,EAAE,mBAAmB,CACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAyC,EACzC,UAAkB,EAClB,KAAc;IAEd,MAAM,gBAAgB,GAAG,MAAM,yCAAyC,CACtE,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,6BAA6B;KACzC,CACF,CAAC;IACF,IAAI,CAAC;QACH,IACE,CAAC,gBAAgB;YACjB,KAAK,YAAY,oCAAoC,EACrD,CAAC;YACD,uEAAuE;YACvE,gEAAgE;YAChE,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,qCAAqC,CACvG,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CACrB,uDAAuD,EACvD,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAyC,EACzC,OAAsC;IACpC,wCAAwC;IACxC,2BAA2B;CAC5B;IAED,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,uEAAuE;YACvE,0BAA0B;YAC1B,IACE,MAAM,IAAI,CAAC,2BAA2B,CACpC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,UAAU,CACX,EACD,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,MAAM,CAAC,gBAAgB;oBACpC,kBAAkB,EAAE,EAAE;iBACvB,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,oBAAoB;gBACvB,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CACpE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACF,IACE,oBAAoB;gBACpB,MAAM,CAAC,EAAE;gBACT,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,KAAK,oBAAoB,EAClE,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;gBAC5D,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CAChE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IACE,MAAM,CAAC,MAAM,KAAK,GAAG;oBACrB,MAAM,CAAC,IAAI,KAAK,6BAA6B;oBAE7C,OAAO,WAAW,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,oBAAoB,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CACnH,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAqD,EACrD,IAAwC;IAExC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAqC,EAAE;QACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,SAAS;aACV,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE;gBACT,GAAG,SAAS;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAkC,EAClC,uBAAkD,EAClD,4BAA4D;IAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE;QAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAA0C,MAAM,CAAC,GAAG,CAChE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAuC,EAAE,CACxD,KAAK,GAAG,2BAA2B;YACjC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAClE,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAClB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACpD,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,cAAc,CAAC;oBAAE,SAAS;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;gBACF,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU;oBAAE,SAAS;gBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACnE,MAAM,CACP,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n DOCUMENT_NOT_FOUND_ERROR_CODE,\n type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../../data/keyingProjectionVerification/error\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport { loadDocumentPurgeCheckpoint } from \"../../../data/persistence/keyingCheckpoints/documentPurgeCheckpointPersistence\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type {\n ContainerDocumentTombstone,\n ContainerDocumentTombstoneVerdict,\n ContainerDocumentTombstoneVerifier,\n} from \"../documentDiscovery/documentDiscoveryTypes\";\nimport { documentHeadMatchesOrganization } from \"../documentDiscovery/documentHeadScope\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport interface VerifiedDocumentHeadLinkSet {\n readonly organizationId: string \| null;\n readonly accessEpoch: number;\n /** Present for a signed head; a terminal purge has no live access state. /\n readonly accessStateHash?: string;\n readonly linkedContainerIds: ReadonlyArray<string>;\n}\n\n/\n The document's verified head link set, or `null` when no verified head is\n * available: the projection could not be fetched (the requester may no\n * longer read the document, or it was purged) or failed verification.\n /\nexport type DocumentHeadLinkSetLoader = (\n documentId: string,\n expectedManifestHash?: string,\n) => Promise<VerifiedDocumentHeadLinkSet \| \"not-found\" \| null>;\n\n/* The highest access epoch local state records for the document. /\nexport type LocalDocumentAccessEpochLoader = (\n documentId: string,\n) => Promise<number>;\n\nexport interface DocumentHeadLinkSetLoaderDeps {\n readonly assertDocumentWriterProjectionConsistent: typeof assertDocumentWriterProjectionConsistent;\n readonly loadDocumentPurgeCheckpoint: typeof loadDocumentPurgeCheckpoint;\n}\n\nexport const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;\n/\n Head loads per settle. Tombstones beyond it stay unverified and are held\n * for a later, backed-off retry, so a bulk move out of a folder does not cost\n * every device an unbounded burst of fetches before the watermark advances.\n /\nexport const HEAD_LINK_SET_LOADS_PER_RUN = 32;\n\nasync function verifiedHeadLinkSet(\n runtime: ContainerContentsWorkflowRuntime,\n deps: DocumentHeadLinkSetLoaderDeps,\n documentId: string,\n projection: DocumentWriterProjectionResponse,\n): Promise<VerifiedDocumentHeadLinkSet> {\n const verified: { value?: VerifiedDocumentHeadLinkSet } = {};\n await deps.assertDocumentWriterProjectionConsistent(projection, {\n // Only the link set is read; a bundle wrapped to superseded KEK targets\n // still carries the signed head.\n allowStaleContentKeyBundle: true,\n execSql: runtime.infra.execSql,\n onVerifiedAuthorization: (authorization) => {\n const head = authorization.documentManifestByHash.get(\n projection.documentManifest.manifestHash,\n );\n if (head && head.state.documentId === documentId) {\n verified.value = {\n organizationId: head.state.organizationId,\n accessEpoch: head.state.epoch,\n accessStateHash: head.manifestHash,\n linkedContainerIds: uniqueSortedStrings(\n head.state.linkedContainerIds,\n ),\n };\n }\n },\n resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n });\n if (!verified.value) {\n throw new Error(\"Tombstone evidence lacks a verified document head\");\n }\n return verified.value;\n}\n\nasync function reportUnavailableHead(\n runtime: ContainerContentsWorkflowRuntime,\n documentId: string,\n error: unknown,\n): Promise<void> {\n const integrityFailure = await reportKeyingVerificationErrorInCauseChain(\n error,\n runtime.util.reportSecurityIncident,\n {\n objectId: documentId,\n objectKind: \"document\",\n operation: \"document.tombstone-evidence\",\n },\n );\n try {\n if (\n !integrityFailure &&\n error instanceof ProjectionDependencyUnavailableError\n ) {\n // A policy can advance without changing this document's hash. Drop its\n // cached evidence so the held head can recover on the next run.\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n runtime.util.log(\n `Container contents: tombstone evidence for document ${documentId} is awaiting current policy history`,\n );\n return;\n }\n runtime.util.logError?.(\n \"Container contents: tombstone evidence is unavailable\",\n error,\n );\n } catch {\n // A host logger that throws must not fail the discovery pass.\n }\n}\n\nexport function createDocumentHeadLinkSetLoader(\n runtime: ContainerContentsWorkflowRuntime,\n deps: DocumentHeadLinkSetLoaderDeps = {\n assertDocumentWriterProjectionConsistent,\n loadDocumentPurgeCheckpoint,\n },\n): DocumentHeadLinkSetLoader {\n return async (documentId, expectedManifestHash) => {\n try {\n // A verified purge proof is terminal signed evidence that the document\n // links nothing any more.\n if (\n await deps.loadDocumentPurgeCheckpoint(\n runtime.infra.execSql,\n documentId,\n )\n ) {\n return {\n organizationId: null,\n accessEpoch: Number.MAX_SAFE_INTEGER,\n linkedContainerIds: [],\n };\n }\n // Tombstones require a fresh head. Listings can reuse a matching cached\n // projection, whose signature and local checkpoint are still verified.\n if (!expectedManifestHash)\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n let result = await runtime.apiClient.getDocumentWriterProjectionResult(\n documentId,\n { reportErrors: false },\n );\n if (\n expectedManifestHash &&\n result.ok &&\n result.data.documentManifest.manifestHash !== expectedManifestHash\n ) {\n runtime.apiClient.evictDocumentWriterProjection(documentId);\n result = await runtime.apiClient.getDocumentWriterProjectionResult(\n documentId,\n { reportErrors: false },\n );\n }\n if (!result.ok) {\n if (\n result.status === 404 &&\n result.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n )\n return \"not-found\";\n runtime.util.log(\n `Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? \"offline\"})`,\n );\n return null;\n }\n return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);\n } catch (error) {\n // Any failure leaves the tombstone unverified (held and retried); a\n // thrown error here must not fail the whole discovery pass.\n await reportUnavailableHead(runtime, documentId, error);\n return null;\n }\n };\n}\n\nfunction judgeTombstones(\n tombstones: ReadonlyArray<ContainerDocumentTombstone>,\n head: VerifiedDocumentHeadLinkSet \| null,\n): ContainerDocumentTombstoneVerdict[] {\n return tombstones.map((tombstone): ContainerDocumentTombstoneVerdict => {\n if (head === null) {\n return { kind: \"unverified\", tombstone };\n }\n if (head.linkedContainerIds.includes(tombstone.containerId)) {\n return {\n kind: \"refuted\",\n linkedContainerIds: head.linkedContainerIds,\n tombstone,\n };\n }\n return {\n kind: \"verified\",\n tombstone: {\n ...tombstone,\n accessEpoch: head.accessEpoch,\n linkedContainerIds: head.linkedContainerIds,\n },\n };\n });\n}\n\n/\n Judge listing tombstones against each document's verified head link set,\n * fetched once per document with bounded concurrency and a per-run cap. A\n * head whose epoch is below local document state is no evidence: it may be a\n * lagging replica or a replay, and applying it could delete rows a newer\n * listing or settled move wrote.\n */\nexport function createContainerDocumentTombstoneVerifier(\n organizationId: string \| undefined,\n loadDocumentHeadLinkSet: DocumentHeadLinkSetLoader,\n loadLocalDocumentAccessEpoch: LocalDocumentAccessEpochLoader,\n): ContainerDocumentTombstoneVerifier {\n return async (tombstones) => {\n const byDocumentId = new Map<string, ContainerDocumentTombstone[]>();\n for (const tombstone of tombstones) {\n const group = byDocumentId.get(tombstone.documentId) ?? [];\n group.push(tombstone);\n byDocumentId.set(tombstone.documentId, group);\n }\n const groups = [...byDocumentId.entries()];\n const verdicts: ContainerDocumentTombstoneVerdict[][] = groups.map(\n ([, group], index): ContainerDocumentTombstoneVerdict[] =>\n index < HEAD_LINK_SET_LOADS_PER_RUN\n ? judgeTombstones(group, null)\n : group.map((tombstone) => ({ kind: \"deferred\", tombstone })),\n );\n let next = 0;\n const worker = async () => {\n while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {\n const index = next++;\n const entry = groups[index];\n if (!entry) break;\n const [documentId, group] = entry;\n const head = await loadDocumentHeadLinkSet(documentId);\n if (head === null \|\| head === \"not-found\") continue;\n if (!documentHeadMatchesOrganization(head, organizationId)) continue;\n // A local-state read that fails is treated like an unavailable head:\n // the tombstones stay held rather than failing the discovery pass.\n const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(\n () => Number.MAX_SAFE_INTEGER,\n );\n if (head.accessEpoch < localEpoch) continue;\n verdicts[index] = judgeTombstones(group, head);\n }\n };\n await Promise.all(\n Array.from(\n { length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) },\n worker,\n ),\n );\n return verdicts.flat();\n };\n}\n"]}

package/workflows/containers/child/create/index.js CHANGED Viewed

@@ -4,8 +4,8 @@ import { assertContainerChildPathFits } from "../../../../data/containers/shared
 import { buildContainerCreateBody, buildContainerCreateKeyEpoch, buildParentRecipientTargets, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../../data/containers/shared/events.js";
 import { acknowledgeContainerMutation } from "../../../../data/containers/shared/mutationAcknowledgement.js";
 import { containerManifestRef, getParentCreateContext, readContainerState, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, } from "../../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKekCurrency.js";
-import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKek/containerKekCurrency.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection/index.js";
 import { projectionVerificationOptions, } from "../../../../data/documents/shared/types.js";
 import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
 import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";

package/workflows/containers/child/create/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAC1G,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,+CAA+C,CAAC;AASvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n containerManifestRef,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../../principals/policyRepairBudget\";\nimport { containerMutationRequestCore } from \"../mutationRequestCore\";\nimport { requireUnwrappedKek } from \"../rotation/rotationContext\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifestRef: null,\n parentContainerPathRefs:\n input.parentProjection.path.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n state: repairState,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAC1G,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,+CAA+C,CAAC;AASvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n containerManifestRef,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKek/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../../principals/policyRepairBudget\";\nimport { containerMutationRequestCore } from \"../mutationRequestCore\";\nimport { requireUnwrappedKek } from \"../rotation/rotationContext\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifestRef: null,\n parentContainerPathRefs:\n input.parentProjection.path.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n state: repairState,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}

package/workflows/containers/child/move/index.d.ts CHANGED Viewed

@@ -11,6 +11,7 @@ export declare function moveRemoteContainer(input: {
     destinationParentContainerId: string;
     eventId?: string | undefined;
     execSql: ExecSql;
+    onStaleAcceptance?: (() => void) | undefined;
     resolveProjectionUserKey: ProjectionUserKeyResolver;
     signedAt?: string | undefined;
     stillCurrent?: (() => boolean) | undefined;

package/workflows/containers/child/move/index.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
 import { assertContainerChildPathFits } from "../../../../data/containers/shared/containerPathLimits.js";
 import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection/index.js";
 import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
 import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
 import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
@@ -246,6 +246,7 @@ export async function moveRemoteContainer(input) {
         },
         containerKey: materializedPlan.containerKey,
         execSql: input.execSql,
+        onStaleAcceptance: input.onStaleAcceptance,
         plan: materializedPlan.plan,
         stillCurrent: input.stillCurrent,
         submit: (carried) => {

package/workflows/containers/child/move/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAQvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAIvD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EACL,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,aAAa,CAAC;AAErB,SAAS,yBAAyB,CAAC,KAelC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC;QAC9C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,kCAAkC,EAChC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClE,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,mCAAmC,CACpC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC;QACrE,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,oBAAoB,EAC1B,6CAA6C,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAQtC;IAKC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,uBAAuB,CACxB,CAAC;IAEF,MAAM,wBAAwB,GAAG,MAAM,sBAAsB,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,2BAA2B,CAClC,CAAC;IACF,mBAAmB,CACjB,wBAAwB,EACxB,iBAAiB,CAAC,GAAG,EACrB,mCAAmC,CACpC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9E,gCAAgC,CAAC;QAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,qCAAqC,CAAC,KAG9C;IACC,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5D,GAAG,0BAA0B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAoBrC;IACC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,yBAAyB,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAWD,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,qCAAqC,CAAC;QACpE,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,KAAqC;IAErC,MAAM,EACJ,YAAY,EAAE,uBAAuB,EACrC,iBAAiB,EACjB,MAAM,GACP,GAAG,MAAM,uBAAuB,CAAC;QAChC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,uBAAuB,CAAC;QAClE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACjD,iBAAiB;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,mBAAmB,EACnB,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,yBAAyB,CAAC;QAClC,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ,EAAE,KAAK,CAAC,mBAAmB;QACnC,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,wBAAwB,EAAE,qCAAqC,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACjE,iBAAiB;QACjB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC;QAClC,IAAI;QACJ,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAazC;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/D,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC1C,KAAK,CAAC,4BAA4B,CACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAC3E,kCAAkC,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,2BAA2B;QAC3B,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,wBAAwB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAChD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACpE,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,GAAG,EAAE,CACH,mBAAmB,CAAC,IAAI,CACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerUserRecipientKey,\n VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n asContainerManifestBundle,\n containerManifestRef,\n getTargetContainerContext,\n readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildMaterializedContainerMovePlanInput,\n ContainerMoveApi,\n ContainerMovePlan,\n ContainerMutationAuthor,\n MaterializedContainerMovePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport {\n nullOnProjectionVerificationCancellation,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n} from \"../mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"../mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"../rekey/rekeyProjection\";\nimport {\n requireUnwrappedKek,\n type SignedRotationTarget,\n signedRotationTarget,\n} from \"../rotation/rotationContext\";\nimport {\n buildMoveRotationWithBody,\n deriveMoveManifestArtifacts,\n} from \"./moveArtifacts\";\nimport {\n buildContainerMoveWraps,\n collectContainerMovePrincipalPolicies,\n} from \"./moveWraps\";\n\nfunction buildContainerMoveRequest(input: {\n body: ContainerMoveAccessEventBody;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"move\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n destinationParentContainerPathRefs:\n input.destinationParentProjection.path.map(containerManifestRef),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container move predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container move keyring\"),\n parentKekState: readCanonicalRecord(\n input.destinationParentKek,\n \"Container move destination parent KEK state\",\n ),\n };\n}\n\nasync function unwrapMoveContainerKeys(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n execSql: ExecSql;\n previousProjection: ContainerWriterProjectionResponse;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: SignedRotationTarget;\n}> {\n const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n const keksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.previousProjection,\n secretKey: input.targetSecretKey,\n verifiedByHash,\n ...projectionVerificationOptions(input),\n });\n const source = signedRotationTarget(input.previousProjection, verifiedByHash);\n const containerKey = requireUnwrappedKek(\n keksByEpochId,\n source.kek,\n \"Container move source\",\n );\n\n const destinationKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.destinationParentProjection,\n secretKey: input.targetSecretKey,\n ...projectionVerificationOptions(input),\n });\n const destinationParent = getTargetContainerContext(\n input.destinationParentProjection,\n );\n requireUnwrappedKek(\n destinationKeksByEpochId,\n destinationParent.kek,\n \"Container move destination parent\",\n );\n\n return { containerKey, destinationParent, source };\n}\n\nfunction assertContainerMoveOrganizations(input: {\n authorOrganizationId: string;\n destinationState: ContainerAccessManifestState;\n previousState: ContainerAccessManifestState;\n}): void {\n if (input.previousState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move author organization mismatch\");\n }\n if (input.destinationState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move destination organization mismatch\");\n }\n}\n\nfunction readContainerMoveStates(input: {\n authorOrganizationId: string;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n const previousState = readContainerState(input.source.manifest);\n const destinationState = readContainerState(input.destinationParent.manifest);\n assertContainerMoveOrganizations({\n authorOrganizationId: input.authorOrganizationId,\n destinationState,\n previousState,\n });\n return { destinationState, previousState };\n}\n\nfunction containerMoveDependencyManifestHashes(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n previousProjection: ContainerWriterProjectionResponse;\n}): string[] {\n return [\n ...uniqueSortedManifestHashes(input.previousProjection.path),\n ...uniqueSortedManifestHashes(input.destinationParentProjection.path),\n ];\n}\n\nfunction buildContainerMovePlanResult(input: {\n body: ContainerMoveAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerMovePlan {\n const plan: ContainerMovePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerMoveRequest({\n body: input.body,\n destinationParentKek: input.destinationParentKek,\n destinationParentProjection: input.destinationParentProjection,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n predecessorBridge: input.predecessorBridge,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\ntype MaterializedContainerMoveInput =\n BuildMaterializedContainerMovePlanInput & {\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n };\n\nasync function collectAuthorizedMovePolicies(\n input: MaterializedContainerMoveInput,\n) {\n const principalPolicies = await collectContainerMovePrincipalPolicies({\n ...input,\n resolveUserKey: input.resolveProjectionUserKey,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.destinationParentProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nasync function buildMaterializedContainerMovePlan(\n input: MaterializedContainerMoveInput,\n): Promise<MaterializedContainerMovePlan> {\n const {\n containerKey: predecessorContainerKey,\n destinationParent,\n source,\n } = await unwrapMoveContainerKeys({\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n // Only a verified path is a final depth refusal; a padded unverified path\n // must fail verification (an incident), never look like an honest refusal.\n assertContainerChildPathFits(input.destinationParentProjection.path);\n const { destinationState, previousState } = readContainerMoveStates({\n authorOrganizationId: input.author.organizationId,\n destinationParent,\n source,\n });\n const principalPolicies = await collectAuthorizedMovePolicies(input);\n const {\n body,\n containerKey,\n containerKeyEpochId,\n keyring,\n predecessorBridge,\n } = await buildMoveRotationWithBody({\n destinationParent,\n destinationState,\n override: input.containerKeyEpochId,\n predecessorContainerKey,\n previousState,\n source,\n });\n const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveMoveManifestArtifacts({\n body,\n containerKeyEpochId,\n destinationParent,\n previousState,\n signing: {\n author: input.author,\n dependencyManifestHashes: containerMoveDependencyManifestHashes(input),\n eventId: input.eventId,\n signedAt: input.signedAt,\n },\n source,\n });\n const { userRecipientKeys, wraps } = await buildContainerMoveWraps({\n principalPolicies,\n containerKey,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n manifestHash,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n state,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n\n return buildContainerMovePlanResult({\n body,\n containerKey,\n containerId: previousState.containerId,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n previousManifest: asContainerManifestBundle(source.manifest),\n previousProjection: input.previousProjection,\n predecessorBridge,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function moveRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerMoveApi;\n author: ContainerMutationAuthor;\n containerId: string;\n destinationParentContainerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerMovePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container move\",\n );\n const [previousProjection, destinationParentProjection] = await Promise.all([\n input.apiClient.getContainerWriterProjection(input.containerId),\n input.apiClient.getContainerWriterProjection(\n input.destinationParentContainerId,\n ),\n ]);\n if (!previousProjection \|\| !destinationParentProjection) {\n return null;\n }\n\n const materializedPlan = await nullOnProjectionVerificationCancellation(() =>\n buildMaterializedContainerMovePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n destinationParentProjection,\n resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n );\n if (!materializedPlan) return null;\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n ancestors: destinationParentProjection,\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { moveContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.moveContainer(input.containerId, request, options),\n result: moveContainerResult\n ? () =>\n moveContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAQvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAIvD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EACL,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,aAAa,CAAC;AAErB,SAAS,yBAAyB,CAAC,KAelC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC;QAC9C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,kCAAkC,EAChC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClE,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,mCAAmC,CACpC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC;QACrE,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,oBAAoB,EAC1B,6CAA6C,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAQtC;IAKC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,uBAAuB,CACxB,CAAC;IAEF,MAAM,wBAAwB,GAAG,MAAM,sBAAsB,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,2BAA2B,CAClC,CAAC;IACF,mBAAmB,CACjB,wBAAwB,EACxB,iBAAiB,CAAC,GAAG,EACrB,mCAAmC,CACpC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9E,gCAAgC,CAAC;QAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,qCAAqC,CAAC,KAG9C;IACC,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5D,GAAG,0BAA0B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAoBrC;IACC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,yBAAyB,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAWD,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,qCAAqC,CAAC;QACpE,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,KAAqC;IAErC,MAAM,EACJ,YAAY,EAAE,uBAAuB,EACrC,iBAAiB,EACjB,MAAM,GACP,GAAG,MAAM,uBAAuB,CAAC;QAChC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,uBAAuB,CAAC;QAClE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACjD,iBAAiB;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,mBAAmB,EACnB,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,yBAAyB,CAAC;QAClC,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ,EAAE,KAAK,CAAC,mBAAmB;QACnC,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,wBAAwB,EAAE,qCAAqC,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACjE,iBAAiB;QACjB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC;QAClC,IAAI;QACJ,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAczC;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/D,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC1C,KAAK,CAAC,4BAA4B,CACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAC3E,kCAAkC,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,2BAA2B;QAC3B,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,wBAAwB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAChD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACpE,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,GAAG,EAAE,CACH,mBAAmB,CAAC,IAAI,CACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerUserRecipientKey,\n VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n asContainerManifestBundle,\n containerManifestRef,\n getTargetContainerContext,\n readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildMaterializedContainerMovePlanInput,\n ContainerMoveApi,\n ContainerMovePlan,\n ContainerMutationAuthor,\n MaterializedContainerMovePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport {\n nullOnProjectionVerificationCancellation,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n} from \"../mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"../mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"../rekey/rekeyProjection\";\nimport {\n requireUnwrappedKek,\n type SignedRotationTarget,\n signedRotationTarget,\n} from \"../rotation/rotationContext\";\nimport {\n buildMoveRotationWithBody,\n deriveMoveManifestArtifacts,\n} from \"./moveArtifacts\";\nimport {\n buildContainerMoveWraps,\n collectContainerMovePrincipalPolicies,\n} from \"./moveWraps\";\n\nfunction buildContainerMoveRequest(input: {\n body: ContainerMoveAccessEventBody;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"move\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n destinationParentContainerPathRefs:\n input.destinationParentProjection.path.map(containerManifestRef),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container move predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container move keyring\"),\n parentKekState: readCanonicalRecord(\n input.destinationParentKek,\n \"Container move destination parent KEK state\",\n ),\n };\n}\n\nasync function unwrapMoveContainerKeys(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n execSql: ExecSql;\n previousProjection: ContainerWriterProjectionResponse;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: SignedRotationTarget;\n}> {\n const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n const keksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.previousProjection,\n secretKey: input.targetSecretKey,\n verifiedByHash,\n ...projectionVerificationOptions(input),\n });\n const source = signedRotationTarget(input.previousProjection, verifiedByHash);\n const containerKey = requireUnwrappedKek(\n keksByEpochId,\n source.kek,\n \"Container move source\",\n );\n\n const destinationKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.destinationParentProjection,\n secretKey: input.targetSecretKey,\n ...projectionVerificationOptions(input),\n });\n const destinationParent = getTargetContainerContext(\n input.destinationParentProjection,\n );\n requireUnwrappedKek(\n destinationKeksByEpochId,\n destinationParent.kek,\n \"Container move destination parent\",\n );\n\n return { containerKey, destinationParent, source };\n}\n\nfunction assertContainerMoveOrganizations(input: {\n authorOrganizationId: string;\n destinationState: ContainerAccessManifestState;\n previousState: ContainerAccessManifestState;\n}): void {\n if (input.previousState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move author organization mismatch\");\n }\n if (input.destinationState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move destination organization mismatch\");\n }\n}\n\nfunction readContainerMoveStates(input: {\n authorOrganizationId: string;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n const previousState = readContainerState(input.source.manifest);\n const destinationState = readContainerState(input.destinationParent.manifest);\n assertContainerMoveOrganizations({\n authorOrganizationId: input.authorOrganizationId,\n destinationState,\n previousState,\n });\n return { destinationState, previousState };\n}\n\nfunction containerMoveDependencyManifestHashes(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n previousProjection: ContainerWriterProjectionResponse;\n}): string[] {\n return [\n ...uniqueSortedManifestHashes(input.previousProjection.path),\n ...uniqueSortedManifestHashes(input.destinationParentProjection.path),\n ];\n}\n\nfunction buildContainerMovePlanResult(input: {\n body: ContainerMoveAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerMovePlan {\n const plan: ContainerMovePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerMoveRequest({\n body: input.body,\n destinationParentKek: input.destinationParentKek,\n destinationParentProjection: input.destinationParentProjection,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n predecessorBridge: input.predecessorBridge,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\ntype MaterializedContainerMoveInput =\n BuildMaterializedContainerMovePlanInput & {\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n };\n\nasync function collectAuthorizedMovePolicies(\n input: MaterializedContainerMoveInput,\n) {\n const principalPolicies = await collectContainerMovePrincipalPolicies({\n ...input,\n resolveUserKey: input.resolveProjectionUserKey,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.destinationParentProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nasync function buildMaterializedContainerMovePlan(\n input: MaterializedContainerMoveInput,\n): Promise<MaterializedContainerMovePlan> {\n const {\n containerKey: predecessorContainerKey,\n destinationParent,\n source,\n } = await unwrapMoveContainerKeys({\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n // Only a verified path is a final depth refusal; a padded unverified path\n // must fail verification (an incident), never look like an honest refusal.\n assertContainerChildPathFits(input.destinationParentProjection.path);\n const { destinationState, previousState } = readContainerMoveStates({\n authorOrganizationId: input.author.organizationId,\n destinationParent,\n source,\n });\n const principalPolicies = await collectAuthorizedMovePolicies(input);\n const {\n body,\n containerKey,\n containerKeyEpochId,\n keyring,\n predecessorBridge,\n } = await buildMoveRotationWithBody({\n destinationParent,\n destinationState,\n override: input.containerKeyEpochId,\n predecessorContainerKey,\n previousState,\n source,\n });\n const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveMoveManifestArtifacts({\n body,\n containerKeyEpochId,\n destinationParent,\n previousState,\n signing: {\n author: input.author,\n dependencyManifestHashes: containerMoveDependencyManifestHashes(input),\n eventId: input.eventId,\n signedAt: input.signedAt,\n },\n source,\n });\n const { userRecipientKeys, wraps } = await buildContainerMoveWraps({\n principalPolicies,\n containerKey,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n manifestHash,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n state,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n\n return buildContainerMovePlanResult({\n body,\n containerKey,\n containerId: previousState.containerId,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n previousManifest: asContainerManifestBundle(source.manifest),\n previousProjection: input.previousProjection,\n predecessorBridge,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function moveRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerMoveApi;\n author: ContainerMutationAuthor;\n containerId: string;\n destinationParentContainerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n onStaleAcceptance?: (() => void) \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerMovePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container move\",\n );\n const [previousProjection, destinationParentProjection] = await Promise.all([\n input.apiClient.getContainerWriterProjection(input.containerId),\n input.apiClient.getContainerWriterProjection(\n input.destinationParentContainerId,\n ),\n ]);\n if (!previousProjection \|\| !destinationParentProjection) {\n return null;\n }\n\n const materializedPlan = await nullOnProjectionVerificationCancellation(() =>\n buildMaterializedContainerMovePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n destinationParentProjection,\n resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n );\n if (!materializedPlan) return null;\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n ancestors: destinationParentProjection,\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n onStaleAcceptance: input.onStaleAcceptance,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { moveContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.moveContainer(input.containerId, request, options),\n result: moveContainerResult\n ? () =>\n moveContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/move/moveRotation.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { createContainerKekPredecessorBridge, KeyingVerificationError, normalizeContainerKekKeyring, openContainerKekKeyring, sealContainerKekKeyring, } from "../../../../internal/crypto/index.js";
 import { resolveContainerKekEpochId } from "../../../../data/containers/shared/events.js";
-import { verifyContainerKekEntries } from "../../../../data/documents/shared/containerKekEntryVerification.js";
+import { verifyContainerKekEntries } from "../../../../data/documents/shared/containerKek/containerKekEntryVerification.js";
 /**
  * A rotation must never launder history it did not verify: an
  * authenticated-but-poisoned keyring (sealed by a prior authorized writer

package/workflows/containers/child/move/moveRotation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"moveRotation.js","sourceRoot":"","sources":["moveRotation.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,~~iEAAiE~~,CAAC;~~AAE5G~~;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA4C;AAC5C;;;;;;GAMG;AACH,cAAmC;IAEnC,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO;QAC9C,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;YAC5C,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,kBAAkB;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,CAC/B,KAAK,CAAC,WAAW,EACjB,eAAe,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,OAAO,uBAAuB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE;YACP,GAAG,eAAe;YAClB;gBACE,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;gBACzD,WAAW,EAAE,KAAK,CAAC,kBAAkB;aACtC;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAOrD;IAMC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,uBAAuB,EAAE,KAAK,CAAC,kBAAkB;QACjD,8BAA8B,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type {\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n} from \"@tearleads/crypto\";\nimport {\n createContainerKekPredecessorBridge,\n KeyingVerificationError,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport { resolveContainerKekEpochId } from \"../../../../data/containers/shared/events\";\nimport { verifyContainerKekEntries } from \"../../../../data/documents/shared/containerKekEntryVerification\";\n\n/*\n A rotation must never launder history it did not verify: an\n * authenticated-but-poisoned keyring (sealed by a prior authorized writer\n * with wrong material) would otherwise be re-signed under the honest\n * rotator's event. Every entry is checked against the material-id its\n * ordinal commits to before it is sealed forward; entry i is key epoch\n * i + 1.\n /\nexport async function verifyKeyringEntriesForSeal(\n containerId: string,\n entries: readonly ContainerKekKeyringEntry[],\n /\n The epoch ids the KEK's signed history commits to, wherever the\n * projection served it (`signedHistoryEpochIds`). A self-consistent forgery\n * passes the material check but cannot also make a real id disappear, so an\n * honest rotation never re-signs one. The KEK's own served history alone is\n * not enough: a server can serve it under another KEK (#2365 finding 32).\n /\n signedEpochIds: ReadonlySet<string>,\n): Promise<void> {\n await verifyContainerKekEntries(containerId, entries);\n const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n for (const historicalId of signedEpochIds) {\n if (!entryIds.has(historicalId)) {\n // Classified like the reader's and the override's refusal of it.\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Container KEK keyring omits an epoch its manifest history commits to\",\n );\n }\n }\n}\n\n/\n Re-seals the container's key history for a rotation: the previous\n * keyring's entries plus the retiring key, under the new epoch's key. One\n * decrypt and one seal regardless of container age.\n /\nexport async function sealRotationKeyring(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n signedEpochIds: ReadonlySet<string>;\n successorContainerKey: Uint8Array;\n successorContainerKeyEpochId: string;\n}): Promise<ContainerKekKeyring> {\n const previousEntries = input.currentKek.keyring\n ? await openContainerKekKeyring({\n keyEpoch: input.currentKek.containerKeyEpoch,\n keyring: normalizeContainerKekKeyring(input.currentKek.keyring),\n successorContainerKey: input.currentKeyMaterial,\n })\n : [];\n await verifyKeyringEntriesForSeal(\n input.containerId,\n previousEntries,\n input.signedEpochIds,\n );\n return sealContainerKekKeyring({\n containerId: input.containerId,\n entries: [\n ...previousEntries,\n {\n containerKeyEpochId: input.currentKek.containerKeyEpochId,\n keyMaterial: input.currentKeyMaterial,\n },\n ],\n keyEpoch: input.keyEpoch,\n successorContainerKey: input.successorContainerKey,\n successorContainerKeyEpochId: input.successorContainerKeyEpochId,\n });\n}\n\n/\n Mints one container KEK rotation: fresh entropy for the new epoch, the\n * write-once bridge to the retiring epoch, and the re-sealed keyring.\n */\nexport async function buildContainerRotationArtifacts(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n override?: string \| undefined;\n signedEpochIds: ReadonlySet<string>;\n}): Promise<{\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: ContainerKekPredecessorBridge;\n}> {\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.containerId,\n keyEpoch: input.keyEpoch,\n keyMaterial: containerKey,\n override: input.override,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.containerId,\n predecessorContainerKey: input.currentKeyMaterial,\n predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n const keyring = await sealRotationKeyring({\n containerId: input.containerId,\n currentKek: input.currentKek,\n currentKeyMaterial: input.currentKeyMaterial,\n keyEpoch: input.keyEpoch,\n signedEpochIds: input.signedEpochIds,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKey, containerKeyEpochId, keyring, predecessorBridge };\n}\n"]}
1	+ {"version":3,"file":"moveRotation.js","sourceRoot":"","sources":["moveRotation.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8EAA8E,CAAC;AAEzH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA4C;AAC5C;;;;;;GAMG;AACH,cAAmC;IAEnC,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO;QAC9C,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;YAC5C,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,kBAAkB;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,CAC/B,KAAK,CAAC,WAAW,EACjB,eAAe,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,OAAO,uBAAuB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE;YACP,GAAG,eAAe;YAClB;gBACE,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;gBACzD,WAAW,EAAE,KAAK,CAAC,kBAAkB;aACtC;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAOrD;IAMC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,uBAAuB,EAAE,KAAK,CAAC,kBAAkB;QACjD,8BAA8B,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type {\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n} from \"@tearleads/crypto\";\nimport {\n createContainerKekPredecessorBridge,\n KeyingVerificationError,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport { resolveContainerKekEpochId } from \"../../../../data/containers/shared/events\";\nimport { verifyContainerKekEntries } from \"../../../../data/documents/shared/containerKek/containerKekEntryVerification\";\n\n/*\n A rotation must never launder history it did not verify: an\n * authenticated-but-poisoned keyring (sealed by a prior authorized writer\n * with wrong material) would otherwise be re-signed under the honest\n * rotator's event. Every entry is checked against the material-id its\n * ordinal commits to before it is sealed forward; entry i is key epoch\n * i + 1.\n /\nexport async function verifyKeyringEntriesForSeal(\n containerId: string,\n entries: readonly ContainerKekKeyringEntry[],\n /\n The epoch ids the KEK's signed history commits to, wherever the\n * projection served it (`signedHistoryEpochIds`). A self-consistent forgery\n * passes the material check but cannot also make a real id disappear, so an\n * honest rotation never re-signs one. The KEK's own served history alone is\n * not enough: a server can serve it under another KEK (#2365 finding 32).\n /\n signedEpochIds: ReadonlySet<string>,\n): Promise<void> {\n await verifyContainerKekEntries(containerId, entries);\n const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n for (const historicalId of signedEpochIds) {\n if (!entryIds.has(historicalId)) {\n // Classified like the reader's and the override's refusal of it.\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Container KEK keyring omits an epoch its manifest history commits to\",\n );\n }\n }\n}\n\n/\n Re-seals the container's key history for a rotation: the previous\n * keyring's entries plus the retiring key, under the new epoch's key. One\n * decrypt and one seal regardless of container age.\n /\nexport async function sealRotationKeyring(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n signedEpochIds: ReadonlySet<string>;\n successorContainerKey: Uint8Array;\n successorContainerKeyEpochId: string;\n}): Promise<ContainerKekKeyring> {\n const previousEntries = input.currentKek.keyring\n ? await openContainerKekKeyring({\n keyEpoch: input.currentKek.containerKeyEpoch,\n keyring: normalizeContainerKekKeyring(input.currentKek.keyring),\n successorContainerKey: input.currentKeyMaterial,\n })\n : [];\n await verifyKeyringEntriesForSeal(\n input.containerId,\n previousEntries,\n input.signedEpochIds,\n );\n return sealContainerKekKeyring({\n containerId: input.containerId,\n entries: [\n ...previousEntries,\n {\n containerKeyEpochId: input.currentKek.containerKeyEpochId,\n keyMaterial: input.currentKeyMaterial,\n },\n ],\n keyEpoch: input.keyEpoch,\n successorContainerKey: input.successorContainerKey,\n successorContainerKeyEpochId: input.successorContainerKeyEpochId,\n });\n}\n\n/\n Mints one container KEK rotation: fresh entropy for the new epoch, the\n * write-once bridge to the retiring epoch, and the re-sealed keyring.\n */\nexport async function buildContainerRotationArtifacts(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n override?: string \| undefined;\n signedEpochIds: ReadonlySet<string>;\n}): Promise<{\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: ContainerKekPredecessorBridge;\n}> {\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.containerId,\n keyEpoch: input.keyEpoch,\n keyMaterial: containerKey,\n override: input.override,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.containerId,\n predecessorContainerKey: input.currentKeyMaterial,\n predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n const keyring = await sealRotationKeyring({\n containerId: input.containerId,\n currentKek: input.currentKek,\n currentKeyMaterial: input.currentKeyMaterial,\n keyEpoch: input.keyEpoch,\n signedEpochIds: input.signedEpochIds,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKey, containerKeyEpochId, keyring, predecessorBridge };\n}\n"]}

package/workflows/containers/child/move/moveWraps.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
 import { readContainerState } from "../../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKek/containerKekCurrency.js";
 import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
 import { buildContainerRotationWraps } from "../rotation/rotationWraps.js";
 export async function collectContainerMovePrincipalPolicies(input) {