@tearleads/client-sdk 0.1.68 → 0.1.71

package/workflows/container-contents/metadata/metadataEvents.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadataEvents.js","sourceRoot":"","sources":["metadataEvents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAGpF,MAAM,UAAU,uCAAuC,CACrD,MAA8B,EAC9B,cAAwE,EACxE,wBAAsC;IAEtC,0EAA0E;IAC1E,mCAAmC;IACnC,OAAO,CACL,sCAAsC,CACpC,MAAM,EACN,cAAc,EACd,wBAAwB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CACzE,CAAC,MAAM,GAAG,CAAC,CACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,4BAA4B,CACnC,KAAoD,EACpD,wBAAiD;IAEjD,IACE,CAAC,wBAAwB;QACzB,CAAC,KAAK,CAAC,SAAS;QAChB,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAA8B,EAC9B,cAAwE,EACxE,wBAAsC;IAEtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxD,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,CAAC,4BAA4B,CAAC,KAAK,CAAC;YACpC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAC1C,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { isDocumentUpdateCreatedEvent } from \"../../../data/documents/documentSync\";\nimport type { DocumentRecord } from \"../../../data/sqlite/documentPersistence\";\n\nexport function hasContainerMetadataDocumentUpdateEvent(\n  events: ReadonlyArray<unknown>,\n  metadataStates: Iterable<{ record: Pick<DocumentRecord, \"documentId\"> }>,\n  locallyAcceptedUpdateIds?: Set<string>,\n): boolean {\n  // A boolean predicate must not consume self-echo ids before the real list\n  // pass classifies the same events.\n  return (\n    listContainerMetadataDocumentUpdateIds(\n      events,\n      metadataStates,\n      locallyAcceptedUpdateIds ? new Set(locallyAcceptedUpdateIds) : undefined,\n    ).length > 0\n  );\n}\n\n/** Consume local ids and report whether an event still contains a peer id. */\nfunction metadataEventHasRemoteUpdate(\n  event: { updateIds?: readonly string[] | undefined },\n  locallyAcceptedUpdateIds: Set<string> | undefined,\n): boolean {\n  if (\n    !locallyAcceptedUpdateIds ||\n    !event.updateIds ||\n    event.updateIds.length === 0\n  ) {\n    return true;\n  }\n\n  let remoteUpdateFound = false;\n  for (const updateId of event.updateIds) {\n    if (locallyAcceptedUpdateIds.has(updateId)) {\n      locallyAcceptedUpdateIds.delete(updateId);\n    } else {\n      remoteUpdateFound = true;\n    }\n  }\n  return remoteUpdateFound;\n}\n\nexport function listContainerMetadataDocumentUpdateIds(\n  events: ReadonlyArray<unknown>,\n  metadataStates: Iterable<{ record: Pick<DocumentRecord, \"documentId\"> }>,\n  locallyAcceptedUpdateIds?: Set<string>,\n): string[] {\n  const metadataDocumentIds = new Set<string>();\n  for (const metadataState of metadataStates) {\n    if (typeof metadataState.record.documentId === \"string\") {\n      metadataDocumentIds.add(metadataState.record.documentId);\n    }\n  }\n  if (metadataDocumentIds.size === 0) return [];\n\n  const eventDocumentIds = new Set<string>();\n  for (const event of events) {\n    if (\n      !isDocumentUpdateCreatedEvent(event) ||\n      !metadataDocumentIds.has(event.documentId)\n    ) {\n      continue;\n    }\n    if (!metadataEventHasRemoteUpdate(event, locallyAcceptedUpdateIds)) {\n      continue;\n    }\n    eventDocumentIds.add(event.documentId);\n  }\n\n  return Array.from(eventDocumentIds);\n}\n"]}
+{"version":3,"file":"metadataEvents.js","sourceRoot":"","sources":["metadataEvents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAGpF,MAAM,UAAU,uCAAuC,CACrD,MAA8B,EAC9B,cAAwE,EACxE,wBAAsC;IAEtC,0EAA0E;IAC1E,mCAAmC;IACnC,OAAO,CACL,sCAAsC,CACpC,MAAM,EACN,cAAc,EACd,wBAAwB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CACzE,CAAC,MAAM,GAAG,CAAC,CACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,4BAA4B,CACnC,KAAoD,EACpD,wBAAiD;IAEjD,IACE,CAAC,wBAAwB;QACzB,CAAC,KAAK,CAAC,SAAS;QAChB,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CACpD,MAA8B,EAC9B,cAAwE,EACxE,wBAAsC,EACtC,kBAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAChE,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxD,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,CAAC,4BAA4B,CAAC,KAAK,CAAC;YACpC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAC1C,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { isDocumentUpdateCreatedEvent } from \"../../../data/documents/documentSync\";\nimport type { DocumentRecord } from \"../../../data/sqlite/documentPersistence\";\n\nexport function hasContainerMetadataDocumentUpdateEvent(\n  events: ReadonlyArray<unknown>,\n  metadataStates: Iterable<{ record: Pick<DocumentRecord, \"documentId\"> }>,\n  locallyAcceptedUpdateIds?: Set<string>,\n): boolean {\n  // A boolean predicate must not consume self-echo ids before the real list\n  // pass classifies the same events.\n  return (\n    listContainerMetadataDocumentUpdateIds(\n      events,\n      metadataStates,\n      locallyAcceptedUpdateIds ? new Set(locallyAcceptedUpdateIds) : undefined,\n    ).length > 0\n  );\n}\n\n/** Consume local ids and report whether an event still contains a peer id. */\nfunction metadataEventHasRemoteUpdate(\n  event: { updateIds?: readonly string[] | undefined },\n  locallyAcceptedUpdateIds: Set<string> | undefined,\n): boolean {\n  if (\n    !locallyAcceptedUpdateIds ||\n    !event.updateIds ||\n    event.updateIds.length === 0\n  ) {\n    return true;\n  }\n\n  let remoteUpdateFound = false;\n  for (const updateId of event.updateIds) {\n    if (locallyAcceptedUpdateIds.has(updateId)) {\n      locallyAcceptedUpdateIds.delete(updateId);\n    } else {\n      remoteUpdateFound = true;\n    }\n  }\n  return remoteUpdateFound;\n}\n\n/**\n * `plannedDocumentIds` names the metadata documents of folders whose create is\n * in flight. A peer can edit one after the create commits but before the\n * response installs its id, and a committed seed stands in for the folder's\n * first metadata sync, so that hint must still queue a read.\n */\nexport function listContainerMetadataDocumentUpdateIds(\n  events: ReadonlyArray<unknown>,\n  metadataStates: Iterable<{ record: Pick<DocumentRecord, \"documentId\"> }>,\n  locallyAcceptedUpdateIds?: Set<string>,\n  plannedDocumentIds?: Iterable<string>,\n): string[] {\n  const metadataDocumentIds = new Set<string>(plannedDocumentIds);\n  for (const metadataState of metadataStates) {\n    if (typeof metadataState.record.documentId === \"string\") {\n      metadataDocumentIds.add(metadataState.record.documentId);\n    }\n  }\n  if (metadataDocumentIds.size === 0) return [];\n\n  const eventDocumentIds = new Set<string>();\n  for (const event of events) {\n    if (\n      !isDocumentUpdateCreatedEvent(event) ||\n      !metadataDocumentIds.has(event.documentId)\n    ) {\n      continue;\n    }\n    if (!metadataEventHasRemoteUpdate(event, locallyAcceptedUpdateIds)) {\n      continue;\n    }\n    eventDocumentIds.add(event.documentId);\n  }\n\n  return Array.from(eventDocumentIds);\n}\n"]}

package/workflows/container-contents/remoteHydration/types.d.ts

@@ -64,6 +64,9 @@ export type PersistContainerStateResult = {
 };
 export interface RemoteContainerHydrationHost {
     persistContainerState: (containerState: ContainerState, patch?: Partial<ContainerMetadataPatch>, updateView?: boolean, saveOptions?: SaveContainerOptions, mutationOptions?: {
+        /** Queued metadata rows the server committed, settled in this write. */
+        acceptedPendingUpdateIds?: readonly string[] | undefined;
+        clearSyncFailure?: boolean | undefined;
         expectedStateWhenMissing?: ContainerState | undefined;
         isCurrent?: (() => boolean) | undefined;
         createIntentSettlement?: Parameters<ContainerContentsPersistence["commitMetadataMutation"]>[1]["createIntentSettlement"];

package/workflows/container-contents/remoteHydration/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { ContainerReplacementAuthorizationsResponse } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n  ListContainerParentLanesResponse,\n  ListContainersResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { createContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n  ContainerContentsPersistence,\n  ContainerDocumentRecord,\n  ContainerHydrationTombstone,\n  ContainerRecord,\n  createContainerParentSyncLane,\n} from \"../containerPersistence\";\nimport type { ContainerMetadataPatch } from \"../metadata\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ListedRemoteContainerPageItem =\n  ListContainersResponse[\"items\"][number];\nexport type ContainerChildIndex = Map<string, Set<string>>;\nexport type QueueContainerParentLane = (parentId: string | null) => void;\nexport type RemoteContainerIngestQueue = Map<string, RemoteContainer>;\nexport type SaveContainerOptions = Parameters<\n  ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nexport type ContainerMetadataDocumentState = Awaited<\n  ReturnType<typeof createContainerMetadataDocument>\n>;\nexport type RemoteContainer = Pick<\n  ContainerSummary,\n  | \"createdAt\"\n  | \"effectiveAccessLevel\"\n  | \"systemSlot\"\n  | \"id\"\n  | \"metadataAccessEpoch\"\n  | \"metadataAccessStateHash\"\n  | \"metadataDocumentId\"\n  | \"metadataReferencedPrincipals\"\n  | \"organizationId\"\n  | \"parentId\"\n  | \"updatedAt\"\n>;\n\nexport interface ContainerState {\n  containerWriterProjection?:\n    | ContainerWriterProjectionResponse\n    | null\n    | undefined;\n  /**\n   * Bumped whenever a realtime hint drops this container's cached writer\n   * projections (container and metadata document alike); an operation that\n   * fetched or carried a projection installs it only if this is unchanged\n   * since it started, so a pre-hint answer never lands after the hint.\n   */\n  writerProjectionGeneration?: number | undefined;\n  metadataReferencedPrincipals?:\n    | readonly ReferencedPrincipalStateResponse[]\n    | undefined;\n  container: ContainerRecord;\n  doc: ContainerMetadataDocumentState;\n  metadataWriterProjection?:\n    | DocumentWriterProjectionResponse\n    | null\n    | undefined;\n  /** Durable pull progress mirrored from the metadata document record. */\n  pullContinuation?: ContainerDocumentRecord[\"pullContinuation\"] | undefined;\n  record: ContainerDocumentRecord;\n}\n\ninterface RemoteContainerHydrationApi\n  extends Partial<PrincipalPolicyHistoryReader>,\n    CurrentPrincipalPolicyReader {\n  getContainerReplacementAuthorizationsResult(\n    containerId: string,\n    replacesOrganizationId: string,\n  ): Promise<RequestResult<ContainerReplacementAuthorizationsResponse>>;\n  evictContainerWriterProjection(containerId: string): void;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  listContainerParentLanes(\n    input: ListContainerParentLanesRequest,\n  ): Promise<ListContainerParentLanesResponse | null>;\n}\n\ninterface RemoteContainerHydrationRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"adoptRootContainer\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  apiClient: RemoteContainerHydrationApi;\n}\n\nexport interface RemoteContainerHydrationState {\n  containersById: Map<string, ContainerState>;\n  lifecycleGeneration?: number | undefined;\n  persistence: ContainerContentsPersistence;\n  rootLaneHydrated?: boolean | undefined;\n  runtime: RemoteContainerHydrationRuntime;\n  structuralGeneration?: number | undefined;\n}\n\nexport type PersistContainerStateResult =\n  | { status: \"identity-superseded\"; record: ContainerDocumentRecord }\n  | { status: \"missing\" }\n  | {\n      status: \"persisted\";\n      record: ContainerDocumentRecord;\n      createIntentSettled?: true | undefined;\n      moveIntentSettled?: true | undefined;\n    }\n  | { status: \"stale-generation\" };\n\nexport interface RemoteContainerHydrationHost {\n  persistContainerState: (\n    containerState: ContainerState,\n    patch?: Partial<ContainerMetadataPatch>,\n    updateView?: boolean,\n    saveOptions?: SaveContainerOptions,\n    mutationOptions?: {\n      expectedStateWhenMissing?: ContainerState | undefined;\n      isCurrent?: (() => boolean) | undefined;\n      createIntentSettlement?: Parameters<\n        ContainerContentsPersistence[\"commitMetadataMutation\"]\n      >[1][\"createIntentSettlement\"];\n      moveIntentSettlement?: Parameters<\n        ContainerContentsPersistence[\"commitMetadataMutation\"]\n      >[1][\"moveIntentSettlement\"];\n      preserveDurableStructureWhenPending?: boolean | undefined;\n    },\n  ) => Promise<PersistContainerStateResult>;\n  requestDocumentPriming?: (() => void) | undefined;\n  updateSnapshot: () => void;\n}\n\nexport interface ContainerParentHydrationLane {\n  parentId: string | null;\n  watermark?: ListContainersResponse[\"nextWatermark\"];\n}\n\nexport interface ExpectedContainerState {\n  container: ContainerRecord;\n  fingerprint: string;\n}\n\nexport interface FetchedContainerParentLanePage {\n  expectedContainerStates: ReadonlyMap<string, ExpectedContainerState>;\n  expectedHydrationTombstones: ReadonlyMap<string, ContainerHydrationTombstone>;\n  lane: ContainerParentHydrationLane;\n  response: ListContainersResponse;\n  syncLane: ReturnType<typeof createContainerParentSyncLane>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { ContainerReplacementAuthorizationsResponse } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n  ListContainerParentLanesResponse,\n  ListContainersResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { createContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n  ContainerContentsPersistence,\n  ContainerDocumentRecord,\n  ContainerHydrationTombstone,\n  ContainerRecord,\n  createContainerParentSyncLane,\n} from \"../containerPersistence\";\nimport type { ContainerMetadataPatch } from \"../metadata\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ListedRemoteContainerPageItem =\n  ListContainersResponse[\"items\"][number];\nexport type ContainerChildIndex = Map<string, Set<string>>;\nexport type QueueContainerParentLane = (parentId: string | null) => void;\nexport type RemoteContainerIngestQueue = Map<string, RemoteContainer>;\nexport type SaveContainerOptions = Parameters<\n  ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nexport type ContainerMetadataDocumentState = Awaited<\n  ReturnType<typeof createContainerMetadataDocument>\n>;\nexport type RemoteContainer = Pick<\n  ContainerSummary,\n  | \"createdAt\"\n  | \"effectiveAccessLevel\"\n  | \"systemSlot\"\n  | \"id\"\n  | \"metadataAccessEpoch\"\n  | \"metadataAccessStateHash\"\n  | \"metadataDocumentId\"\n  | \"metadataReferencedPrincipals\"\n  | \"organizationId\"\n  | \"parentId\"\n  | \"updatedAt\"\n>;\n\nexport interface ContainerState {\n  containerWriterProjection?:\n    | ContainerWriterProjectionResponse\n    | null\n    | undefined;\n  /**\n   * Bumped whenever a realtime hint drops this container's cached writer\n   * projections (container and metadata document alike); an operation that\n   * fetched or carried a projection installs it only if this is unchanged\n   * since it started, so a pre-hint answer never lands after the hint.\n   */\n  writerProjectionGeneration?: number | undefined;\n  metadataReferencedPrincipals?:\n    | readonly ReferencedPrincipalStateResponse[]\n    | undefined;\n  container: ContainerRecord;\n  doc: ContainerMetadataDocumentState;\n  metadataWriterProjection?:\n    | DocumentWriterProjectionResponse\n    | null\n    | undefined;\n  /** Durable pull progress mirrored from the metadata document record. */\n  pullContinuation?: ContainerDocumentRecord[\"pullContinuation\"] | undefined;\n  record: ContainerDocumentRecord;\n}\n\ninterface RemoteContainerHydrationApi\n  extends Partial<PrincipalPolicyHistoryReader>,\n    CurrentPrincipalPolicyReader {\n  getContainerReplacementAuthorizationsResult(\n    containerId: string,\n    replacesOrganizationId: string,\n  ): Promise<RequestResult<ContainerReplacementAuthorizationsResponse>>;\n  evictContainerWriterProjection(containerId: string): void;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  listContainerParentLanes(\n    input: ListContainerParentLanesRequest,\n  ): Promise<ListContainerParentLanesResponse | null>;\n}\n\ninterface RemoteContainerHydrationRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"adoptRootContainer\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  apiClient: RemoteContainerHydrationApi;\n}\n\nexport interface RemoteContainerHydrationState {\n  containersById: Map<string, ContainerState>;\n  lifecycleGeneration?: number | undefined;\n  persistence: ContainerContentsPersistence;\n  rootLaneHydrated?: boolean | undefined;\n  runtime: RemoteContainerHydrationRuntime;\n  structuralGeneration?: number | undefined;\n}\n\nexport type PersistContainerStateResult =\n  | { status: \"identity-superseded\"; record: ContainerDocumentRecord }\n  | { status: \"missing\" }\n  | {\n      status: \"persisted\";\n      record: ContainerDocumentRecord;\n      createIntentSettled?: true | undefined;\n      moveIntentSettled?: true | undefined;\n    }\n  | { status: \"stale-generation\" };\n\nexport interface RemoteContainerHydrationHost {\n  persistContainerState: (\n    containerState: ContainerState,\n    patch?: Partial<ContainerMetadataPatch>,\n    updateView?: boolean,\n    saveOptions?: SaveContainerOptions,\n    mutationOptions?: {\n      /** Queued metadata rows the server committed, settled in this write. */\n      acceptedPendingUpdateIds?: readonly string[] | undefined;\n      clearSyncFailure?: boolean | undefined;\n      expectedStateWhenMissing?: ContainerState | undefined;\n      isCurrent?: (() => boolean) | undefined;\n      createIntentSettlement?: Parameters<\n        ContainerContentsPersistence[\"commitMetadataMutation\"]\n      >[1][\"createIntentSettlement\"];\n      moveIntentSettlement?: Parameters<\n        ContainerContentsPersistence[\"commitMetadataMutation\"]\n      >[1][\"moveIntentSettlement\"];\n      preserveDurableStructureWhenPending?: boolean | undefined;\n    },\n  ) => Promise<PersistContainerStateResult>;\n  requestDocumentPriming?: (() => void) | undefined;\n  updateSnapshot: () => void;\n}\n\nexport interface ContainerParentHydrationLane {\n  parentId: string | null;\n  watermark?: ListContainersResponse[\"nextWatermark\"];\n}\n\nexport interface ExpectedContainerState {\n  container: ContainerRecord;\n  fingerprint: string;\n}\n\nexport interface FetchedContainerParentLanePage {\n  expectedContainerStates: ReadonlyMap<string, ExpectedContainerState>;\n  expectedHydrationTombstones: ReadonlyMap<string, ContainerHydrationTombstone>;\n  lane: ContainerParentHydrationLane;\n  response: ListContainersResponse;\n  syncLane: ReturnType<typeof createContainerParentSyncLane>;\n}\n"]}

package/workflows/containers/child/mutationRequestCore.js

@@ -1,4 +1,4 @@
-import { principalPolicyRequestRecord } from "../../../data/containers/shared/principalPolicies.js";
+import { principalPolicyRef } from "../../../data/containers/shared/principalPolicies.js";
 import { containerManifestRef } from "../../../data/containers/shared/projection.js";
 import { readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
 export function readCanonicalRecordOrNull(value, label) {
@@ -31,7 +31,7 @@ export function containerMutationRequestCore(operation, input) {
         body: readCanonicalRecord(input.body, `${label} body`),
         expectedManifestHash: input.manifestHash,
         manifest: readCanonicalRecord(input.manifest, `${label} manifest`),
-        principalPolicies: readCanonicalRecords(input.principalPolicies.map((policy) => principalPolicyRequestRecord(policy)), `${label} principal policies`),
+        principalPolicyRefs: input.principalPolicies.map(principalPolicyRef),
         keyEpoch: readCanonicalRecord(input.keyEpoch, `${label} key epoch`),
         wraps: readCanonicalRecords(input.wraps, `${label} wraps`),
         userRecipientKeys: readCanonicalRecords(input.userRecipientKeys, `${label} user recipient keys`),

package/workflows/containers/child/mutationRequestCore.js.map

@@ -1 +1 @@
-{"version":3,"file":"mutationRequestCore.js","sourceRoot":"","sources":["mutationRequestCore.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAA0C,EAC1C,kBAAqD;IAKrD,OAAO;QACL,mBAAmB,EAAE,oBAAoB,CAAC,gBAAgB,CAAC;QAC3D,yBAAyB,EACvB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,KASC;IAYD,MAAM,KAAK,GAAG,aAAa,SAAS,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACzD,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC;QACtD,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,4BAA4B,CAAC,MAAM,CAAC,CACrC,EACD,GAAG,KAAK,qBAAqB,CAC9B;QACD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,CAAC;QACnE,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC1D,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,GAAG,KAAK,sBAAsB,CAC/B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport {\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function readCanonicalRecordOrNull(\n  value: unknown,\n  label: string,\n): Record<string, unknown> | null {\n  return value === null || value === undefined\n    ? null\n    : readCanonicalRecord(value, label);\n}\n\n/**\n * The previous-manifest identity every non-create mutation\n * (share/rekey/revoke/move) sends alongside the core request fields: the\n * previous head and the current path, cited by hash rather than echoed.\n */\nexport function previousPathRequestFields(\n  previousManifest: AccessManifestBundleWire,\n  previousProjection: ContainerWriterProjectionResponse,\n): Pick<\n  ContainerMutationRequest,\n  \"previousManifestRef\" | \"previousContainerPathRefs\"\n> {\n  return {\n    previousManifestRef: containerManifestRef(previousManifest),\n    previousContainerPathRefs:\n      previousProjection.path.map(containerManifestRef),\n  };\n}\n\n/**\n * The eight ContainerMutationRequest fields every child-container mutation\n * (create/share/rekey/revoke/move) assembles identically, labeled by\n * operation. The identity fields — previous manifest/path, manifest history,\n * predecessor bridge, keyring, and the parent KEK — genuinely differ per\n * operation and stay with each builder.\n */\nexport function containerMutationRequestCore(\n  operation: string,\n  input: {\n    body: unknown;\n    event: AccessEvent;\n    keyEpoch: ContainerKeyEpoch;\n    manifest: AccessManifest;\n    manifestHash: string;\n    principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n    userRecipientKeys: readonly ContainerUserRecipientKey[];\n    wraps: readonly ContainerKeyWrap[];\n  },\n): Pick<\n  ContainerMutationRequest,\n  | \"event\"\n  | \"body\"\n  | \"expectedManifestHash\"\n  | \"manifest\"\n  | \"principalPolicies\"\n  | \"keyEpoch\"\n  | \"wraps\"\n  | \"userRecipientKeys\"\n> {\n  const label = `Container ${operation}`;\n  return {\n    event: readCanonicalRecord(input.event, `${label} event`),\n    body: readCanonicalRecord(input.body, `${label} body`),\n    expectedManifestHash: input.manifestHash,\n    manifest: readCanonicalRecord(input.manifest, `${label} manifest`),\n    principalPolicies: readCanonicalRecords(\n      input.principalPolicies.map((policy) =>\n        principalPolicyRequestRecord(policy),\n      ),\n      `${label} principal policies`,\n    ),\n    keyEpoch: readCanonicalRecord(input.keyEpoch, `${label} key epoch`),\n    wraps: readCanonicalRecords(input.wraps, `${label} wraps`),\n    userRecipientKeys: readCanonicalRecords(\n      input.userRecipientKeys,\n      `${label} user recipient keys`,\n    ),\n  };\n}\n"]}
+{"version":3,"file":"mutationRequestCore.js","sourceRoot":"","sources":["mutationRequestCore.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAA0C,EAC1C,kBAAqD;IAKrD,OAAO;QACL,mBAAmB,EAAE,oBAAoB,CAAC,gBAAgB,CAAC;QAC3D,yBAAyB,EACvB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,KASC;IAYD,MAAM,KAAK,GAAG,aAAa,SAAS,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACzD,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC;QACtD,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClE,mBAAmB,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpE,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,CAAC;QACnE,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC1D,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,GAAG,KAAK,sBAAsB,CAC/B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyRef } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport {\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function readCanonicalRecordOrNull(\n  value: unknown,\n  label: string,\n): Record<string, unknown> | null {\n  return value === null || value === undefined\n    ? null\n    : readCanonicalRecord(value, label);\n}\n\n/**\n * The previous-manifest identity every non-create mutation\n * (share/rekey/revoke/move) sends alongside the core request fields: the\n * previous head and the current path, cited by hash rather than echoed.\n */\nexport function previousPathRequestFields(\n  previousManifest: AccessManifestBundleWire,\n  previousProjection: ContainerWriterProjectionResponse,\n): Pick<\n  ContainerMutationRequest,\n  \"previousManifestRef\" | \"previousContainerPathRefs\"\n> {\n  return {\n    previousManifestRef: containerManifestRef(previousManifest),\n    previousContainerPathRefs:\n      previousProjection.path.map(containerManifestRef),\n  };\n}\n\n/**\n * The eight ContainerMutationRequest fields every child-container mutation\n * (create/share/rekey/revoke/move) assembles identically, labeled by\n * operation. The identity fields — previous manifest/path, manifest history,\n * predecessor bridge, keyring, and the parent KEK — genuinely differ per\n * operation and stay with each builder.\n */\nexport function containerMutationRequestCore(\n  operation: string,\n  input: {\n    body: unknown;\n    event: AccessEvent;\n    keyEpoch: ContainerKeyEpoch;\n    manifest: AccessManifest;\n    manifestHash: string;\n    principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n    userRecipientKeys: readonly ContainerUserRecipientKey[];\n    wraps: readonly ContainerKeyWrap[];\n  },\n): Pick<\n  ContainerMutationRequest,\n  | \"event\"\n  | \"body\"\n  | \"expectedManifestHash\"\n  | \"manifest\"\n  | \"principalPolicyRefs\"\n  | \"keyEpoch\"\n  | \"wraps\"\n  | \"userRecipientKeys\"\n> {\n  const label = `Container ${operation}`;\n  return {\n    event: readCanonicalRecord(input.event, `${label} event`),\n    body: readCanonicalRecord(input.body, `${label} body`),\n    expectedManifestHash: input.manifestHash,\n    manifest: readCanonicalRecord(input.manifest, `${label} manifest`),\n    principalPolicyRefs: input.principalPolicies.map(principalPolicyRef),\n    keyEpoch: readCanonicalRecord(input.keyEpoch, `${label} key epoch`),\n    wraps: readCanonicalRecords(input.wraps, `${label} wraps`),\n    userRecipientKeys: readCanonicalRecords(\n      input.userRecipientKeys,\n      `${label} user recipient keys`,\n    ),\n  };\n}\n"]}

package/workflows/containers/child/recitePlan.js

@@ -1,6 +1,6 @@
 import { computeAccessManifestHash, deriveContainerAccessManifest, KeyingVerificationError, MAX_CONTAINER_RECITATION_EPOCH, resolveContainerStatePathUserAccessLevel, } from "../../../internal/crypto/index.js";
 import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
-import { principalPolicyRequestRecord } from "../../../data/containers/shared/principalPolicies.js";
+import { principalPolicyRef } from "../../../data/containers/shared/principalPolicies.js";
 import { containerManifestRef } from "../../../data/containers/shared/projection.js";
 import { canonicalKeyingJsonString, readCanonicalRecord, } from "../../../data/keying/canonicalJson.js";
 export function referencedRecitationPolicies(path, policies) {
@@ -53,7 +53,7 @@ export async function buildContainerRecitePlan(input) {
         expectedManifestHash: manifestHash,
         previousManifestRef: containerManifestRef(previous.bundle),
         previousContainerPathRefs: input.path.map((head) => containerManifestRef(head.bundle)),
-        principalPolicies: referencedRecitationPolicies(input.path, input.policies).map((policy) => principalPolicyRequestRecord(policy)),
+        principalPolicyRefs: referencedRecitationPolicies(input.path, input.policies).map(principalPolicyRef),
     };
     return { body, event, eventHash, manifest, manifestHash, state, request };
 }

package/workflows/containers/child/recitePlan.js.map

@@ -1 +1 @@
-{"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC;QACD,iBAAiB,EAAE,4BAA4B,CAC7C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n  KeyingVerificationError,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n  canonicalKeyingJsonString,\n  readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n  path: readonly HeldContainerHead[],\n  policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n  const referencedIds = new Set(\n    path.flatMap((head) =>\n      head.state.referencedPrincipalHeads.map(\n        (ref) => `${ref.principalType}:${ref.principalId}`,\n      ),\n    ),\n  );\n  return policies.filter((policy) =>\n    referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n  );\n}\n\nexport async function buildContainerRecitePlan(input: {\n  readonly author: ContainerMutationAuthor;\n  readonly path: readonly HeldContainerHead[];\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n  const previous = input.path.at(-1);\n  if (!previous) throw new Error(\"Recitation requires a held container path\");\n  if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n    throw new Error(\"Container re-citation history budget is exhausted\");\n  }\n  if (\n    input.path.some(\n      (head) => head.state.organizationId !== input.author.organizationId,\n    )\n  ) {\n    throw new Error(\"Recitation cannot cross organizations\");\n  }\n  if (\n    resolveContainerStatePathUserAccessLevel({\n      states: input.path.map((head) => head.state),\n      principalPolicies: input.policies,\n      userId: input.author.signerUserId,\n    }) !== \"admin\"\n  ) {\n    throw new KeyingVerificationError(\n      \"unauthorized\",\n      \"Container re-citation signer lacks admin access on the held path\",\n    );\n  }\n  const body = {\n    eventType: \"container.recite\" as const,\n    containerKeyEpochId: previous.state.containerKeyEpochId,\n    containerKeyPublicKey: previous.state.containerKeyPublicKey,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previous.state.containerId,\n    dependencyManifestHashes: input.path.map(\n      (head) => head.bundle.manifestHash,\n    ),\n    eventId: crypto.randomUUID(),\n    previousManifestHash: previous.bundle.manifestHash,\n    signedAt: new Date().toISOString(),\n  });\n  const state = {\n    ...previous.state,\n    epoch: previous.state.epoch + 1,\n    eventHash,\n    previousManifestHash: previous.bundle.manifestHash,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const request: ContainerReciteRequest = {\n    body,\n    event: readCanonicalRecord(event, \"Recitation event\"),\n    manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n    expectedManifestHash: manifestHash,\n    previousManifestRef: containerManifestRef(previous.bundle),\n    previousContainerPathRefs: input.path.map((head) =>\n      containerManifestRef(head.bundle),\n    ),\n    principalPolicies: referencedRecitationPolicies(\n      input.path,\n      input.policies,\n    ).map((policy) => principalPolicyRequestRecord(policy)),\n  };\n  return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n  plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n  response: ContainerReciteResponse,\n): void {\n  const bundle = response.accessManifest;\n  const signedFieldsMatch = [\n    [bundle.event.event, plan.event],\n    [bundle.event.body, plan.body],\n    [bundle.manifest, plan.manifest],\n    [bundle.state, plan.state],\n  ].every(\n    ([actual, expected]) =>\n      canonicalKeyingJsonString(actual, \"Recitation response\") ===\n      canonicalKeyingJsonString(expected, \"Recitation plan\"),\n  );\n  if (\n    response.containerId !== plan.state.containerId ||\n    response.organizationId !== plan.state.organizationId ||\n    response.parentId !== plan.state.parentContainerId ||\n    response.manifestHead.epoch !== plan.state.epoch ||\n    response.manifestHead.manifestHash !== plan.manifestHash ||\n    bundle.manifestHash !== plan.manifestHash ||\n    bundle.event.eventHash !== plan.eventHash ||\n    !signedFieldsMatch ||\n    canonicalKeyingJsonString(\n      response.referencedPrincipalHeads,\n      \"Recitation references\",\n    ) !==\n      canonicalKeyingJsonString(\n        plan.manifest.referencedPrincipalHeads,\n        \"Recitation planned references\",\n      )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Container recitation response does not match the signed plan\",\n    );\n}\n"]}
+{"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC;QACD,mBAAmB,EAAE,4BAA4B,CAC/C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAC1B,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n  KeyingVerificationError,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRef } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n  canonicalKeyingJsonString,\n  readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n  path: readonly HeldContainerHead[],\n  policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n  const referencedIds = new Set(\n    path.flatMap((head) =>\n      head.state.referencedPrincipalHeads.map(\n        (ref) => `${ref.principalType}:${ref.principalId}`,\n      ),\n    ),\n  );\n  return policies.filter((policy) =>\n    referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n  );\n}\n\nexport async function buildContainerRecitePlan(input: {\n  readonly author: ContainerMutationAuthor;\n  readonly path: readonly HeldContainerHead[];\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n  const previous = input.path.at(-1);\n  if (!previous) throw new Error(\"Recitation requires a held container path\");\n  if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n    throw new Error(\"Container re-citation history budget is exhausted\");\n  }\n  if (\n    input.path.some(\n      (head) => head.state.organizationId !== input.author.organizationId,\n    )\n  ) {\n    throw new Error(\"Recitation cannot cross organizations\");\n  }\n  if (\n    resolveContainerStatePathUserAccessLevel({\n      states: input.path.map((head) => head.state),\n      principalPolicies: input.policies,\n      userId: input.author.signerUserId,\n    }) !== \"admin\"\n  ) {\n    throw new KeyingVerificationError(\n      \"unauthorized\",\n      \"Container re-citation signer lacks admin access on the held path\",\n    );\n  }\n  const body = {\n    eventType: \"container.recite\" as const,\n    containerKeyEpochId: previous.state.containerKeyEpochId,\n    containerKeyPublicKey: previous.state.containerKeyPublicKey,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previous.state.containerId,\n    dependencyManifestHashes: input.path.map(\n      (head) => head.bundle.manifestHash,\n    ),\n    eventId: crypto.randomUUID(),\n    previousManifestHash: previous.bundle.manifestHash,\n    signedAt: new Date().toISOString(),\n  });\n  const state = {\n    ...previous.state,\n    epoch: previous.state.epoch + 1,\n    eventHash,\n    previousManifestHash: previous.bundle.manifestHash,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const request: ContainerReciteRequest = {\n    body,\n    event: readCanonicalRecord(event, \"Recitation event\"),\n    manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n    expectedManifestHash: manifestHash,\n    previousManifestRef: containerManifestRef(previous.bundle),\n    previousContainerPathRefs: input.path.map((head) =>\n      containerManifestRef(head.bundle),\n    ),\n    principalPolicyRefs: referencedRecitationPolicies(\n      input.path,\n      input.policies,\n    ).map(principalPolicyRef),\n  };\n  return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n  plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n  response: ContainerReciteResponse,\n): void {\n  const bundle = response.accessManifest;\n  const signedFieldsMatch = [\n    [bundle.event.event, plan.event],\n    [bundle.event.body, plan.body],\n    [bundle.manifest, plan.manifest],\n    [bundle.state, plan.state],\n  ].every(\n    ([actual, expected]) =>\n      canonicalKeyingJsonString(actual, \"Recitation response\") ===\n      canonicalKeyingJsonString(expected, \"Recitation plan\"),\n  );\n  if (\n    response.containerId !== plan.state.containerId ||\n    response.organizationId !== plan.state.organizationId ||\n    response.parentId !== plan.state.parentContainerId ||\n    response.manifestHead.epoch !== plan.state.epoch ||\n    response.manifestHead.manifestHash !== plan.manifestHash ||\n    bundle.manifestHash !== plan.manifestHash ||\n    bundle.event.eventHash !== plan.eventHash ||\n    !signedFieldsMatch ||\n    canonicalKeyingJsonString(\n      response.referencedPrincipalHeads,\n      \"Recitation references\",\n    ) !==\n      canonicalKeyingJsonString(\n        plan.manifest.referencedPrincipalHeads,\n        \"Recitation planned references\",\n      )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Container recitation response does not match the signed plan\",\n    );\n}\n"]}

package/workflows/containers/root/create.js

@@ -1,8 +1,9 @@
 import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, normalizeContainerAccessEventBody, } from "../../../internal/crypto/index.js";
 import { buildContainerCreateBody, buildContainerCreateKeyEpoch, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../data/containers/shared/events.js";
+import { principalPolicyRef } from "../../../data/containers/shared/principalPolicies.js";
 import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
 import { readCanonicalJson, readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
-import { principalHeadFromInitialGroupPolicy, principalPolicyRecordFromInitialGroupPolicy, } from "./initialGroupPolicy.js";
+import { principalHeadFromInitialGroupPolicy } from "./initialGroupPolicy.js";
 function buildRootContainerCreateBody(input) {
     const baseBody = buildContainerCreateBody({
         systemSlot: input.systemSlot,
@@ -56,7 +57,7 @@ function buildRootContainerCreateRequest(input) {
         manifest: readCanonicalRecord(input.manifest, "Container root create manifest"),
         previousManifestRef: null,
         parentContainerPathRefs: [],
-        principalPolicies: readCanonicalRecords(input.principalPolicies, "Container root create principal policies"),
+        principalPolicyRefs: input.principalPolicyRefs,
         keyEpoch: readCanonicalRecord(input.keyEpoch, "Container root create key epoch"),
         predecessorBridge: null,
         keyring: null,
@@ -64,26 +65,13 @@ function buildRootContainerCreateRequest(input) {
         userRecipientKeys: readCanonicalRecords(input.userRecipientKeys, "Container root create user recipient keys"),
     };
 }
-async function buildRootManagedPrincipalContext(adminGroup) {
-    if (!adminGroup) {
-        return {
-            managedPrincipalHead: null,
-            managedPrincipalPolicies: [],
-        };
-    }
-    const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({
-        principalId: adminGroup.groupId,
-        policy: adminGroup.initialGroupPolicy,
-    });
-    return {
-        managedPrincipalHead,
-        managedPrincipalPolicies: [
-            principalPolicyRecordFromInitialGroupPolicy({
-                head: managedPrincipalHead,
-                policy: adminGroup.initialGroupPolicy,
-            }),
-        ],
-    };
+async function rootManagedPrincipalHead(group) {
+    return group
+        ? principalHeadFromInitialGroupPolicy({
+            principalId: group.groupId,
+            policy: group.initialGroupPolicy,
+        })
+        : null;
 }
 async function deriveRootCreateArtifacts(input) {
     if (!input.body.containerKeyPublicKey)
@@ -175,11 +163,10 @@ function normalizedRootCreateBody(input) {
 export async function buildRootContainerCreatePlan(input) {
     const containerKey = rootKeyMaterial(input.containerKey);
     const adminGroup = input.adminGroup ?? null;
-    const { managedPrincipalHead, managedPrincipalPolicies } = await buildRootManagedPrincipalContext(adminGroup);
-    const member = await buildRootManagedPrincipalContext(input.memberGroup ?? null);
+    const managedPrincipalHead = await rootManagedPrincipalHead(adminGroup);
+    const memberHead = await rootManagedPrincipalHead(input.memberGroup ?? null);
     if (input.memberGroup && !adminGroup)
         throw new Error("Members root grant requires Admins authority");
-    managedPrincipalPolicies.push(...member.managedPrincipalPolicies);
     const containerKeyEpochId = await resolveContainerKekEpochId({
         containerId: input.containerId,
         keyEpoch: 1,
@@ -190,7 +177,7 @@ export async function buildRootContainerCreatePlan(input) {
             containerId: input.containerId,
             keyMaterial: containerKey,
         }),
-        memberHead: member.managedPrincipalHead,
+        memberHead,
         systemSlot: input.systemSlot ?? null,
         author: input.author,
         containerKeyEpochId,
@@ -207,7 +194,7 @@ export async function buildRootContainerCreatePlan(input) {
     });
     const { recipientTargets, wraps, userRecipientKeys } = await wrapRootContainerRecipients({
         memberGroup: input.memberGroup ?? null,
-        memberHead: member.managedPrincipalHead,
+        memberHead,
         adminGroup,
         containerKey,
         containerKeyEpochId,
@@ -239,7 +226,9 @@ export async function buildRootContainerCreatePlan(input) {
             keyEpoch,
             manifest,
             manifestHash,
-            principalPolicies: managedPrincipalPolicies,
+            principalPolicyRefs: [managedPrincipalHead, memberHead]
+                .filter((head) => head !== null)
+                .map(principalPolicyRef),
             userRecipientKeys,
             wraps,
         }),

package/workflows/containers/root/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,sBAAsB,CAAC;AAE9B,SAAS,4BAA4B,CAAC,KAQrC;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ;oBACE,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,WAAW;oBACjD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;iBACtD;gBACD,GAAG,CAAC,KAAK,CAAC,UAAU;oBAClB,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE,MAAe;4BAC5B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;4BACvC,WAAW,EAAE,OAAgB;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,wBAAwB,EAAE;gBACxB,KAAK,CAAC,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KASxC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACtE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;QACnE,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,gCAAgC,CACjC;QACD,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EAAE,EAAE;QAC3B,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,0CAA0C,CAC3C;QACD,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,iCAAiC,CAClC;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACvE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,UAAiD;IAKjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,WAAW,EAAE,UAAU,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,kBAAkB;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,wBAAwB,EAAE;YACxB,2CAA2C,CAAC;gBAC1C,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,SAAS;QACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;KAC9D,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,CAAC,MAAM,kCAAkC,CAAC;gBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAC7B,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;gBAClE,aAAa,EAAE,KAAK,CAAC,oBAAoB;aAC1C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAGC;IAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;QACnC,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,GAAG,KAAK;YACR,+BAA+B,EAC7B,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;YACnE,aAAa,EAAE,KAAK,CAAC,UAAU;SAChC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,gBAAgB,EAAE;YAChB,IAAI,CAAC,eAAe;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyD;IAEzD,MAAM,IAAI,GAAG,iCAAiC,CAC5C,iBAAiB,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GACtD,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,gCAAgC,CACnD,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,UAAU;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,wBAAwB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,yBAAyB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACL,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAClD,MAAM,2BAA2B,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,oBAAoB;QACpB,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACL,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAwB;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB;QAChB,OAAO,EAAE,+BAA+B,CAAC;YACvC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,iBAAiB,EAAE,wBAAwB;YAC3C,iBAAiB;YACjB,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,IAAyB;IAEzB,OAAO;QACL,cAAc,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;oBAC9D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC;oBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;gBACvE,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAC/D;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,kCAAkC,CACnC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAChE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerCreateAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  deriveContainerKekWrappingPublicKey,\n  normalizeContainerAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationRequest,\n  CreateOrganizationGroupRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  buildContainerCreateBody,\n  buildContainerCreateKeyEpoch,\n  deriveContainerCreateManifest,\n  resolveContainerKekEpochId,\n  signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerCreatePlan,\n  ContainerMutationAuthor,\n  MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\n\nimport {\n  principalHeadFromInitialGroupPolicy,\n  principalPolicyRecordFromInitialGroupPolicy,\n} from \"./initialGroupPolicy\";\n\nfunction buildRootContainerCreateBody(input: {\n  author: ContainerMutationAuthor;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string;\n  metadataDocumentId: string;\n  memberHead: ContainerGrantPrincipalHead | null;\n  systemSlot: ContainerSystemSlot | null;\n}): ContainerCreateAccessEventBody {\n  const baseBody = buildContainerCreateBody({\n    systemSlot: input.systemSlot,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n  });\n  if (input.managedPrincipalHead) {\n    return {\n      ...baseBody,\n      directGrants: [\n        {\n          accessLevel: \"admin\",\n          subjectId: input.managedPrincipalHead.principalId,\n          subjectType: input.managedPrincipalHead.principalType,\n        },\n        ...(input.memberHead\n          ? [\n              {\n                accessLevel: \"read\" as const,\n                subjectId: input.memberHead.principalId,\n                subjectType: \"group\" as const,\n              },\n            ]\n          : []),\n      ],\n      referencedPrincipalHeads: [\n        input.managedPrincipalHead,\n        ...(input.memberHead ? [input.memberHead] : []),\n      ],\n    };\n  }\n\n  return {\n    ...baseBody,\n    directGrants: [\n      {\n        accessLevel: \"admin\",\n        subjectId: input.author.signerUserId,\n        subjectType: \"user\",\n      },\n    ],\n  };\n}\n\nfunction buildRootContainerCreateRequest(input: {\n  body: ContainerCreateAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  principalPolicies: readonly Record<string, unknown>[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    event: readCanonicalRecord(input.event, \"Container root create event\"),\n    body: readCanonicalRecord(input.body, \"Container root create body\"),\n    expectedManifestHash: input.manifestHash,\n    manifest: readCanonicalRecord(\n      input.manifest,\n      \"Container root create manifest\",\n    ),\n    previousManifestRef: null,\n    parentContainerPathRefs: [],\n    principalPolicies: readCanonicalRecords(\n      input.principalPolicies,\n      \"Container root create principal policies\",\n    ),\n    keyEpoch: readCanonicalRecord(\n      input.keyEpoch,\n      \"Container root create key epoch\",\n    ),\n    predecessorBridge: null,\n    keyring: null,\n    wraps: readCanonicalRecords(input.wraps, \"Container root create wraps\"),\n    userRecipientKeys: readCanonicalRecords(\n      input.userRecipientKeys,\n      \"Container root create user recipient keys\",\n    ),\n  };\n}\n\nasync function buildRootManagedPrincipalContext(\n  adminGroup: CreateOrganizationGroupRequest | null,\n): Promise<{\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  managedPrincipalPolicies: Record<string, unknown>[];\n}> {\n  if (!adminGroup) {\n    return {\n      managedPrincipalHead: null,\n      managedPrincipalPolicies: [],\n    };\n  }\n\n  const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({\n    principalId: adminGroup.groupId,\n    policy: adminGroup.initialGroupPolicy,\n  });\n\n  return {\n    managedPrincipalHead,\n    managedPrincipalPolicies: [\n      principalPolicyRecordFromInitialGroupPolicy({\n        head: managedPrincipalHead,\n        policy: adminGroup.initialGroupPolicy,\n      }),\n    ],\n  };\n}\n\nasync function deriveRootCreateArtifacts(input: {\n  author: ContainerMutationAuthor;\n  body: ContainerCreateAccessEventBody;\n  containerId: string;\n  containerKeyEpochId: string;\n  metadataDocumentId: string;\n  signedAt: string | undefined;\n}) {\n  if (!input.body.containerKeyPublicKey)\n    throw new Error(\"Root container public key is missing\");\n  const { event, eventHash } = await signContainerCreateEvent({\n    author: input.author,\n    body: input.body,\n    containerId: input.containerId,\n    eventId: crypto.randomUUID(),\n    // A root container belongs to the creator's own organization.\n    organizationId: input.author.organizationId,\n    parentPath: [],\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n    {\n      systemSlot: input.body.systemSlot,\n      containerId: input.containerId,\n      containerKeyEpochId: input.containerKeyEpochId,\n      containerKeyPublicKey: input.body.containerKeyPublicKey,\n      directGrants: input.body.directGrants,\n      eventHash,\n      metadataDocumentId: input.metadataDocumentId,\n      // A root container belongs to the creator's own organization.\n      organizationId: input.author.organizationId,\n      parentContainerId: null,\n      parentManifestHash: null,\n      referencedPrincipalHeads: input.body.referencedPrincipalHeads,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash,\n    manifestHash,\n    parentContainerKeyEpochId: null,\n  });\n  return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\nasync function wrapRootContainerKeyForPlan(input: {\n  adminGroup: CreateOrganizationGroupRequest | null;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  recipientEncapsulationPublicKey: Uint8Array;\n  userId: string;\n}) {\n  if (input.adminGroup && input.managedPrincipalHead) {\n    return {\n      ...(await wrapContainerKeyToManagedPrincipal({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        principalEncapsulationPublicKey:\n          input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,\n        principalHead: input.managedPrincipalHead,\n      })),\n      userRecipientKey: null,\n    };\n  }\n\n  return wrapContainerKeyToRootUser({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n    userId: input.userId,\n  });\n}\n\nasync function wrapRootContainerRecipients(\n  input: Parameters<typeof wrapRootContainerKeyForPlan>[0] & {\n    memberGroup: CreateOrganizationGroupRequest | null;\n    memberHead: ContainerGrantPrincipalHead | null;\n  },\n) {\n  const root = await wrapRootContainerKeyForPlan(input);\n  const member =\n    input.memberGroup && input.memberHead\n      ? await wrapContainerKeyToManagedPrincipal({\n          ...input,\n          principalEncapsulationPublicKey:\n            input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,\n          principalHead: input.memberHead,\n        })\n      : null;\n  return {\n    recipientTargets: [\n      root.recipientTarget,\n      ...(member ? [member.recipientTarget] : []),\n    ],\n    wraps: [root.wrap, ...(member ? [member.wrap] : [])],\n    userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],\n  };\n}\n\nfunction rootKeyMaterial(key?: Uint8Array): Uint8Array {\n  const material = key ?? crypto.getRandomValues(new Uint8Array(32));\n  if (material.byteLength !== 32)\n    throw new Error(\"Container KEK material must be 32 bytes\");\n  return material;\n}\n\nfunction normalizedRootCreateBody(\n  input: Parameters<typeof buildRootContainerCreateBody>[0],\n): ContainerCreateAccessEventBody {\n  const body = normalizeContainerAccessEventBody(\n    readCanonicalJson(buildRootContainerCreateBody(input), \"Root create body\"),\n  );\n  if (body.eventType !== \"container.create\")\n    throw new Error(\"Expected root creation body\");\n  return body;\n}\n\nexport async function buildRootContainerCreatePlan(input: {\n  adminGroup?: CreateOrganizationGroupRequest | undefined;\n  memberGroup?: CreateOrganizationGroupRequest | undefined;\n  systemSlot?: ContainerSystemSlot | undefined;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  containerKey?: Uint8Array | undefined;\n  metadataDocumentId: string;\n  recipientEncapsulationPublicKey: Uint8Array;\n  signedAt?: string | undefined;\n}): Promise<MaterializedContainerCreatePlan> {\n  const containerKey = rootKeyMaterial(input.containerKey);\n  const adminGroup = input.adminGroup ?? null;\n  const { managedPrincipalHead, managedPrincipalPolicies } =\n    await buildRootManagedPrincipalContext(adminGroup);\n\n  const member = await buildRootManagedPrincipalContext(\n    input.memberGroup ?? null,\n  );\n  if (input.memberGroup && !adminGroup)\n    throw new Error(\"Members root grant requires Admins authority\");\n  managedPrincipalPolicies.push(...member.managedPrincipalPolicies);\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.containerId,\n    keyEpoch: 1,\n    keyMaterial: containerKey,\n  });\n  const body = normalizedRootCreateBody({\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.containerId,\n      keyMaterial: containerKey,\n    }),\n    memberHead: member.managedPrincipalHead,\n    systemSlot: input.systemSlot ?? null,\n    author: input.author,\n    containerKeyEpochId,\n    managedPrincipalHead,\n    metadataDocumentId: input.metadataDocumentId,\n  });\n  const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveRootCreateArtifacts({\n      author: input.author,\n      body,\n      containerId: input.containerId,\n      containerKeyEpochId,\n      metadataDocumentId: input.metadataDocumentId,\n      signedAt: input.signedAt,\n    });\n  const { recipientTargets, wraps, userRecipientKeys } =\n    await wrapRootContainerRecipients({\n      memberGroup: input.memberGroup ?? null,\n      memberHead: member.managedPrincipalHead,\n      adminGroup,\n      containerKey,\n      containerKeyEpochId,\n      manifestHash,\n      managedPrincipalHead,\n      recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n      userId: input.author.signerUserId,\n    });\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  const plan: ContainerCreatePlan = {\n    body,\n    containerId: input.containerId,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyEpochHash,\n    keyTargetHash,\n    manifest,\n    manifestHash,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n    recipientTargets,\n    request: buildRootContainerCreateRequest({\n      body,\n      event,\n      keyEpoch,\n      manifest,\n      manifestHash,\n      principalPolicies: managedPrincipalPolicies,\n      userRecipientKeys,\n      wraps,\n    }),\n    state,\n    wraps,\n  };\n\n  return { containerKey, plan };\n}\n\nexport function rootContainerWriterProjectionFromCreatePlan(\n  plan: ContainerCreatePlan,\n): ContainerWriterProjectionResponse {\n  return {\n    policyEvidence: {\n      organization: null,\n      organizationPayloads: [],\n      groups: [],\n    },\n    containerId: plan.containerId,\n    organizationId: plan.state.organizationId,\n    path: [\n      {\n        event: {\n          event: readCanonicalRecord(plan.event, \"Container root event\"),\n          body: readCanonicalRecord(plan.body, \"Container root body\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(plan.manifest, \"Container root manifest\"),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container root state\"),\n      },\n    ],\n    containerKeks: [\n      {\n        containerId: plan.containerId,\n        accessManifestHash: plan.manifestHash,\n        containerKeyEpochId: plan.containerKeyEpochId,\n        containerKeyEpoch: plan.keyEpoch.keyEpoch,\n        keyEpoch: readCanonicalRecord(\n          plan.keyEpoch,\n          \"Container root key epoch\",\n        ),\n        keyEpochHash: plan.keyEpochHash,\n        keyTargetHash: plan.keyTargetHash,\n        containerManifestHistory: [],\n        parentContainerKeyEpochId: null,\n        keyring: null,\n        recipientTargets: readCanonicalRecords(\n          plan.recipientTargets,\n          \"Container root recipient targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container root wraps\"),\n      },\n    ],\n  };\n}\n"]}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EACL,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAE3E,SAAS,4BAA4B,CAAC,KAQrC;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ;oBACE,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,WAAW;oBACjD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;iBACtD;gBACD,GAAG,CAAC,KAAK,CAAC,UAAU;oBAClB,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE,MAAe;4BAC5B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;4BACvC,WAAW,EAAE,OAAgB;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,wBAAwB,EAAE;gBACxB,KAAK,CAAC,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KASxC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACtE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;QACnE,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,gCAAgC,CACjC;QACD,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EAAE,EAAE;QAC3B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,iCAAiC,CAClC;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACvE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAA4C;IAE5C,OAAO,KAAK;QACV,CAAC,CAAC,mCAAmC,CAAC;YAClC,WAAW,EAAE,KAAK,CAAC,OAAO;YAC1B,MAAM,EAAE,KAAK,CAAC,kBAAkB;SACjC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,SAAS;QACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;KAC9D,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,CAAC,MAAM,kCAAkC,CAAC;gBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAC7B,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;gBAClE,aAAa,EAAE,KAAK,CAAC,oBAAoB;aAC1C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAGC;IAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;QACnC,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,GAAG,KAAK;YACR,+BAA+B,EAC7B,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;YACnE,aAAa,EAAE,KAAK,CAAC,UAAU;SAChC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,gBAAgB,EAAE;YAChB,IAAI,CAAC,eAAe;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyD;IAEzD,MAAM,IAAI,GAAG,iCAAiC,CAC5C,iBAAiB,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,oBAAoB,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,UAAU;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,UAAU;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,yBAAyB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACL,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAClD,MAAM,2BAA2B,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU;QACV,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,oBAAoB;QACpB,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACL,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAwB;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB;QAChB,OAAO,EAAE,+BAA+B,CAAC;YACvC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,mBAAmB,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC;iBACpD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC/B,GAAG,CAAC,kBAAkB,CAAC;YAC1B,iBAAiB;YACjB,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,IAAyB;IAEzB,OAAO;QACL,cAAc,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;oBAC9D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC;oBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;gBACvE,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAC/D;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,kCAAkC,CACnC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAChE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerCreateAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  deriveContainerKekWrappingPublicKey,\n  normalizeContainerAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationRequest,\n  CreateOrganizationGroupRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  buildContainerCreateBody,\n  buildContainerCreateKeyEpoch,\n  deriveContainerCreateManifest,\n  resolveContainerKekEpochId,\n  signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { principalPolicyRef } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerCreatePlan,\n  ContainerMutationAuthor,\n  MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\n\nimport { principalHeadFromInitialGroupPolicy } from \"./initialGroupPolicy\";\n\nfunction buildRootContainerCreateBody(input: {\n  author: ContainerMutationAuthor;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string;\n  metadataDocumentId: string;\n  memberHead: ContainerGrantPrincipalHead | null;\n  systemSlot: ContainerSystemSlot | null;\n}): ContainerCreateAccessEventBody {\n  const baseBody = buildContainerCreateBody({\n    systemSlot: input.systemSlot,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n  });\n  if (input.managedPrincipalHead) {\n    return {\n      ...baseBody,\n      directGrants: [\n        {\n          accessLevel: \"admin\",\n          subjectId: input.managedPrincipalHead.principalId,\n          subjectType: input.managedPrincipalHead.principalType,\n        },\n        ...(input.memberHead\n          ? [\n              {\n                accessLevel: \"read\" as const,\n                subjectId: input.memberHead.principalId,\n                subjectType: \"group\" as const,\n              },\n            ]\n          : []),\n      ],\n      referencedPrincipalHeads: [\n        input.managedPrincipalHead,\n        ...(input.memberHead ? [input.memberHead] : []),\n      ],\n    };\n  }\n\n  return {\n    ...baseBody,\n    directGrants: [\n      {\n        accessLevel: \"admin\",\n        subjectId: input.author.signerUserId,\n        subjectType: \"user\",\n      },\n    ],\n  };\n}\n\nfunction buildRootContainerCreateRequest(input: {\n  body: ContainerCreateAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  principalPolicyRefs: ContainerMutationRequest[\"principalPolicyRefs\"];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    event: readCanonicalRecord(input.event, \"Container root create event\"),\n    body: readCanonicalRecord(input.body, \"Container root create body\"),\n    expectedManifestHash: input.manifestHash,\n    manifest: readCanonicalRecord(\n      input.manifest,\n      \"Container root create manifest\",\n    ),\n    previousManifestRef: null,\n    parentContainerPathRefs: [],\n    principalPolicyRefs: input.principalPolicyRefs,\n    keyEpoch: readCanonicalRecord(\n      input.keyEpoch,\n      \"Container root create key epoch\",\n    ),\n    predecessorBridge: null,\n    keyring: null,\n    wraps: readCanonicalRecords(input.wraps, \"Container root create wraps\"),\n    userRecipientKeys: readCanonicalRecords(\n      input.userRecipientKeys,\n      \"Container root create user recipient keys\",\n    ),\n  };\n}\n\nasync function rootManagedPrincipalHead(\n  group: CreateOrganizationGroupRequest | null,\n): Promise<ContainerGrantPrincipalHead | null> {\n  return group\n    ? principalHeadFromInitialGroupPolicy({\n        principalId: group.groupId,\n        policy: group.initialGroupPolicy,\n      })\n    : null;\n}\n\nasync function deriveRootCreateArtifacts(input: {\n  author: ContainerMutationAuthor;\n  body: ContainerCreateAccessEventBody;\n  containerId: string;\n  containerKeyEpochId: string;\n  metadataDocumentId: string;\n  signedAt: string | undefined;\n}) {\n  if (!input.body.containerKeyPublicKey)\n    throw new Error(\"Root container public key is missing\");\n  const { event, eventHash } = await signContainerCreateEvent({\n    author: input.author,\n    body: input.body,\n    containerId: input.containerId,\n    eventId: crypto.randomUUID(),\n    // A root container belongs to the creator's own organization.\n    organizationId: input.author.organizationId,\n    parentPath: [],\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n    {\n      systemSlot: input.body.systemSlot,\n      containerId: input.containerId,\n      containerKeyEpochId: input.containerKeyEpochId,\n      containerKeyPublicKey: input.body.containerKeyPublicKey,\n      directGrants: input.body.directGrants,\n      eventHash,\n      metadataDocumentId: input.metadataDocumentId,\n      // A root container belongs to the creator's own organization.\n      organizationId: input.author.organizationId,\n      parentContainerId: null,\n      parentManifestHash: null,\n      referencedPrincipalHeads: input.body.referencedPrincipalHeads,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash,\n    manifestHash,\n    parentContainerKeyEpochId: null,\n  });\n  return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\nasync function wrapRootContainerKeyForPlan(input: {\n  adminGroup: CreateOrganizationGroupRequest | null;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  managedPrincipalHead: ContainerGrantPrincipalHead | null;\n  recipientEncapsulationPublicKey: Uint8Array;\n  userId: string;\n}) {\n  if (input.adminGroup && input.managedPrincipalHead) {\n    return {\n      ...(await wrapContainerKeyToManagedPrincipal({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        principalEncapsulationPublicKey:\n          input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,\n        principalHead: input.managedPrincipalHead,\n      })),\n      userRecipientKey: null,\n    };\n  }\n\n  return wrapContainerKeyToRootUser({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n    userId: input.userId,\n  });\n}\n\nasync function wrapRootContainerRecipients(\n  input: Parameters<typeof wrapRootContainerKeyForPlan>[0] & {\n    memberGroup: CreateOrganizationGroupRequest | null;\n    memberHead: ContainerGrantPrincipalHead | null;\n  },\n) {\n  const root = await wrapRootContainerKeyForPlan(input);\n  const member =\n    input.memberGroup && input.memberHead\n      ? await wrapContainerKeyToManagedPrincipal({\n          ...input,\n          principalEncapsulationPublicKey:\n            input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,\n          principalHead: input.memberHead,\n        })\n      : null;\n  return {\n    recipientTargets: [\n      root.recipientTarget,\n      ...(member ? [member.recipientTarget] : []),\n    ],\n    wraps: [root.wrap, ...(member ? [member.wrap] : [])],\n    userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],\n  };\n}\n\nfunction rootKeyMaterial(key?: Uint8Array): Uint8Array {\n  const material = key ?? crypto.getRandomValues(new Uint8Array(32));\n  if (material.byteLength !== 32)\n    throw new Error(\"Container KEK material must be 32 bytes\");\n  return material;\n}\n\nfunction normalizedRootCreateBody(\n  input: Parameters<typeof buildRootContainerCreateBody>[0],\n): ContainerCreateAccessEventBody {\n  const body = normalizeContainerAccessEventBody(\n    readCanonicalJson(buildRootContainerCreateBody(input), \"Root create body\"),\n  );\n  if (body.eventType !== \"container.create\")\n    throw new Error(\"Expected root creation body\");\n  return body;\n}\n\nexport async function buildRootContainerCreatePlan(input: {\n  adminGroup?: CreateOrganizationGroupRequest | undefined;\n  memberGroup?: CreateOrganizationGroupRequest | undefined;\n  systemSlot?: ContainerSystemSlot | undefined;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  containerKey?: Uint8Array | undefined;\n  metadataDocumentId: string;\n  recipientEncapsulationPublicKey: Uint8Array;\n  signedAt?: string | undefined;\n}): Promise<MaterializedContainerCreatePlan> {\n  const containerKey = rootKeyMaterial(input.containerKey);\n  const adminGroup = input.adminGroup ?? null;\n  const managedPrincipalHead = await rootManagedPrincipalHead(adminGroup);\n  const memberHead = await rootManagedPrincipalHead(input.memberGroup ?? null);\n  if (input.memberGroup && !adminGroup)\n    throw new Error(\"Members root grant requires Admins authority\");\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.containerId,\n    keyEpoch: 1,\n    keyMaterial: containerKey,\n  });\n  const body = normalizedRootCreateBody({\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.containerId,\n      keyMaterial: containerKey,\n    }),\n    memberHead,\n    systemSlot: input.systemSlot ?? null,\n    author: input.author,\n    containerKeyEpochId,\n    managedPrincipalHead,\n    metadataDocumentId: input.metadataDocumentId,\n  });\n  const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveRootCreateArtifacts({\n      author: input.author,\n      body,\n      containerId: input.containerId,\n      containerKeyEpochId,\n      metadataDocumentId: input.metadataDocumentId,\n      signedAt: input.signedAt,\n    });\n  const { recipientTargets, wraps, userRecipientKeys } =\n    await wrapRootContainerRecipients({\n      memberGroup: input.memberGroup ?? null,\n      memberHead,\n      adminGroup,\n      containerKey,\n      containerKeyEpochId,\n      manifestHash,\n      managedPrincipalHead,\n      recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n      userId: input.author.signerUserId,\n    });\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  const plan: ContainerCreatePlan = {\n    body,\n    containerId: input.containerId,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyEpochHash,\n    keyTargetHash,\n    manifest,\n    manifestHash,\n    metadataDocumentId: input.metadataDocumentId,\n    parentContainerId: null,\n    parentManifestHash: null,\n    recipientTargets,\n    request: buildRootContainerCreateRequest({\n      body,\n      event,\n      keyEpoch,\n      manifest,\n      manifestHash,\n      principalPolicyRefs: [managedPrincipalHead, memberHead]\n        .filter((head) => head !== null)\n        .map(principalPolicyRef),\n      userRecipientKeys,\n      wraps,\n    }),\n    state,\n    wraps,\n  };\n\n  return { containerKey, plan };\n}\n\nexport function rootContainerWriterProjectionFromCreatePlan(\n  plan: ContainerCreatePlan,\n): ContainerWriterProjectionResponse {\n  return {\n    policyEvidence: {\n      organization: null,\n      organizationPayloads: [],\n      groups: [],\n    },\n    containerId: plan.containerId,\n    organizationId: plan.state.organizationId,\n    path: [\n      {\n        event: {\n          event: readCanonicalRecord(plan.event, \"Container root event\"),\n          body: readCanonicalRecord(plan.body, \"Container root body\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(plan.manifest, \"Container root manifest\"),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container root state\"),\n      },\n    ],\n    containerKeks: [\n      {\n        containerId: plan.containerId,\n        accessManifestHash: plan.manifestHash,\n        containerKeyEpochId: plan.containerKeyEpochId,\n        containerKeyEpoch: plan.keyEpoch.keyEpoch,\n        keyEpoch: readCanonicalRecord(\n          plan.keyEpoch,\n          \"Container root key epoch\",\n        ),\n        keyEpochHash: plan.keyEpochHash,\n        keyTargetHash: plan.keyTargetHash,\n        containerManifestHistory: [],\n        parentContainerKeyEpochId: null,\n        keyring: null,\n        recipientTargets: readCanonicalRecords(\n          plan.recipientTargets,\n          \"Container root recipient targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container root wraps\"),\n      },\n    ],\n  };\n}\n"]}

package/workflows/containers/root/initialGroupPolicy.js

@@ -1,5 +1,4 @@
 import { computePrincipalStateHash } from "../../../internal/crypto/index.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
 export async function principalHeadFromInitialGroupPolicy(input) {
     return {
         principalType: "group",
@@ -10,26 +9,4 @@ export async function principalHeadFromInitialGroupPolicy(input) {
         keyFingerprint: input.policy.state.keyFingerprint,
     };
 }
-export function principalPolicyRecordFromInitialGroupPolicy(input) {
-    const { head } = input;
-    return readCanonicalRecord({
-        principalType: head.principalType,
-        principalId: head.principalId,
-        version: head.version,
-        keyEpoch: head.keyEpoch,
-        stateHash: head.stateHash,
-        state: {
-            ...input.policy.state,
-            stateHash: head.stateHash,
-        },
-        projection: input.policy.projection,
-        grants: input.policy.grants,
-        checkpoint: {
-            principalType: head.principalType,
-            principalId: head.principalId,
-            version: head.version,
-            stateHash: head.stateHash,
-        },
-    }, "Initial managed principal policy");
-}
 //# sourceMappingURL=initialGroupPolicy.js.map

package/workflows/containers/root/initialGroupPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"initialGroupPolicy.js","sourceRoot":"","sources":["initialGroupPolicy.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAUzE,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqC;IAErC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QACnC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ;QACrC,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAG3D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,OAAO,mBAAmB,CACxB;QACE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,UAAU,EAAE;YACV,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,EACD,kCAAkC,CACnC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerGrantPrincipalHead,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\n\ntype InitialManagedPrincipalPolicy =\n  CreateOrganizationGroupRequest[\"initialGroupPolicy\"];\n\ninterface RootManagedPrincipalGrantInput {\n  readonly principalId: string;\n  readonly policy: InitialManagedPrincipalPolicy;\n}\n\nexport async function principalHeadFromInitialGroupPolicy(\n  input: RootManagedPrincipalGrantInput,\n): Promise<ContainerGrantPrincipalHead> {\n  return {\n    principalType: \"group\",\n    principalId: input.principalId,\n    version: input.policy.state.version,\n    keyEpoch: input.policy.state.keyEpoch,\n    stateHash: await computePrincipalStateHash(input.policy.state),\n    keyFingerprint: input.policy.state.keyFingerprint,\n  };\n}\n\nexport function principalPolicyRecordFromInitialGroupPolicy(input: {\n  readonly head: ReferencedPrincipalHead;\n  readonly policy: InitialManagedPrincipalPolicy;\n}): Record<string, unknown> {\n  const { head } = input;\n\n  return readCanonicalRecord(\n    {\n      principalType: head.principalType,\n      principalId: head.principalId,\n      version: head.version,\n      keyEpoch: head.keyEpoch,\n      stateHash: head.stateHash,\n      state: {\n        ...input.policy.state,\n        stateHash: head.stateHash,\n      },\n      projection: input.policy.projection,\n      grants: input.policy.grants,\n      checkpoint: {\n        principalType: head.principalType,\n        principalId: head.principalId,\n        version: head.version,\n        stateHash: head.stateHash,\n      },\n    },\n    \"Initial managed principal policy\",\n  );\n}\n"]}
+{"version":3,"file":"initialGroupPolicy.js","sourceRoot":"","sources":["initialGroupPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAW9D,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqC;IAErC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QACnC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ;QACrC,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;KAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantPrincipalHead } from \"@tearleads/crypto\";\nimport { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\n\ntype InitialManagedPrincipalPolicy =\n  CreateOrganizationGroupRequest[\"initialGroupPolicy\"];\n\ninterface RootManagedPrincipalGrantInput {\n  readonly principalId: string;\n  readonly policy: InitialManagedPrincipalPolicy;\n}\n\nexport async function principalHeadFromInitialGroupPolicy(\n  input: RootManagedPrincipalGrantInput,\n): Promise<ContainerGrantPrincipalHead> {\n  return {\n    principalType: \"group\",\n    principalId: input.principalId,\n    version: input.policy.state.version,\n    keyEpoch: input.policy.state.keyEpoch,\n    stateHash: await computePrincipalStateHash(input.policy.state),\n    keyFingerprint: input.policy.state.keyFingerprint,\n  };\n}\n"]}

package/workflows/documents/create/index.d.ts

@@ -1,6 +1,7 @@
 import { type ContainerWriterProjectionResponse, type DocumentCreateResponse } from "../../../internal/validators/response/index.js";
 import type { CreateRemoteDocumentResult, DocumentCreateApi, DocumentCreateAuthor, MaterializedDocumentCreatePlan, ProjectionVerificationOptions } from "../../../data/documents/shared/types.js";
 import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { PendingUpdateRecord } from "../../../data/sqlite/documentPersistence/index.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import type { DocumentCreateTerminalFailureHandler } from "./createProjectionFetch.js";
 export declare function buildMaterializedDocumentCreatePlan(input: {
@@ -37,6 +38,12 @@ interface RemoteDocumentCreateInput {
      */
     onTerminalSubmitFailure?: DocumentCreateTerminalFailureHandler | undefined;
     resolveProjectionUserKey: ProjectionUserKeyResolver;
+    /**
+     * The queued row holding the new document's whole content (see
+     * `documentCreateSeedCandidate`). The create commits it as its seed, and the
+     * caller settles the row from the response instead of syncing it.
+     */
+    seedUpdate?: PendingUpdateRecord | undefined;
     signedAt?: string | undefined;
     stillCurrent?: (() => boolean) | undefined;
     targetSecretKey: Uint8Array;

package/workflows/documents/create/index.js

@@ -6,6 +6,7 @@ import { projectionVerificationOptions } from "../../../data/documents/shared/ty
 import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { isContainerCreatePending } from "../../../data/persistence/container-contents/pendingContainerCreate.js";
 import { recordDocumentAuthorAccessFailure } from "../authorAccessFailure.js";
+import { buildDocumentCreateSeedRequest, documentCreateSeedFits, } from "../sync/initialSync.js";
 import { isDocumentManifestAlreadyExistsConflict, shouldRetryWithFreshProjection, } from "../syncFailures/syncFailureClassification.js";
 import { adoptExistingRemoteDocument } from "./createAdoption.js";
 import { fetchContainerWriterProjectionForCreate } from "./createProjectionFetch.js";
@@ -119,6 +120,39 @@ async function buildMaterializedDocumentCreatePlanWithFreshProjection(input) {
     });
     return refreshedProjection ? buildWithProjection(refreshedProjection) : null;
 }
+/**
+ * A seed only saves the first sync. A refusal of the seeded create falls back
+ * to the plain create once, so the row syncs as before and seeding adds no
+ * failure mode. A lost response is adopted, and a stale target is replanned
+ * with a fresh seed, exactly as for a plain create. Building the seed awaits
+ * its encryption, so each submission rechecks the caller is still current and
+ * returns null instead of creating a document whose response would be dropped.
+ */
+async function submitPlannedDocumentCreateRequest(input, createPlan) {
+    const request = createPlan.materializedPlan.plan.request;
+    const organizationId = createPlan.containerProjection.organizationId;
+    const seed = input.seedUpdate
+        ? await buildDocumentCreateSeedRequest({
+            author: input.author,
+            containerProjection: createPlan.containerProjection,
+            materializedDocument: createPlan.materializedPlan,
+            pendingUpdate: input.seedUpdate,
+        })
+        : null;
+    if (seed && documentCreateSeedFits(seed)) {
+        if (input.stillCurrent?.() === false)
+            return null;
+        const seeded = await submitDocumentCreate(input.apiClient, { ...request, initialSync: seed }, organizationId);
+        if (seeded.ok ||
+            isDocumentManifestAlreadyExistsConflict(seeded) ||
+            isStaleDocumentCreateTargetConflict(seeded)) {
+            return seeded;
+        }
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    return submitDocumentCreate(input.apiClient, request, organizationId);
+}
 function isRemoteDocumentCreatePlanBlocked(input, createPlan) {
     const organizationId = createPlan.containerProjection.organizationId;
     return input.isRemoteSyncBlocked?.(organizationId) ?? false;
@@ -152,7 +186,9 @@ async function submitPlannedDocumentCreate(input, resolveProjectionUserKey) {
         return null;
     if (input.stillCurrent?.() === false)
         return null;
-    let submission = await submitDocumentCreate(input.apiClient, createPlan.materializedPlan.plan.request, createPlan.containerProjection.organizationId);
+    let submission = await submitPlannedDocumentCreateRequest(input, createPlan);
+    if (!submission)
+        return null;
     if (isStaleDocumentCreateTargetConflict(submission)) {
         if (input.stillCurrent?.() === false) {
             return { createPlan, submission };
@@ -185,7 +221,9 @@ async function submitPlannedDocumentCreate(input, resolveProjectionUserKey) {
         createPlan = refreshedPlan;
         if (input.stillCurrent?.() === false)
             return null;
-        submission = await submitDocumentCreate(input.apiClient, createPlan.materializedPlan.plan.request, createPlan.containerProjection.organizationId);
+        submission = await submitPlannedDocumentCreateRequest(input, createPlan);
+        if (!submission)
+            return null;
     }
     return { createPlan, submission };
 }