@tearleads/client-sdk 0.1.66 → 0.1.68

package/workflows/container-contents/container-state/move/moveIntentSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moveIntentSync.js","sourceRoot":"","sources":["moveIntentSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOhD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAIlC,SAAS,iBAAiB,CAExB,SAAwB,EAAE,MAAc;IACxC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAQ3C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,EAAE;QAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAK9C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,sBAAsB,GAC1B,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,SAAS;SACzD,cAAc,IAAI,IAAI,CAAC;IAC5B,IACE,CAAC,sBAAsB;QACvB,sBAAsB,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAChE,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,CAAC;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,MAAM,oCAAoC,GACxC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAAC,OAAO,EAAE;QACxE,KAAK,CAAC,WAAW;KAClB,CAAC,CAAC;IACL,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,oCAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACrE,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,4BAA4B;QAC9C,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,+BAA+B,CAAC;QAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,SAAS;QAChC,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,oBAAoB,GACxB,MAAM,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,oBAAoB,CAAC,SAAS,GAAG;QAC/B,GAAG,oBAAoB,CAAC,SAAS;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,SAAS;QAChC,eAAe,EAAE,KAAK,CAAC,SAAS;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACxD,oBAAoB,EACpB;QACE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,eAAe,EAAE,KAAK,CAAC,uBAAuB;QAC9C,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;KACrC,EACD,KAAK,EACL;QACE,cAAc;QACd,gBAAgB,EAAE;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,EACD;QACE,wBAAwB,EAAE,cAAc;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;SACpC;KACF,CACF,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,iBAAiB,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnE,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,iBAAiB,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;IACjD,qCAAqC,CAAC,cAAc,EAAE,oBAAoB,EAAE;QAC1E,eAAe,EAAE,UAAU;QAC3B,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,cAAc,CAAC,SAAS,GAAG;QACzB,GAAG,cAAc,CAAC,SAAS;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAuC;IAEvC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1C,MAAM,gBAAgB,GAAG,MAAM,CAAC,yBAAyB,CAAC;IAC1D,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,yBAAyB,CACjE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B;QACE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;QAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;QACnC,yBAAyB,EAAE,gBAAgB;QAC3C,YAAY,EAAE,SAAS,CAAC,SAAS;KAClC,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IAC/C,sEAAsE;IACtE,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,cAAc,EAAE,CAAC;QACnB,cAAc,CAAC,SAAS,GAAG;YACzB,GAAG,cAAc,CAAC,SAAS;YAC3B,QAAQ,EAAE,gBAAgB;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;IACtB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,gDAAgD,MAAM,CAAC,WAAW,2CAA2C,CAC9G,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAAC,KAM/B;IACC,MAAM,EACJ,kBAAkB,EAClB,KAAK,EACL,WAAW,EACX,iBAAiB,EACjB,SAAS,GACV,GAAG,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IACpC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,YAAY,yBAAyB;QAC5C,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACvC,2EAA2E;IAC3E,2CAA2C;IAC3C,IAAI,iBAAiB,IAAI,KAAK,YAAY,KAAK;QAC7C,uBAAuB,CACrB,SAAS,EACT,iEAAiE,EACjE,KAAK,CACN,CAAC;IACJ,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc;KACrD,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;QAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;QACnC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,kCAAkC,YAAY,CAAC,KAAK,CAAC,EAAE;QAChE,KAAK;KACN,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1C,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,cAAc,GAAkB,MAAM,CAAC,iBAAiB,CAAC;IAC7D,MAAM,kBAAkB,GAAG,GAAG,EAAE;QAC9B,IAAI,iBAAiB,EAAE,CAAC;YACtB,uBAAuB,CACrB,SAAS,EACT,mBAAmB,EACnB,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAC3D,CAAC;YACF,SAAS,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,WAAoB,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,GAAG,EAAE;gBACf,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,SAAS,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC3B,IAAI,CAAC,iBAAiB;oBACpB,SAAS,CAAC,2BAA2B,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAClE,OAAO,kBAAkB,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,iBAAiB;gBAAE,OAAO,0BAA0B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,4BAA4B,CAAC;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,OAAO,EAAE,mDAAmD;gBAC5D,KAAK;aACN,CAAC,CAAC;YACH,OAAO,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC;QACzB,MAAM,KAAK,GACT,SAAS,IAAI,QAAQ;YACnB,CAAC,CAAC,sBAAsB,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC;YAC1D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;YAAE,OAAO,kBAAkB,EAAE,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC;YAChD,IAAI;YACJ,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM;YACN,KAAK;YACL,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;YAClE,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,SAAS,IAAI,QAAQ;YACnB,CAAC,CAAC,qDAAqD,MAAM,CAAC,WAAW,0BAA0B;YACnG,CAAC,CAAC,oDAAoD,MAAM,CAAC,WAAW,EAAE,CAC7E,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC;YACtB,kBAAkB;YAClB,KAAK;YACL,WAAW;YACX,iBAAiB;YACjB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAEvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,4DAA4D;YACrE,KAAK;SACN,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EACL,yEAAyE;YAC3E,KAAK;SACN,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,+BAA+B,CAAC,cAAc,CAAC;QAChD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,yBAAyB;QACzB,MAAM,4BAA4B,CAAC;YACjC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,yCAAyC;YAClD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IACD,IACE,CAAC,+BAA+B,CAAC,WAAW,CAAC;QAC7C,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC/C,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,qDAAqD;YAC9D,KAAK;SACN,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,cAAc;QACd,WAAW;QACX,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAQrD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,cAAc,GAClB,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC;YACrD,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,MAAM;YACN,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK;SACN,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,8BAA8B;YAC9B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { ContainerPathTooDeepError } from \"../../../../data/containers/shared/containerPathLimits\";\nimport { reportAndRethrowKeyingVerificationError } from \"../../../../data/keyingProjectionVerification/error\";\nimport { errorMessage } from \"../../../../data/shared/errorMessage\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport {\n  createDetachedContainerMetadataState,\n  installDetachedContainerMetadataState,\n} from \"../../metadata/metadataStateIsolation\";\nimport type { ContainerState, RemoteContainer } from \"../../remoteHydration\";\nimport { hasRemoteContainerMetadataState } from \"../../remoteHydration/reconciliation\";\nimport { moveRemoteContainer } from \"../remote\";\nimport type {\n  AcceptedMoveRetry,\n  ContainerMoveIntentSyncHost,\n  ContainerMoveIntentSyncInput,\n  ContainerMoveIntentSyncState,\n} from \"../types\";\nimport {\n  appliedRemoteContainer,\n  leaveAcceptedMoveQueued,\n  STALE_ACCEPTED_MOVE,\n  unacknowledgedAcceptedMove,\n  unpersistedAcceptedMove,\n} from \"./acceptedMoveSettlement\";\n\ntype MoveIntentSyncResult = \"abandoned\" | \"blocked\" | \"failed\" | \"moved\";\n\nfunction currentMoveResult<\n  Result extends Exclude<MoveIntentSyncResult, \"abandoned\">,\n>(isCurrent: () => boolean, result: Result): \"abandoned\" | Result {\n  return isCurrent() ? result : \"abandoned\";\n}\n\nasync function recordPendingMoveIntentError(input: {\n  blocked?: boolean | undefined;\n  containerId: string;\n  expectedIntentId: string;\n  expectedUpdatedAt: string;\n  isCurrent: () => boolean;\n  message: string;\n  state: ContainerMoveIntentSyncState;\n}): Promise<boolean> {\n  if (!input.isCurrent()) {\n    return false;\n  }\n  const execSql = input.state.runtime.infra.execSql;\n  await input.state.persistence.recordMoveIntentError(execSql, {\n    blocked: input.blocked,\n    containerId: input.containerId,\n    expectedIntentId: input.expectedIntentId,\n    expectedUpdatedAt: input.expectedUpdatedAt,\n    message: input.message,\n    stillCurrent: input.isCurrent,\n  });\n  return input.isCurrent();\n}\n\nasync function resolveMoveIntentLocalUpdatedAt(input: {\n  containerId: string;\n  isCurrent: () => boolean;\n  remoteUpdatedAt: string;\n  state: ContainerMoveIntentSyncState;\n}): Promise<string | null> {\n  if (!input.isCurrent()) {\n    return null;\n  }\n  const previousLocalUpdatedAt =\n    input.state.containersById.get(input.containerId)?.container\n      .localUpdatedAt ?? null;\n  if (\n    !previousLocalUpdatedAt ||\n    previousLocalUpdatedAt.localeCompare(input.remoteUpdatedAt) <= 0\n  ) {\n    return input.remoteUpdatedAt;\n  }\n\n  const execSql = input.state.runtime.infra.execSql;\n  const containersWithPendingMetadataUpdates =\n    await input.state.persistence.listContainerIdsWithPendingUpdates(execSql, [\n      input.containerId,\n    ]);\n  if (!input.isCurrent()) {\n    return null;\n  }\n\n  return containersWithPendingMetadataUpdates.includes(input.containerId)\n    ? previousLocalUpdatedAt\n    : input.remoteUpdatedAt;\n}\n\nexport async function persistAcceptedMoveIntent(input: {\n  host: ContainerMoveIntentSyncHost;\n  isCurrent: () => boolean;\n  intent: ContainerMoveIntentSyncInput[\"intent\"];\n  moved: RemoteContainer;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerMoveIntentSyncState;\n}): Promise<boolean> {\n  const { host, intent, moved, state } = input;\n  const abandon = () => {\n    input.requestRemoteReconciliation(moved.parentId);\n    return false;\n  };\n  if (!input.isCurrent()) return abandon();\n  const containerState = state.containersById.get(intent.containerId);\n  if (!containerState) {\n    return false;\n  }\n\n  await createRuntimePrincipalPolicyWarmer(state.runtime)({\n    organizationId: moved.organizationId,\n    references: moved.metadataReferencedPrincipals,\n    stillCurrent: input.isCurrent,\n  });\n  if (!input.isCurrent()) {\n    return abandon();\n  }\n  const localUpdatedAt = await resolveMoveIntentLocalUpdatedAt({\n    containerId: intent.containerId,\n    isCurrent: input.isCurrent,\n    remoteUpdatedAt: moved.updatedAt,\n    state,\n  });\n  if (!input.isCurrent() || localUpdatedAt === null) {\n    return abandon();\n  }\n  const persistenceCandidate =\n    await createDetachedContainerMetadataState(containerState);\n  if (!input.isCurrent()) {\n    return abandon();\n  }\n  persistenceCandidate.container = {\n    ...persistenceCandidate.container,\n    createdAt: moved.createdAt,\n    serverCreatedAt: moved.createdAt,\n    serverUpdatedAt: moved.updatedAt,\n    updatedAt: moved.updatedAt,\n  };\n  const persistenceResult = await host.persistContainerState(\n    persistenceCandidate,\n    {\n      accessEpoch: moved.metadataAccessEpoch,\n      accessStateHash: moved.metadataAccessStateHash,\n      documentId: moved.metadataDocumentId,\n      metadataDocumentId: moved.metadataDocumentId,\n      organizationId: moved.organizationId,\n      parentId: moved.parentId,\n      systemSlot: moved.systemSlot ?? null,\n    },\n    false,\n    {\n      localUpdatedAt,\n      serverTimestamps: {\n        createdAt: moved.createdAt,\n        updatedAt: moved.updatedAt,\n      },\n    },\n    {\n      expectedStateWhenMissing: containerState,\n      isCurrent: input.isCurrent,\n      moveIntentSettlement: {\n        containerId: intent.containerId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n      },\n    },\n  );\n  if (!input.isCurrent() || persistenceResult.status !== \"persisted\") {\n    return abandon();\n  }\n  if (persistenceResult.moveIntentSettled !== true) {\n    throw new Error(\n      \"Container move persistence must settle the intent atomically\",\n    );\n  }\n  if (!input.isCurrent()) return abandon();\n  const { record: nextRecord } = persistenceResult;\n  installDetachedContainerMetadataState(containerState, persistenceCandidate, {\n    candidateRecord: nextRecord,\n    preserveConcurrentMetadataEdit: true,\n  });\n  containerState.container = {\n    ...containerState.container,\n    metadataDocumentId: moved.metadataDocumentId,\n    organizationId: moved.organizationId,\n    parentId: moved.parentId,\n  };\n  return true;\n}\n\n/**\n * A move refused for path length never succeeds; the queue-time check saw only\n * the descendants this device holds. Drop the queued move and restore the\n * previous parent together: the server row never changed, so no listing would\n * ever put the folder back.\n */\nasync function abandonTooDeepMove(\n  syncInput: ContainerMoveIntentSyncInput,\n): Promise<MoveIntentSyncResult> {\n  const { host, intent, state } = syncInput;\n  const previousParentId = intent.previousParentContainerId;\n  if (previousParentId === null) {\n    throw new Error(\"A queued container move must name its previous parent\");\n  }\n  const abandoned = await state.persistence.abandonMoveIntentRevision(\n    state.runtime.infra.execSql,\n    {\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      previousParentContainerId: previousParentId,\n      stillCurrent: syncInput.isCurrent,\n    },\n  );\n  if (!syncInput.isCurrent()) return \"abandoned\";\n  // A newer local move superseded this revision; it replays on its own.\n  if (!abandoned) return \"failed\";\n  const containerState = state.containersById.get(intent.containerId);\n  if (containerState) {\n    containerState.container = {\n      ...containerState.container,\n      parentId: previousParentId,\n    };\n  }\n  host.updateSnapshot();\n  state.runtime.util.log(\n    `Container contents: abandoned queued move of ${intent.containerId}; its path would exceed the maximum depth`,\n  );\n  return \"failed\";\n}\n\n/** A replay that threw: refused for depth, tampered, or left unsettled. */\nasync function failedMoveReplay(input: {\n  abandonAppliedMove: () => \"abandoned\";\n  error: unknown;\n  parentState: ContainerState;\n  remoteMoveApplied: boolean;\n  syncInput: ContainerMoveIntentSyncInput;\n}): Promise<MoveIntentSyncResult> {\n  const {\n    abandonAppliedMove,\n    error,\n    parentState,\n    remoteMoveApplied,\n    syncInput,\n  } = input;\n  const { intent, state } = syncInput;\n  if (!syncInput.isCurrent()) {\n    return abandonAppliedMove();\n  }\n  if (error instanceof ContainerPathTooDeepError)\n    return abandonTooDeepMove(syncInput);\n  // Even a refused acknowledgement leaves the move on the server; its replay\n  // verifies the head again before settling.\n  if (remoteMoveApplied && error instanceof Error)\n    leaveAcceptedMoveQueued(\n      syncInput,\n      \"Container contents: an accepted container move failed to settle\",\n      error,\n    );\n  await reportAndRethrowKeyingVerificationError(\n    error,\n    state.runtime.util.reportSecurityIncident,\n    {\n      objectId: intent.containerId,\n      objectKind: \"container\",\n      operation: \"container.move.replay\",\n      organizationId: parentState.container.organizationId,\n    },\n  );\n  if (!syncInput.isCurrent()) {\n    return abandonAppliedMove();\n  }\n  await recordPendingMoveIntentError({\n    containerId: intent.containerId,\n    expectedIntentId: intent.id,\n    expectedUpdatedAt: intent.updatedAt,\n    isCurrent: syncInput.isCurrent,\n    message: `Failed to sync container move: ${errorMessage(error)}`,\n    state,\n  });\n  return currentMoveResult(syncInput.isCurrent, \"failed\");\n}\n\nasync function movePendingRemoteContainer(input: {\n  containerState: ContainerState;\n  parentState: ContainerState;\n  syncInput: ContainerMoveIntentSyncInput;\n}): Promise<MoveIntentSyncResult> {\n  const { containerState, parentState, syncInput } = input;\n  const { host, intent, state } = syncInput;\n  let remoteMoveApplied = false;\n  let remoteParentId: string | null = intent.parentContainerId;\n  const abandonAppliedMove = () => {\n    if (remoteMoveApplied) {\n      leaveAcceptedMoveQueued(\n        syncInput,\n        STALE_ACCEPTED_MOVE,\n        new Error(\"Stale pass dropped an accepted container move\"),\n      );\n      syncInput.requestRemoteReconciliation(remoteParentId);\n    }\n    return \"abandoned\" as const;\n  };\n  try {\n    const replayed = await moveRemoteContainer({\n      containerId: intent.containerId,\n      onAccepted: () => {\n        remoteMoveApplied = true;\n      },\n      parentContainerId: intent.parentContainerId,\n      resolveProjectionUserKey: state.resolveProjectionUserKey,\n      runtime: state.runtime,\n      stillCurrent: syncInput.isCurrent,\n    });\n    if (!replayed) {\n      if (!syncInput.isCurrent()) {\n        if (!remoteMoveApplied)\n          syncInput.requestRemoteReconciliation(intent.parentContainerId);\n        return abandonAppliedMove();\n      }\n      if (remoteMoveApplied) return unacknowledgedAcceptedMove(syncInput);\n      await recordPendingMoveIntentError({\n        containerId: intent.containerId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n        isCurrent: syncInput.isCurrent,\n        message: \"Remote container move was rejected or unavailable\",\n        state,\n      });\n      return currentMoveResult(syncInput.isCurrent, \"failed\");\n    }\n    remoteMoveApplied = true;\n    const moved =\n      \"applied\" in replayed\n        ? appliedRemoteContainer(containerState, replayed.applied)\n        : replayed.moved;\n    remoteParentId = moved.parentId;\n    if (!syncInput.isCurrent()) return abandonAppliedMove();\n\n    const persisted = await persistAcceptedMoveIntent({\n      host,\n      isCurrent: syncInput.isCurrent,\n      intent,\n      moved,\n      requestRemoteReconciliation: syncInput.requestRemoteReconciliation,\n      state,\n    });\n    if (!persisted) return unpersistedAcceptedMove(syncInput);\n    state.runtime.util.log(\n      \"applied\" in replayed\n        ? `Container contents: settled queued container move ${intent.containerId} the server already held`\n        : `Container contents: synced queued container move ${intent.containerId}`,\n    );\n    return \"moved\";\n  } catch (error: unknown) {\n    return failedMoveReplay({\n      abandonAppliedMove,\n      error,\n      parentState,\n      remoteMoveApplied,\n      syncInput,\n    });\n  }\n}\n\nasync function trySyncPendingContainerMoveIntent(\n  input: ContainerMoveIntentSyncInput,\n): Promise<MoveIntentSyncResult> {\n  const { intent, state } = input;\n  if (!input.isCurrent()) {\n    return \"abandoned\";\n  }\n  const containerState = state.containersById.get(intent.containerId);\n  const parentState = state.containersById.get(intent.parentContainerId);\n\n  if (!containerState) {\n    await recordPendingMoveIntentError({\n      blocked: true,\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Container move intent references a missing local container\",\n      state,\n    });\n    return currentMoveResult(input.isCurrent, \"failed\");\n  }\n  if (!parentState) {\n    await recordPendingMoveIntentError({\n      blocked: true,\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message:\n        \"Container move intent references a missing destination parent container\",\n      state,\n    });\n    return currentMoveResult(input.isCurrent, \"failed\");\n  }\n  if (input.isRemoteSyncBlocked(containerState.container.organizationId)) {\n    return \"blocked\";\n  }\n  if (\n    !hasRemoteContainerMetadataState(containerState) ||\n    input.isCreatePending(intent.containerId)\n  ) {\n    // Source not synced yet is TRANSIENT, exactly like the destination case\n    // below: the source's own create intent syncs first (createIntentSync runs\n    // before moveIntentSync in a pass), but if that create fails on this pass\n    // the source still lacks remote metadata here. Keep the intent 'pending'\n    // (not 'blocked') so the queue reports a retryable failure rather than a\n    // missing-dependency block; either way listUnsyncedMoveIntents replays it\n    // once the create lands.\n    await recordPendingMoveIntentError({\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Container move source is not synced yet\",\n      state,\n    });\n    return currentMoveResult(input.isCurrent, \"blocked\");\n  }\n  if (\n    !hasRemoteContainerMetadataState(parentState) ||\n    input.isCreatePending(intent.parentContainerId)\n  ) {\n    await recordPendingMoveIntentError({\n      containerId: intent.containerId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Container move destination parent is not synced yet\",\n      state,\n    });\n    return currentMoveResult(input.isCurrent, \"blocked\");\n  }\n\n  return movePendingRemoteContainer({\n    containerState,\n    parentState,\n    syncInput: input,\n  });\n}\n\nexport async function syncPendingContainerMoveIntents(input: {\n  host: ContainerMoveIntentSyncHost;\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  acceptedMoveRetry: AcceptedMoveRetry;\n  state: ContainerMoveIntentSyncState;\n}): Promise<number> {\n  if (!input.isCurrent()) {\n    return 0;\n  }\n  const { host } = input;\n  const state = { ...input.state };\n  const execSql = state.runtime.infra.execSql;\n  const pendingIntents =\n    await state.persistence.listUnsyncedMoveIntents(execSql);\n  if (!input.isCurrent()) {\n    return 0;\n  }\n  let movedCount = 0;\n\n  for (const intent of pendingIntents) {\n    if (!input.isCurrent()) {\n      return movedCount;\n    }\n    const result = await trySyncPendingContainerMoveIntent({\n      host,\n      isCurrent: input.isCurrent,\n      isCreatePending: input.isCreatePending,\n      isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n      intent,\n      requestRemoteReconciliation: input.requestRemoteReconciliation,\n      acceptedMoveRetry: input.acceptedMoveRetry,\n      state,\n    });\n    if (result === \"abandoned\") {\n      return movedCount;\n    }\n\n    if (result === \"moved\") {\n      movedCount += 1;\n    } else {\n      // A replay that failed before reaching the server keeps an earlier\n      // acceptance's retries going.\n      input.acceptedMoveRetry.resume(intent.id);\n    }\n  }\n\n  return movedCount;\n}\n"]}

package/workflows/container-contents/container-state/remote.js

@@ -1,6 +1,6 @@
 import { isContainerNotFoundFailure } from "../../../data/containers/shared/mutationFailures.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { moveRemoteContainer as moveRemoteContainerMutation, readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, shareRemoteContainer as shareRemoteContainerMutation, } from "../../containers/index.js";
+import { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, replayRemoteContainerMove, shareRemoteContainer as shareRemoteContainerMutation, } from "../../containers/index.js";
 import { createRuntimeCurrentGroupShare } from "../../containers/child/share/runtimeCurrentGroupShare.js";
 import { resolveDocumentCreateAuthor } from "../../documents/index.js";
 import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataRuntime.js";
@@ -103,43 +103,46 @@ export async function shareRemoteContainerWithGroup(input) {
     }
     return sharedRemoteContainerStateFromMutation(input.previousProjection, shared.response);
 }
+/**
+ * Replays a queued move. `applied` carries the verified head when the server
+ * already holds the container under the destination, so nothing is posted.
+ */
 export async function moveRemoteContainer(input) {
     const writer = resolveContainerWriterContext(input.runtime, "container move");
     if (!writer) {
         return null;
     }
     const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;
-    const moved = await moveRemoteContainerMutation({
+    const replayed = await replayRemoteContainerMove({
         reportSecurityIncident: input.runtime.util.reportSecurityIncident,
         apiClient,
         author,
         containerId: input.containerId,
         destinationParentContainerId: input.parentContainerId,
         execSql,
-        onStaleAcceptance: input.onStaleAcceptance,
+        onAccepted: input.onAccepted,
         resolveProjectionUserKey: input.resolveProjectionUserKey,
         stillCurrent: input.stillCurrent,
         targetSecretKey,
         warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
     });
-    if (!moved) {
-        return null;
+    if (!replayed || "applied" in replayed) {
+        return replayed;
     }
+    const { response } = replayed;
     return {
-        createdAt: moved.response.createdAt,
-        effectiveAccessLevel: "admin",
-        id: moved.response.containerId,
-        organizationId: moved.response.organizationId,
-        parentId: moved.response.parentId,
-        metadataDocumentId: readContainerMutationMetadataDocumentId({
-            response: moved.response,
-        }),
-        metadataAccessEpoch: moved.response.manifestHead.epoch,
-        metadataAccessStateHash: moved.response.manifestHead.manifestHash,
-        metadataReferencedPrincipals: referencedPrincipalHeadsFromContainerMutationResponse({
-            response: moved.response,
-        }),
-        updatedAt: moved.response.updatedAt,
+        moved: {
+            createdAt: response.createdAt,
+            effectiveAccessLevel: "admin",
+            id: response.containerId,
+            organizationId: response.organizationId,
+            parentId: response.parentId,
+            metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),
+            metadataAccessEpoch: response.manifestHead.epoch,
+            metadataAccessStateHash: response.manifestHead.manifestHash,
+            metadataReferencedPrincipals: referencedPrincipalHeadsFromContainerMutationResponse({ response }),
+            updatedAt: response.updatedAt,
+        },
     };
 }
 export async function deleteRemoteContainer(input) {

package/workflows/container-contents/container-state/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,uCAAuC,EACvC,qDAAqD,EACrD,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,6BAA6B,CAAC;AAQrC;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC9C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,oBAAoB,EAAE,OAAO;QAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,kBAAkB,EAAE,uCAAuC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;QACtD,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY;QACjE,4BAA4B,EAC1B,qDAAqD,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACJ,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  moveRemoteContainer as moveRemoteContainerMutation,\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n  shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/share/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n  type ContainerAlreadyCommitted,\n  createRemoteContainerWithMetadataDocument,\n} from \"./create/createWithMetadata\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n  RemoteContainer,\n  SharedRemoteContainerState,\n} from \"./types\";\n\n/**\n * Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n  runtime: ContainerWorkflowRuntime,\n  operation:\n    | \"container create\"\n    | \"container group share\"\n    | \"container move\"\n    | \"container share\",\n) {\n  const author = resolveDocumentCreateAuthor(runtime);\n  const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !secretKey) {\n    runtime.util.log(\n      `Container contents: skipped ${operation} because the writer context is unavailable.`,\n    );\n    return null;\n  }\n\n  return {\n    apiClient: runtime.apiClient,\n    author,\n    execSql: runtime.infra.execSql,\n    secretKey,\n  };\n}\n\nexport async function createRemoteContainer(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n  previousProjection: ContainerWriterProjectionResponse,\n  response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n  if (\n    response.containerId !== previousProjection.containerId ||\n    response.organizationId !== previousProjection.organizationId\n  )\n    throw new Error(\"Container mutation response projection mismatch\");\n  return {\n    accessManifestHash: response.manifestHead.manifestHash,\n    accessEpoch: response.manifestHead.epoch,\n    createdAt: response.createdAt,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n    referencedPrincipalHeads:\n      referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n    updatedAt: response.updatedAt,\n    // The next read obtains the post-commit proof. A failed read cannot undo\n    // acknowledgement of this successful mutation.\n    writerProjection: null,\n  };\n}\n\nexport async function shareRemoteContainer(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shared = await shareRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    previousProjection: input.previousProjection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container group share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n  if (!shareWithGroup)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  const shared = await shareWithGroup({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    expectedGroupName: input.expectedGroupName ?? null,\n    readEncryptedName: (bundle) =>\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        author.organizationId,\n        input.stillCurrent,\n      ).readName(bundle),\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: input.previousProjection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    signingKeyPair: input.runtime.crypto.signingKeyPair,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function moveRemoteContainer(input: {\n  containerId: string;\n  onStaleAcceptance?: (() => void) | undefined;\n  parentContainerId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<RemoteContainer | null> {\n  const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const moved = await moveRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    destinationParentContainerId: input.parentContainerId,\n    execSql,\n    onStaleAcceptance: input.onStaleAcceptance,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!moved) {\n    return null;\n  }\n\n  return {\n    createdAt: moved.response.createdAt,\n    effectiveAccessLevel: \"admin\",\n    id: moved.response.containerId,\n    organizationId: moved.response.organizationId,\n    parentId: moved.response.parentId,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({\n      response: moved.response,\n    }),\n    metadataAccessEpoch: moved.response.manifestHead.epoch,\n    metadataAccessStateHash: moved.response.manifestHead.manifestHash,\n    metadataReferencedPrincipals:\n      referencedPrincipalHeadsFromContainerMutationResponse({\n        response: moved.response,\n      }),\n    updatedAt: moved.response.updatedAt,\n  };\n}\n\nexport async function deleteRemoteContainer(input: {\n  containerId: string;\n  organizationId: string;\n  requiredAncestorId?: string | undefined;\n  runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } | null> {\n  const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n    input.containerId,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n      requiredAncestorId: input.requiredAncestorId,\n    },\n  );\n  if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n    deleteResult.report();\n    return null;\n  }\n\n  if (!deleteResult.ok) {\n    // A 404 proves this immutable id is permanently absent, but it does not\n    // carry the server deletion time. A maximal fence prevents an older\n    // in-flight listing page from resurrecting it.\n    return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n  }\n\n  return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAEL,uCAAuC,EACvC,qDAAqD,EACrD,yBAAyB,EACzB,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,6BAA6B,CAAC;AAQrC;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IAGC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,OAAO;QACL,KAAK,EAAE;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,oBAAoB,EAAE,OAAO;YAC7B,EAAE,EAAE,QAAQ,CAAC,WAAW;YACxB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;YACzE,mBAAmB,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;YAChD,uBAAuB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;YAC3D,4BAA4B,EAC1B,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  type AppliedContainerMove,\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n  replayRemoteContainerMove,\n  shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/share/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n  type ContainerAlreadyCommitted,\n  createRemoteContainerWithMetadataDocument,\n} from \"./create/createWithMetadata\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n  RemoteContainer,\n  SharedRemoteContainerState,\n} from \"./types\";\n\n/**\n * Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n  runtime: ContainerWorkflowRuntime,\n  operation:\n    | \"container create\"\n    | \"container group share\"\n    | \"container move\"\n    | \"container share\",\n) {\n  const author = resolveDocumentCreateAuthor(runtime);\n  const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !secretKey) {\n    runtime.util.log(\n      `Container contents: skipped ${operation} because the writer context is unavailable.`,\n    );\n    return null;\n  }\n\n  return {\n    apiClient: runtime.apiClient,\n    author,\n    execSql: runtime.infra.execSql,\n    secretKey,\n  };\n}\n\nexport async function createRemoteContainer(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n  previousProjection: ContainerWriterProjectionResponse,\n  response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n  if (\n    response.containerId !== previousProjection.containerId ||\n    response.organizationId !== previousProjection.organizationId\n  )\n    throw new Error(\"Container mutation response projection mismatch\");\n  return {\n    accessManifestHash: response.manifestHead.manifestHash,\n    accessEpoch: response.manifestHead.epoch,\n    createdAt: response.createdAt,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n    referencedPrincipalHeads:\n      referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n    updatedAt: response.updatedAt,\n    // The next read obtains the post-commit proof. A failed read cannot undo\n    // acknowledgement of this successful mutation.\n    writerProjection: null,\n  };\n}\n\nexport async function shareRemoteContainer(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shared = await shareRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    previousProjection: input.previousProjection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container group share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n  if (!shareWithGroup)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  const shared = await shareWithGroup({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    expectedGroupName: input.expectedGroupName ?? null,\n    readEncryptedName: (bundle) =>\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        author.organizationId,\n        input.stillCurrent,\n      ).readName(bundle),\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: input.previousProjection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    signingKeyPair: input.runtime.crypto.signingKeyPair,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\n/**\n * Replays a queued move. `applied` carries the verified head when the server\n * already holds the container under the destination, so nothing is posted.\n */\nexport async function moveRemoteContainer(input: {\n  containerId: string;\n  onAccepted?: (() => void) | undefined;\n  parentContainerId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  { applied: AppliedContainerMove } | { moved: RemoteContainer } | null\n> {\n  const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const replayed = await replayRemoteContainerMove({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    destinationParentContainerId: input.parentContainerId,\n    execSql,\n    onAccepted: input.onAccepted,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!replayed || \"applied\" in replayed) {\n    return replayed;\n  }\n\n  const { response } = replayed;\n  return {\n    moved: {\n      createdAt: response.createdAt,\n      effectiveAccessLevel: \"admin\",\n      id: response.containerId,\n      organizationId: response.organizationId,\n      parentId: response.parentId,\n      metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n      metadataAccessEpoch: response.manifestHead.epoch,\n      metadataAccessStateHash: response.manifestHead.manifestHash,\n      metadataReferencedPrincipals:\n        referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n      updatedAt: response.updatedAt,\n    },\n  };\n}\n\nexport async function deleteRemoteContainer(input: {\n  containerId: string;\n  organizationId: string;\n  requiredAncestorId?: string | undefined;\n  runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } | null> {\n  const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n    input.containerId,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n      requiredAncestorId: input.requiredAncestorId,\n    },\n  );\n  if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n    deleteResult.report();\n    return null;\n  }\n\n  if (!deleteResult.ok) {\n    // A 404 proves this immutable id is permanently absent, but it does not\n    // carry the server deletion time. A maximal fence prevents an older\n    // in-flight listing page from resurrecting it.\n    return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n  }\n\n  return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}

package/workflows/container-contents/container-state/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerDeleteResponse,\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { createInitializedContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type {\n  createRemoteContainer,\n  moveRemoteContainer,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"../../containers\";\nimport type { createRemoteDocument } from \"../../documents\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n  ContainerContentsPersistence,\n  ContainerCreateIntentRecord,\n  ContainerMoveIntentRecord,\n} from \"../containerPersistence\";\nimport type {\n  ContainerState,\n  RemoteContainer as HydratedRemoteContainer,\n  RemoteContainerHydrationHost,\n} from \"../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ContainerWorkflowApi = Parameters<\n  typeof createRemoteContainer\n>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainerWithGroup>[0][\"apiClient\"] &\n  Parameters<typeof moveRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof createRemoteDocument>[0][\"apiClient\"] &\n  Partial<PrincipalPolicyHistoryReader> &\n  CurrentPrincipalPolicyReader & {\n    deleteContainerResult(\n      containerId: string,\n      options?: {\n        expectedPaymentRequiredOrganizationId?: string;\n        reportErrors?: boolean;\n        requiredAncestorId?: string | undefined;\n      },\n    ): Promise<\n      | { data: ContainerDeleteResponse; ok: true }\n      | {\n          ok: false;\n          report: () => void;\n          status: number | null;\n        }\n    >;\n    primeContainerWriterProjection(\n      containerId: string,\n      projection: ContainerWriterProjectionResponse,\n    ): void;\n  };\n\nexport interface ContainerWorkflowRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  readonly apiClient: ContainerWorkflowApi;\n}\n\nexport interface CreatedRemoteContainerState {\n  accessManifestHash: string;\n  /** The slot this client signed into the create; never the server's echo. */\n  systemSlot: ContainerSystemSlot | null;\n  containerId: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  organizationId: string;\n  /** A created container is a child; the acknowledgement echoed this parent. */\n  parentId: string;\n  persistedMetadataState: Pick<\n    DocumentRecord,\n    | \"documentId\"\n    | \"contentKeyBundle\"\n    | \"documentKekTargets\"\n    | \"documentManifestBundle\"\n  >;\n  updatedAt: string;\n}\n\nexport interface SharedRemoteContainerState {\n  accessEpoch: number;\n  accessManifestHash: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  referencedPrincipalHeads: ReferencedPrincipalStateResponse[];\n  updatedAt: string;\n  writerProjection: ContainerWriterProjectionResponse | null;\n}\n\nexport interface SharedContainerState {\n  container: ContainerState[\"container\"];\n  record: ContainerState[\"record\"];\n}\n\nexport type SharedContainerStateResult =\n  | { status: \"missing\" }\n  | { status: \"confirmed\" }\n  | (SharedContainerState & {\n      status: \"identity-superseded\" | \"persisted\";\n    });\n\nexport type RemoteContainer = HydratedRemoteContainer;\n\nexport type ContainerMetadataDocumentState = Awaited<\n  ReturnType<typeof createInitializedContainerMetadataDocument>\n>[\"doc\"];\n\nexport interface CreatedChildContainerState {\n  containerState: ContainerState;\n  initialUpdate: Uint8Array;\n  shouldRequestSync: boolean;\n}\n\nexport interface ContainerIntentSyncState {\n  containersById: ReadonlyMap<string, ContainerState>;\n  persistence: ContainerContentsPersistence;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  /**\n   * Verifies that a listed container is this device's pending create before it\n   * is adopted and returns where it sits; `assertContainerCreateAdoptable`\n   * unless a test replaces it.\n   */\n  verifyCreateAdoption?: (input: {\n    readonly containerId: string;\n    readonly expectedOrganizationId: string;\n  }) => Promise<AdoptedContainerPlacement>;\n}\n\n/** Where a verified listed create committed, and where its container is now. */\nexport interface AdoptedContainerPlacement {\n  /** The parent its signed epoch-1 `container.create` named. */\n  readonly createdParentId: string;\n  /** The verified head's parent; another writer may have moved it since. */\n  readonly currentParentId: string;\n}\n\nexport type ContainerCreateIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerCreateIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\"\n>;\n\nexport interface ContainerCreateIntentSyncInput {\n  host: ContainerCreateIntentSyncHost;\n  /** A parent whose own create has not settled takes no child create. */\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerCreateIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerCreateIntentSyncState;\n}\n\nexport type ContainerMoveIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerMoveIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\" | \"updateSnapshot\"\n>;\n\nexport interface ContainerMoveIntentSyncInput {\n  host: ContainerMoveIntentSyncHost;\n  isCurrent: () => boolean;\n  /** A folder whose create has not settled takes no structural writes. */\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerMoveIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerMoveIntentSyncState;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerDeleteResponse,\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { createInitializedContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type {\n  createRemoteContainer,\n  moveRemoteContainer,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"../../containers\";\nimport type { createRemoteDocument } from \"../../documents\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n  ContainerContentsPersistence,\n  ContainerCreateIntentRecord,\n  ContainerMoveIntentRecord,\n} from \"../containerPersistence\";\nimport type {\n  ContainerState,\n  RemoteContainer as HydratedRemoteContainer,\n  RemoteContainerHydrationHost,\n} from \"../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ContainerWorkflowApi = Parameters<\n  typeof createRemoteContainer\n>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainerWithGroup>[0][\"apiClient\"] &\n  Parameters<typeof moveRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof createRemoteDocument>[0][\"apiClient\"] &\n  Partial<PrincipalPolicyHistoryReader> &\n  CurrentPrincipalPolicyReader & {\n    deleteContainerResult(\n      containerId: string,\n      options?: {\n        expectedPaymentRequiredOrganizationId?: string;\n        reportErrors?: boolean;\n        requiredAncestorId?: string | undefined;\n      },\n    ): Promise<\n      | { data: ContainerDeleteResponse; ok: true }\n      | {\n          ok: false;\n          report: () => void;\n          status: number | null;\n        }\n    >;\n    primeContainerWriterProjection(\n      containerId: string,\n      projection: ContainerWriterProjectionResponse,\n    ): void;\n  };\n\nexport interface ContainerWorkflowRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  readonly apiClient: ContainerWorkflowApi;\n}\n\nexport interface CreatedRemoteContainerState {\n  accessManifestHash: string;\n  /** The slot this client signed into the create; never the server's echo. */\n  systemSlot: ContainerSystemSlot | null;\n  containerId: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  organizationId: string;\n  /** A created container is a child; the acknowledgement echoed this parent. */\n  parentId: string;\n  persistedMetadataState: Pick<\n    DocumentRecord,\n    | \"documentId\"\n    | \"contentKeyBundle\"\n    | \"documentKekTargets\"\n    | \"documentManifestBundle\"\n  >;\n  updatedAt: string;\n}\n\nexport interface SharedRemoteContainerState {\n  accessEpoch: number;\n  accessManifestHash: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  referencedPrincipalHeads: ReferencedPrincipalStateResponse[];\n  updatedAt: string;\n  writerProjection: ContainerWriterProjectionResponse | null;\n}\n\nexport interface SharedContainerState {\n  container: ContainerState[\"container\"];\n  record: ContainerState[\"record\"];\n}\n\nexport type SharedContainerStateResult =\n  | { status: \"missing\" }\n  | { status: \"confirmed\" }\n  | (SharedContainerState & {\n      status: \"identity-superseded\" | \"persisted\";\n    });\n\nexport type RemoteContainer = HydratedRemoteContainer;\n\nexport type ContainerMetadataDocumentState = Awaited<\n  ReturnType<typeof createInitializedContainerMetadataDocument>\n>[\"doc\"];\n\nexport interface CreatedChildContainerState {\n  containerState: ContainerState;\n  initialUpdate: Uint8Array;\n  shouldRequestSync: boolean;\n}\n\nexport interface ContainerIntentSyncState {\n  containersById: ReadonlyMap<string, ContainerState>;\n  persistence: ContainerContentsPersistence;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  /**\n   * Verifies that a listed container is this device's pending create before it\n   * is adopted and returns where it sits; `assertContainerCreateAdoptable`\n   * unless a test replaces it.\n   */\n  verifyCreateAdoption?: (input: {\n    readonly containerId: string;\n    readonly expectedOrganizationId: string;\n  }) => Promise<AdoptedContainerPlacement>;\n}\n\n/** Where a verified listed create committed, and where its container is now. */\nexport interface AdoptedContainerPlacement {\n  /** The parent its signed epoch-1 `container.create` named. */\n  readonly createdParentId: string;\n  /** The verified head's parent; another writer may have moved it since. */\n  readonly currentParentId: string;\n}\n\nexport type ContainerCreateIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerCreateIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\"\n>;\n\nexport interface ContainerCreateIntentSyncInput {\n  host: ContainerCreateIntentSyncHost;\n  /** A parent whose own create has not settled takes no child create. */\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerCreateIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerCreateIntentSyncState;\n}\n\nexport type ContainerMoveIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerMoveIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\" | \"updateSnapshot\"\n>;\n\n/** Later passes for moves the server accepted but no pass settled. */\nexport interface AcceptedMoveRetry {\n  /** The server holds the move: schedule a replay to settle it. */\n  arm: (intentId: string) => void;\n  /** A replay failed; continue an accepted move's retries, if it has some. */\n  resume: (intentId: string) => void;\n}\n\nexport interface ContainerMoveIntentSyncInput {\n  host: ContainerMoveIntentSyncHost;\n  isCurrent: () => boolean;\n  /** A folder whose create has not settled takes no structural writes. */\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerMoveIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  acceptedMoveRetry: AcceptedMoveRetry;\n  state: ContainerMoveIntentSyncState;\n}\n"]}

package/workflows/container-contents/storedContainerState.js

@@ -52,7 +52,11 @@ export async function hydrateStoredContainerState(input) {
             metadataUpdates: bytesToBase64(initialUpdate),
         });
         await persistence.saveContainer(execSql, nextContainer, nextRecord);
-        if (!container.metadataDocumentId) {
+        // A device-first child's first metadata waits for its create. A root's
+        // never does: only registration creates a root remotely, and provisioning
+        // commits the root's metadata itself, so a queued copy would only be
+        // replayed after login as duplicate ops.
+        if (!container.metadataDocumentId && container.parentId !== null) {
             await enqueuePendingContainerUpdate(execSql, persistence, {
                 containerId: container.id,
                 update: initialUpdate,

package/workflows/container-contents/storedContainerState.js.map

@@ -1 +1 @@
-{"version":3,"file":"storedContainerState.js","sourceRoot":"","sources":["storedContainerState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAGL,6BAA6B,GAE9B,MAAM,wBAAwB,CAAC;AAOhC,SAAS,4BAA4B,CAAC,KAGrC;IACC,OAAO;QACL,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;QACtB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAuC,EACvC,KAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA4C;IAE5C,MAAM,cAAc,GAClB,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1D,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC;IAExC,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;QAChC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG;YACd,GAAG,SAAS;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,yBAAyB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,CAAC,aAAa,CAC7B,OAAO,EACP,aAAa,EACb,UAAU,EACV,iBAAiB,CAAC,SAAS,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC5C,UAAU,GAAG,4BAA4B,CAAC;YACxC,SAAS;YACT,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAEpE,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;YAClC,MAAM,6BAA6B,CAAC,OAAO,EAAE,WAAW,EAAE;gBACxD,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAE7D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport {\n  createContainerMetadataDocument,\n  getDefaultContainerName,\n  readContainerMetadataValue,\n  writeContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  type ContainerContentsPersistence,\n  type ContainerMetadataRecord,\n  enqueuePendingContainerUpdate,\n  type StoredContainerState,\n} from \"./containerPersistence\";\nimport type { ContainerState } from \"./remoteHydration/types\";\n\ntype SaveContainerOptions = Parameters<\n  ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nfunction createInitialContainerRecord(input: {\n  container: StoredContainerState[\"container\"];\n  metadataUpdates: string;\n}): ContainerMetadataRecord {\n  return {\n    accessEpoch: 1,\n    accessStateHash: null,\n    contentKeyBundle: null,\n    documentId: input.container.metadataDocumentId,\n    documentKekTargets: null,\n    documentManifestBundle: null,\n    id: input.container.id,\n    lastCommitLsn: null,\n    metadataUpdates: input.metadataUpdates,\n    snapshotEndVersion: \"\",\n  };\n}\n\nfunction metadataProjectionChanged(\n  left: StoredContainerState[\"container\"],\n  right: StoredContainerState[\"container\"],\n): boolean {\n  return left.icon !== right.icon || left.name !== right.name;\n}\n\nfunction replaySaveOptions(\n  container: StoredContainerState[\"container\"],\n): SaveContainerOptions {\n  const localUpdatedAt =\n    container.localUpdatedAt ?? container.updatedAt ?? null;\n  return localUpdatedAt ? { localUpdatedAt } : undefined;\n}\n\nexport async function hydrateStoredContainerState(input: {\n  execSql: ExecSql;\n  persistence: ContainerContentsPersistence;\n  storedContainer: StoredContainerState;\n}): Promise<ContainerState> {\n  const { execSql, persistence, storedContainer } = input;\n  const { container } = storedContainer;\n  const doc = await createContainerMetadataDocument(container.id);\n  let nextContainer = container;\n  let nextRecord = storedContainer.record;\n\n  if (nextRecord?.metadataUpdates) {\n    importUpdates(doc, [base64ToBytes(nextRecord.metadataUpdates)]);\n    const metadata = readContainerMetadataValue(\n      doc,\n      getDefaultContainerName(container.parentId),\n    );\n    nextContainer = {\n      ...container,\n      icon: metadata.icon,\n      name: metadata.name,\n    };\n    if (metadataProjectionChanged(container, nextContainer)) {\n      await persistence.saveContainer(\n        execSql,\n        nextContainer,\n        nextRecord,\n        replaySaveOptions(container),\n      );\n    }\n  } else {\n    writeContainerMetadataValue(doc, {\n      icon: container.icon,\n      name: container.name,\n    });\n    const initialUpdate = exportAllUpdates(doc);\n    nextRecord = createInitialContainerRecord({\n      container,\n      metadataUpdates: bytesToBase64(initialUpdate),\n    });\n    await persistence.saveContainer(execSql, nextContainer, nextRecord);\n\n    if (!container.metadataDocumentId) {\n      await enqueuePendingContainerUpdate(execSql, persistence, {\n        containerId: container.id,\n        update: initialUpdate,\n      });\n    }\n  }\n\n  return { container: nextContainer, doc, record: nextRecord };\n}\n\n/** Materialize a CAS winner without writing repair rows from a stale caller. */\nexport async function materializeStoredContainerStateReadOnly(input: {\n  storedContainer: StoredContainerState;\n}): Promise<ContainerState | null> {\n  const { container, record } = input.storedContainer;\n  if (!record) return null;\n  const doc = await createContainerMetadataDocument(container.id);\n  let nextContainer = container;\n  if (record.metadataUpdates) {\n    importUpdates(doc, [base64ToBytes(record.metadataUpdates)]);\n    const metadata = readContainerMetadataValue(\n      doc,\n      getDefaultContainerName(container.parentId),\n    );\n    nextContainer = { ...container, icon: metadata.icon, name: metadata.name };\n  } else {\n    writeContainerMetadataValue(doc, {\n      icon: container.icon,\n      name: container.name,\n    });\n  }\n  return { container: nextContainer, doc, record };\n}\n"]}
+{"version":3,"file":"storedContainerState.js","sourceRoot":"","sources":["storedContainerState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAGL,6BAA6B,GAE9B,MAAM,wBAAwB,CAAC;AAOhC,SAAS,4BAA4B,CAAC,KAGrC;IACC,OAAO;QACL,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;QACtB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAuC,EACvC,KAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA4C;IAE5C,MAAM,cAAc,GAClB,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1D,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC;IAExC,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;QAChC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG;YACd,GAAG,SAAS;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,yBAAyB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,CAAC,aAAa,CAC7B,OAAO,EACP,aAAa,EACb,UAAU,EACV,iBAAiB,CAAC,SAAS,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC5C,UAAU,GAAG,4BAA4B,CAAC;YACxC,SAAS;YACT,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAEpE,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,6BAA6B,CAAC,OAAO,EAAE,WAAW,EAAE;gBACxD,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAE7D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport {\n  createContainerMetadataDocument,\n  getDefaultContainerName,\n  readContainerMetadataValue,\n  writeContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  type ContainerContentsPersistence,\n  type ContainerMetadataRecord,\n  enqueuePendingContainerUpdate,\n  type StoredContainerState,\n} from \"./containerPersistence\";\nimport type { ContainerState } from \"./remoteHydration/types\";\n\ntype SaveContainerOptions = Parameters<\n  ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nfunction createInitialContainerRecord(input: {\n  container: StoredContainerState[\"container\"];\n  metadataUpdates: string;\n}): ContainerMetadataRecord {\n  return {\n    accessEpoch: 1,\n    accessStateHash: null,\n    contentKeyBundle: null,\n    documentId: input.container.metadataDocumentId,\n    documentKekTargets: null,\n    documentManifestBundle: null,\n    id: input.container.id,\n    lastCommitLsn: null,\n    metadataUpdates: input.metadataUpdates,\n    snapshotEndVersion: \"\",\n  };\n}\n\nfunction metadataProjectionChanged(\n  left: StoredContainerState[\"container\"],\n  right: StoredContainerState[\"container\"],\n): boolean {\n  return left.icon !== right.icon || left.name !== right.name;\n}\n\nfunction replaySaveOptions(\n  container: StoredContainerState[\"container\"],\n): SaveContainerOptions {\n  const localUpdatedAt =\n    container.localUpdatedAt ?? container.updatedAt ?? null;\n  return localUpdatedAt ? { localUpdatedAt } : undefined;\n}\n\nexport async function hydrateStoredContainerState(input: {\n  execSql: ExecSql;\n  persistence: ContainerContentsPersistence;\n  storedContainer: StoredContainerState;\n}): Promise<ContainerState> {\n  const { execSql, persistence, storedContainer } = input;\n  const { container } = storedContainer;\n  const doc = await createContainerMetadataDocument(container.id);\n  let nextContainer = container;\n  let nextRecord = storedContainer.record;\n\n  if (nextRecord?.metadataUpdates) {\n    importUpdates(doc, [base64ToBytes(nextRecord.metadataUpdates)]);\n    const metadata = readContainerMetadataValue(\n      doc,\n      getDefaultContainerName(container.parentId),\n    );\n    nextContainer = {\n      ...container,\n      icon: metadata.icon,\n      name: metadata.name,\n    };\n    if (metadataProjectionChanged(container, nextContainer)) {\n      await persistence.saveContainer(\n        execSql,\n        nextContainer,\n        nextRecord,\n        replaySaveOptions(container),\n      );\n    }\n  } else {\n    writeContainerMetadataValue(doc, {\n      icon: container.icon,\n      name: container.name,\n    });\n    const initialUpdate = exportAllUpdates(doc);\n    nextRecord = createInitialContainerRecord({\n      container,\n      metadataUpdates: bytesToBase64(initialUpdate),\n    });\n    await persistence.saveContainer(execSql, nextContainer, nextRecord);\n\n    // A device-first child's first metadata waits for its create. A root's\n    // never does: only registration creates a root remotely, and provisioning\n    // commits the root's metadata itself, so a queued copy would only be\n    // replayed after login as duplicate ops.\n    if (!container.metadataDocumentId && container.parentId !== null) {\n      await enqueuePendingContainerUpdate(execSql, persistence, {\n        containerId: container.id,\n        update: initialUpdate,\n      });\n    }\n  }\n\n  return { container: nextContainer, doc, record: nextRecord };\n}\n\n/** Materialize a CAS winner without writing repair rows from a stale caller. */\nexport async function materializeStoredContainerStateReadOnly(input: {\n  storedContainer: StoredContainerState;\n}): Promise<ContainerState | null> {\n  const { container, record } = input.storedContainer;\n  if (!record) return null;\n  const doc = await createContainerMetadataDocument(container.id);\n  let nextContainer = container;\n  if (record.metadataUpdates) {\n    importUpdates(doc, [base64ToBytes(record.metadataUpdates)]);\n    const metadata = readContainerMetadataValue(\n      doc,\n      getDefaultContainerName(container.parentId),\n    );\n    nextContainer = { ...container, icon: metadata.icon, name: metadata.name };\n  } else {\n    writeContainerMetadataValue(doc, {\n      icon: container.icon,\n      name: container.name,\n    });\n  }\n  return { container: nextContainer, doc, record };\n}\n"]}

package/workflows/containers/child/move/index.d.ts

@@ -1,9 +1,18 @@
+import type { ContainerAccessManifestState } from "../../../../internal/crypto/index.js";
 import type { ContainerRotationResponse } from "../../../../internal/validators/response/index.js";
 import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../../data/containers/shared/types.js";
 import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
 import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
-export declare function moveRemoteContainer(input: {
+/**
+ * The source's verified head already sits under the destination: a move the
+ * server accepted but this device never settled, or one another writer made.
+ */
+export interface AppliedContainerMove {
+    readonly manifestHash: string;
+    readonly state: ContainerAccessManifestState;
+}
+interface MoveRemoteContainerInput {
     reportSecurityIncident: SecurityIncidentReporter;
     apiClient: ContainerMoveApi;
     author: ContainerMutationAuthor;
@@ -11,14 +20,26 @@ export declare function moveRemoteContainer(input: {
     destinationParentContainerId: string;
     eventId?: string | undefined;
     execSql: ExecSql;
-    onStaleAcceptance?: (() => void) | undefined;
+    onAccepted?: (() => void) | undefined;
     resolveProjectionUserKey: ProjectionUserKeyResolver;
     signedAt?: string | undefined;
     stillCurrent?: (() => boolean) | undefined;
     targetSecretKey: Uint8Array;
     warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<{
+}
+interface SubmittedContainerMove {
     containerKey: Uint8Array;
     plan: ContainerMovePlan;
     response: ContainerRotationResponse;
+}
+/** Signs and submits a move; `null` when it was refused or abandoned. */
+export declare function moveRemoteContainer(input: MoveRemoteContainerInput): Promise<SubmittedContainerMove | null>;
+/**
+ * Replays a queued move. When the verified source head already sits under
+ * the destination it signs nothing and returns that head, so a lost response
+ * settles without a second rotation.
+ */
+export declare function replayRemoteContainerMove(input: MoveRemoteContainerInput): Promise<SubmittedContainerMove | {
+    applied: AppliedContainerMove;
 } | null>;
+export {};

package/workflows/containers/child/move/index.js

@@ -1,26 +1,15 @@
 import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
 import { assertContainerChildPathFits } from "../../../../data/containers/shared/containerPathLimits.js";
-import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
+import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
 import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection/index.js";
 import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
 import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
-import { containerMutationRequestCore, previousPathRequestFields, } from "../mutationRequestCore.js";
 import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "../mutationSubmit.js";
 import { containerWriterProjectionFromRotationPlan } from "../rekey/rekeyProjection.js";
 import { requireUnwrappedKek, signedRotationTarget, } from "../rotation/rotationContext.js";
 import { buildMoveRotationWithBody, deriveMoveManifestArtifacts, } from "./moveArtifacts.js";
+import { buildContainerMovePlanResult } from "./moveRequest.js";
 import { buildContainerMoveWraps, collectContainerMovePrincipalPolicies, } from "./moveWraps.js";
-function buildContainerMoveRequest(input) {
-    return {
-        ...containerMutationRequestCore("move", input),
-        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
-        destinationParentContainerPathRefs: input.destinationParentProjection.path.map(containerManifestRef),
-        predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container move predecessor bridge"),
-        keyring: readCanonicalRecord(input.keyring, "Container move keyring"),
-        parentKekState: readCanonicalRecord(input.destinationParentKek, "Container move destination parent KEK state"),
-    };
-}
 async function unwrapMoveContainerKeys(input) {
     const verifiedByHash = new Map();
     const keksByEpochId = await unwrapContainerKekPath({
@@ -66,39 +55,6 @@ function containerMoveDependencyManifestHashes(input) {
         ...uniqueSortedManifestHashes(input.destinationParentProjection.path),
     ];
 }
-function buildContainerMovePlanResult(input) {
-    const plan = {
-        body: input.body,
-        containerId: input.containerId,
-        containerKeyEpochId: input.containerKeyEpochId,
-        event: input.event,
-        eventHash: input.eventHash,
-        keyEpoch: input.keyEpoch,
-        keyring: input.keyring,
-        manifest: input.manifest,
-        manifestHash: input.manifestHash,
-        previousManifest: input.previousManifest,
-        request: buildContainerMoveRequest({
-            body: input.body,
-            destinationParentKek: input.destinationParentKek,
-            destinationParentProjection: input.destinationParentProjection,
-            event: input.event,
-            keyEpoch: input.keyEpoch,
-            keyring: input.keyring,
-            manifest: input.manifest,
-            manifestHash: input.manifestHash,
-            previousManifest: input.previousManifest,
-            previousProjection: input.previousProjection,
-            predecessorBridge: input.predecessorBridge,
-            principalPolicies: input.principalPolicies,
-            userRecipientKeys: input.userRecipientKeys,
-            wraps: input.wraps,
-        }),
-        state: input.state,
-        wraps: input.wraps,
-    };
-    return { containerKey: input.containerKey, plan };
-}
 async function collectAuthorizedMovePolicies(input) {
     const principalPolicies = await collectContainerMovePrincipalPolicies({
         ...input,
@@ -118,8 +74,9 @@ async function collectAuthorizedMovePolicies(input) {
     });
     return principalPolicies;
 }
-async function buildMaterializedContainerMovePlan(input) {
-    const { containerKey: predecessorContainerKey, destinationParent, source, } = await unwrapMoveContainerKeys({
+/** Verifies both projections and reads the states a move rotates between. */
+async function verifyContainerMoveSources(input) {
+    const unwrapped = await unwrapMoveContainerKeys({
         destinationParentProjection: input.destinationParentProjection,
         execSql: input.execSql,
         previousProjection: input.previousProjection,
@@ -131,11 +88,25 @@ async function buildMaterializedContainerMovePlan(input) {
     // Only a verified path is a final depth refusal; a padded unverified path
     // must fail verification (an incident), never look like an honest refusal.
     assertContainerChildPathFits(input.destinationParentProjection.path);
-    const { destinationState, previousState } = readContainerMoveStates({
-        authorOrganizationId: input.author.organizationId,
-        destinationParent,
-        source,
-    });
+    return {
+        ...unwrapped,
+        ...readContainerMoveStates({
+            authorOrganizationId: input.author.organizationId,
+            destinationParent: unwrapped.destinationParent,
+            source: unwrapped.source,
+        }),
+    };
+}
+async function buildMaterializedContainerMovePlan(input) {
+    const { containerKey: predecessorContainerKey, destinationParent, destinationState, previousState, source, } = await verifyContainerMoveSources(input);
+    if (input.adoptAppliedMove &&
+        previousState.parentContainerId === destinationState.containerId)
+        return {
+            applied: {
+                manifestHash: source.manifest.manifestHash,
+                state: previousState,
+            },
+        };
     const principalPolicies = await collectAuthorizedMovePolicies(input);
     const { body, containerKey, containerKeyEpochId, keyring, predecessorBridge, } = await buildMoveRotationWithBody({
         destinationParent,
@@ -194,7 +165,22 @@ async function buildMaterializedContainerMovePlan(input) {
         wraps,
     });
 }
+/** Signs and submits a move; `null` when it was refused or abandoned. */
 export async function moveRemoteContainer(input) {
+    const moved = await submitRemoteContainerMove(input, false);
+    if (moved && "applied" in moved)
+        throw new Error("A move that adopts nothing cannot report one applied");
+    return moved;
+}
+/**
+ * Replays a queued move. When the verified source head already sits under
+ * the destination it signs nothing and returns that head, so a lost response
+ * settles without a second rotation.
+ */
+export function replayRemoteContainerMove(input) {
+    return submitRemoteContainerMove(input, true);
+}
+async function submitRemoteContainerMove(input, adoptAppliedMove) {
     const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container move");
     const [previousProjection, destinationParentProjection] = await Promise.all([
         input.apiClient.getContainerWriterProjection(input.containerId),
@@ -204,6 +190,7 @@ export async function moveRemoteContainer(input) {
         return null;
     }
     const materializedPlan = await nullOnProjectionVerificationCancellation(() => buildMaterializedContainerMovePlan({
+        adoptAppliedMove,
         author: input.author,
         eventId: input.eventId,
         execSql: input.execSql,
@@ -215,8 +202,8 @@ export async function moveRemoteContainer(input) {
         targetSecretKey: input.targetSecretKey,
         warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
     }));
-    if (!materializedPlan)
-        return null;
+    if (!materializedPlan || "applied" in materializedPlan)
+        return materializedPlan;
     return submitAcknowledgedContainerMutation({
         reportSecurityIncident: input.reportSecurityIncident,
         recitationPolicies: [],
@@ -246,24 +233,28 @@ export async function moveRemoteContainer(input) {
         },
         containerKey: materializedPlan.containerKey,
         execSql: input.execSql,
-        onStaleAcceptance: input.onStaleAcceptance,
+        onAccepted: input.onAccepted,
         plan: materializedPlan.plan,
         stillCurrent: input.stillCurrent,
-        submit: (carried) => {
-            const request = carried.length
-                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
-                : materializedPlan.plan.request;
-            const options = {
-                expectedPaymentRequiredOrganizationId: input.author.organizationId,
-            };
-            const { moveContainerResult } = input.apiClient;
-            return submitContainerRotation({
-                plain: () => input.apiClient.moveContainer(input.containerId, request, options),
-                result: moveContainerResult
-                    ? () => moveContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
-                    : undefined,
-            });
-        },
+        submit: (carried) => submitContainerMoveRequest(input, {
+            ...materializedPlan.plan.request,
+            ...(carried.length ? { containerRekeys: [...carried] } : {}),
+        }),
+    });
+}
+function submitContainerMoveRequest(input, request) {
+    const options = {
+        expectedPaymentRequiredOrganizationId: input.author.organizationId,
+    };
+    const { moveContainerResult } = input.apiClient;
+    return submitContainerRotation({
+        plain: () => input.apiClient.moveContainer(input.containerId, request, options),
+        result: moveContainerResult
+            ? () => moveContainerResult.call(input.apiClient, input.containerId, request, {
+                ...options,
+                reportErrors: false,
+            })
+            : undefined,
     });
 }
 //# sourceMappingURL=index.js.map