@tearleads/client-sdk 0.1.73 → 0.1.75

package/client/organizations/principalContainerMutations.js

@@ -1,5 +1,5 @@
+import { preparePrincipalContainerRematerializationBatch, } from "../../workflows/containers/rematerialization/index.js";
 import { resolveDocumentCreateAuthor } from "../../workflows/documents/index.js";
-import { preparePrincipalContainerRematerializationBatch, } from "../../workflows/organizations/rematerialization/principalContainerRematerialization.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 export async function preparePrincipalContainerMutations(input) {
     const author = resolveDocumentCreateAuthor(input.runtime);

package/client/organizations/principalContainerMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/rematerialization/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/rematerialization/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    preceding: input.preceding,\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}
+{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,+CAA+C,GAChD,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  type PrincipalRematerializationPredecessor,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/containers/rematerialization\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    preceding: input.preceding,\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/stores/documents/documentStore/sync/index.js

@@ -127,7 +127,7 @@ async function syncDocumentState(state, currentDoc, nextRecord, encapsulationKey
         return nextRemoteRecord;
     }
     // Pre-register the IDs we are about to send so the author's OWN
-    // `document_update_created` echo (fanned back over redis) is classified as
+    // `document_update_created` echo (fanned back over realtime) is classified as
     // self-authored and never re-arms a redundant sync. Registering BEFORE the
     // network await closes the race where the echo lands before
     // finalizeDocumentSync records the accepted IDs — the gap that turned every

package/stores/documents/documentStore/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAGL,0BAA0B,EAE1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAKL,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,0BAA0B,IAAI,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,4CAA4C,GAC7C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,4CAA4C,EAC5C,wCAAwC,EACxC,kCAAkC,EAGlC,gCAAgC,EAChC,oCAAoC,EACpC,wCAAwC,GACzC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,cAAc,CAAC;AAEtB,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO;IACL,yDAAyD;IACzD,kEAAkE;IAClE,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,KAAK,CAAC,GAAG,KAAK,IAAI;QAClB,KAAK,CAAC,QAAQ,CAAC,KAAK;QACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,IAAI;QAClD,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAO3C;IAIC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,6BAA6B,CAC1E,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,sCAAsC,CAC9D,KAAK,CAAC,KAAK,EACX,aAAa,EACb,GAAG,EAAE,CACH,yBAAyB,CAAC;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,6BAA6B,EAAE,CAAC,SAAS,EAAE,EAAE,CAC3C,4CAA4C,CAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,SAAS,CACV;QACH,cAAc,EAAE,eAAe;QAC/B,iBAAiB;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,2BAA2B,EACzB,oEAAoE;KACvE,CAAC,CACL,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAqC;IAKrC,OAAO;QACL,eAAe,EAAE,cAAc;QAC/B,iBAAiB,EAAE,cAAc,CAAC,MAAM;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsB,EACtB,kBAA0B;IAE1B,OAAO,CACL,kBAAkB,KAAK,CAAC;QACxB,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1C,CAAC,MAAM,CAAC,gCAAgC,CACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAuC;IAEvC,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,6BAA6B,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAClE,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACjD,IAAI,cAAc,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,qBAAqB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;QACpC,CAAC;QACD,IAAI,qBAAqB;YAAE,OAAO,UAAU,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,6BAA6B;QAC7B,UAAU;QACV,oBAAoB;QACpB,UAAU;QACV,UAAU;QACV,cAAc;QACd,KAAK;KACN,CAAC,CAAC;IACH,IAAI,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACxC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,UAAU;QAAE,OAAO,UAAU,CAAC;IAErD,MAAM,gBAAgB,GAAG,MAAM,+BAA+B,CAAC;QAC7D,UAAU;QACV,UAAU;QACV,cAAc;QACd,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAC1C,CAAC;IACD,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC3C,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;IAEjD,IACE,oCAAoC,CAAC;QACnC,aAAa,EAAE,gBAAgB;QAC/B,cAAc;QACd,KAAK;KACN,CAAC,EACF,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,gEAAgE;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACxE,UAAU;QACV,oBAAoB;QACpB,UAAU;QACV,cAAc;QACd,MAAM,EAAE,gBAAgB;QACxB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACtC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,sCAAsC,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CACvE,oBAAoB,CAClB,KAAK,EACL,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,6BAA6B,EAC7B,UAAU,EACV,aAAa,EACb,cAAc,CACf,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAuC;IAEvC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,6BAA6B,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAClE,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;QAClD,KAAK;QACL,UAAU;QACV,aAAa,EAAE,UAAU;QACzB,oBAAoB;QACpB,UAAU;QACV,cAAc,EAAE,EAAE;QAClB,2BAA2B,EACzB,2FAA2F;KAC9F,CAAC,CAAC;IACH,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACtC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAChD,KAAK,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,6BAA6B,EAC7B,UAAU,EACV,EAAE,EACF,cAAc,CACf,CAAC;IACF,OAAO;QACL,kBAAkB,EAChB,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB;YACrC,eAAe,CAAC,gBAAgB,IAAI,IAAI;YACxC,eAAe,CAAC,gCAAgC,KAAK,IAAI;YACzD,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;QACzD,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAyB,EACzB,kBAAmD;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC7B,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACvE,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;IAE9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,wCAAwC,CACzD,KAAK,EACL,UAAU,EACV,kBAAkB,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,4CAA4C,CACvE,KAAK,EACL,UAAU,EACV,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACzC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,yCAAyC,CAClE,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;IACF,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,KAAK,EACL,UAAU,EACV,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC;IACzC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,wDAAwD;IAExD,UAAU,GAAG,MAAM,iBAAiB,CAClC,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;IAEF,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAExC,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,iCAAiC,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,8BAA8B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAyB,EACzB,kBAAmD;IAEnD,IAAI,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,OAAO;YACnD,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,eAAe;SAC3B,CACF,CAAC;QAEF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAyB,EACzB,kBAAmD;IAEnD,MAAM,iBAAiB,GAAG,kCAAkC,CAC1D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,IACE,iBAAiB;YACjB,oCAAoC,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAC9D,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EACnE,CAAC;YACD,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAyB,EACzB,qBAAmE;IAEnE,OAAO,wBAAwB,CAAC;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,GAAG,EAAE,CACb,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,MAAM,EAAE,kBAAkB,KAAK,EAAE;YAClE,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3B,yEAAyE;YACzE,8DAA8D;YAC9D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7C,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;YACnD,IAAI,CAAC,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,qEAAqE;gBACrE,uEAAuE;gBACvE,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;oBACxB,IACE,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EACnE,CAAC;wBACD,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,CACvC,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC;gBACjE,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CACtB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../../../data/keyingProjectionVerification/error\";\nimport {\n  type DocumentRecord,\n  type DocumentSyncLane,\n  isDatabaseUnavailableError,\n  type PendingUpdateRecord,\n  registerDocumentSyncLane,\n  resolveDocumentCreateAuthor,\n} from \"../../../../workflows/documents\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport { awaitInitializationForSync } from \"../initialization\";\nimport { listPendingUpdates } from \"../persistence\";\nimport {\n  type DocumentState,\n  type DocumentStoreState,\n  type DocumentSyncAttempt,\n  type EncapsulationKeyPair,\n  setDocumentSyncing,\n} from \"../state\";\nimport { logRevalidationUnavailable as logUnavailable } from \"./remoteRevalidationTelemetry\";\nimport {\n  getActiveDocumentRemoteWork,\n  runDocumentRemoteWork,\n} from \"./remoteWork\";\nimport {\n  cleanupPreRegisteredUpdateIdsOnFailure,\n  discardPreRegisteredUpdateIds,\n  preRegisterMaterializedDocumentSyncUpdateIds,\n} from \"./syncAcceptedUpdateIds\";\nimport { syncPendingAttachments } from \"./syncAttachments\";\nimport { syncDetachedAttachmentBindings } from \"./syncDetachedAttachments\";\nimport { finalizeDocumentSync } from \"./syncFinalize\";\nimport {\n  captureDocumentStoreAttachmentSyncGeneration,\n  captureDocumentStoreRemoteSyncGeneration,\n  captureDocumentStoreSyncGeneration,\n  type DocumentStoreSyncGeneration,\n  type DocumentStoreSyncLaneGeneration,\n  isDocumentStoreRemoteSyncBlocked,\n  isDocumentStoreSyncGenerationCurrent,\n  isDocumentStoreSyncLaneGenerationCurrent,\n} from \"./syncGeneration\";\nimport { prepareDocumentOutgoingCoverage } from \"./syncOutgoingCoverage\";\nimport { requestRemoteDocumentSync } from \"./syncRequest\";\nimport { ensureSeededRemoteDocument } from \"./syncSeededCreate\";\nimport {\n  isContainerAwaitingRemoteCreate,\n  shouldSkipCleanScheduledDocumentSync,\n} from \"./syncShared\";\n\nfunction canRunScheduledSync(state: DocumentStoreState): boolean {\n  return (\n    // A deferred birth waits for its attach to carry it (see\n    // deferredInitialUpdate.ts); a pass now would ship it on its own.\n    state.deferInitialUpdate !== true &&\n    state.doc !== null &&\n    state.snapshot.ready &&\n    state.runtime.state.online &&\n    state.runtime.auth.isAuthenticated &&\n    state.runtime.crypto.encapsulationKeyPair !== null &&\n    resolveDocumentCreateAuthor(state.runtime) !== null\n  );\n}\n\nasync function requestOutgoingDocumentBatch(input: {\n  readonly currentDoc: DocumentState;\n  readonly encapsulationKeyPair: EncapsulationKeyPair;\n  readonly generation: DocumentStoreSyncGeneration;\n  readonly pendingUpdates: PendingUpdateRecord[];\n  readonly record: DocumentRecord;\n  readonly state: DocumentStoreState;\n}): Promise<{\n  sentUpdateIds: string[];\n  syncAttempt: DocumentSyncAttempt | null;\n}> {\n  const { planningUpdates, queuedUpdateCount } = prepareDocumentStoreSyncQueue(\n    input.pendingUpdates,\n  );\n  const sentUpdateIds: string[] = [];\n  const syncAttempt = await cleanupPreRegisteredUpdateIdsOnFailure(\n    input.state,\n    sentUpdateIds,\n    () =>\n      requestRemoteDocumentSync({\n        currentDoc: input.currentDoc,\n        currentRecord: input.record,\n        encapsulationKeyPair: input.encapsulationKeyPair,\n        generation: input.generation,\n        onOutgoingUpdatesMaterialized: (updateIds) =>\n          preRegisterMaterializedDocumentSyncUpdateIds(\n            input.state,\n            sentUpdateIds,\n            updateIds,\n          ),\n        pendingUpdates: planningUpdates,\n        queuedUpdateCount,\n        state: input.state,\n        unavailableWriterLogMessage:\n          \"Documents: skipped sync because the writer context is unavailable.\",\n      }),\n  );\n  return { sentUpdateIds, syncAttempt };\n}\n\n/**\n * Keep the full durable queue visible to stale-heal/checkpoint classification.\n * The workflow planner owns the final count and byte bounds, and the exact\n * materialized batch is pre-registered immediately before each submit.\n */\nexport function prepareDocumentStoreSyncQueue(\n  pendingUpdates: PendingUpdateRecord[],\n): {\n  planningUpdates: PendingUpdateRecord[];\n  queuedUpdateCount: number;\n} {\n  return {\n    planningUpdates: pendingUpdates,\n    queuedUpdateCount: pendingUpdates.length,\n  };\n}\n\nexport function canSyncDetachedAttachmentBindings(\n  record: DocumentRecord,\n  pendingUpdateCount: number,\n): boolean {\n  return (\n    pendingUpdateCount === 0 &&\n    (record.pullContinuation ?? null) === null &&\n    !record.pullContinuationRecoveryRequired\n  );\n}\n\nasync function syncDocumentState(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  nextRecord: DocumentRecord,\n  encapsulationKeyPair: EncapsulationKeyPair,\n  generation: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord> {\n  // Snapshot the remote-update signal sequence before any await. The GET below\n  // fetches server state as of its own snapshot; any remote event delivered\n  // after this point describes an update that may not be in that response, so\n  // finalizeDocumentSync must not clear the signal if this sequence has moved.\n  const consumedRemoteUpdateSignalSeq = state.remoteUpdateSignalSeq;\n  const wasRemoteProbe = state.remoteUpdatePending;\n  let pendingUpdates = await listPendingUpdates(state);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n  if (pendingUpdates.length === 0 && isDocumentStoreRemoteSyncBlocked(state)) {\n    return nextRecord;\n  }\n  // Create the remote document even when nothing is queued to send: a note\n  // created and never edited enqueues no updates, but its local row is still a\n  // pending create the write queue reports — it must flush, not sit. Defer\n  // while the container itself still awaits its remote create — with OR\n  // without queued edits, since the create cannot succeed before its parent\n  // exists and attempting it just records a spurious failure. The structural\n  // lane primes this store again as soon as the container create lands.\n  if (!nextRecord.documentId) {\n    const containerAwaitsCreate = await isContainerAwaitingRemoteCreate(state);\n    if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n      requestDocumentStoreSync(state);\n      return state.record ?? nextRecord;\n    }\n    if (containerAwaitsCreate) return nextRecord;\n  }\n  const created = await ensureSeededRemoteDocument({\n    consumedRemoteUpdateSignalSeq,\n    currentDoc,\n    encapsulationKeyPair,\n    generation,\n    nextRecord,\n    pendingUpdates,\n    state,\n  });\n  let nextRemoteRecord = created.record;\n  pendingUpdates = created.pendingUpdates;\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n  if (!nextRemoteRecord?.documentId) return nextRecord;\n\n  const preparedCoverage = await prepareDocumentOutgoingCoverage({\n    currentDoc,\n    generation,\n    pendingUpdates,\n    state,\n  });\n  if (!preparedCoverage) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRemoteRecord;\n  }\n  nextRemoteRecord = preparedCoverage.record;\n  pendingUpdates = preparedCoverage.pendingUpdates;\n\n  if (\n    shouldSkipCleanScheduledDocumentSync({\n      currentRecord: nextRemoteRecord,\n      pendingUpdates,\n      state,\n    })\n  ) {\n    return nextRemoteRecord;\n  }\n\n  // Pre-register the IDs we are about to send so the author's OWN\n  // `document_update_created` echo (fanned back over redis) is classified as\n  // self-authored and never re-arms a redundant sync. Registering BEFORE the\n  // network await closes the race where the echo lands before\n  // finalizeDocumentSync records the accepted IDs — the gap that turned every\n  // fast keystroke into an extra self-triggered sync.\n  const { sentUpdateIds, syncAttempt } = await requestOutgoingDocumentBatch({\n    currentDoc,\n    encapsulationKeyPair,\n    generation,\n    pendingUpdates,\n    record: nextRemoteRecord,\n    state,\n  });\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRemoteRecord;\n  }\n  if (!syncAttempt) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    logUnavailable(state, wasRemoteProbe);\n    return nextRemoteRecord;\n  }\n\n  return cleanupPreRegisteredUpdateIdsOnFailure(state, sentUpdateIds, () =>\n    finalizeDocumentSync(\n      state,\n      currentDoc,\n      nextRemoteRecord,\n      syncAttempt,\n      consumedRemoteUpdateSignalSeq,\n      generation,\n      sentUpdateIds,\n      wasRemoteProbe,\n    ),\n  );\n}\n\nasync function revalidateRemoteDocumentBeforeAttachments(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  nextRecord: DocumentRecord,\n  encapsulationKeyPair: EncapsulationKeyPair,\n  generation: DocumentStoreSyncGeneration,\n): Promise<{ canSyncAttachments: boolean; nextRecord: DocumentRecord }> {\n  if (state.pendingAttachments.length === 0 || !nextRecord.documentId) {\n    return { canSyncAttachments: true, nextRecord };\n  }\n\n  const consumedRemoteUpdateSignalSeq = state.remoteUpdateSignalSeq;\n  const wasRemoteProbe = state.remoteUpdatePending;\n  const syncAttempt = await requestRemoteDocumentSync({\n    state,\n    currentDoc,\n    currentRecord: nextRecord,\n    encapsulationKeyPair,\n    generation,\n    pendingUpdates: [],\n    unavailableWriterLogMessage:\n      \"Documents: skipped pre-attachment revalidation because the writer context is unavailable.\",\n  });\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return { canSyncAttachments: false, nextRecord };\n  }\n  if (!syncAttempt) {\n    logUnavailable(state, wasRemoteProbe);\n    return { canSyncAttachments: false, nextRecord };\n  }\n\n  const refreshedRecord = await finalizeDocumentSync(\n    state,\n    currentDoc,\n    nextRecord,\n    syncAttempt,\n    consumedRemoteUpdateSignalSeq,\n    generation,\n    [],\n    wasRemoteProbe,\n  );\n  return {\n    canSyncAttachments:\n      !syncAttempt.synced.hasIncompletePull &&\n      refreshedRecord.pullContinuation == null &&\n      refreshedRecord.pullContinuationRecoveryRequired !== true &&\n      isDocumentStoreSyncGenerationCurrent(state, generation),\n    nextRecord: refreshedRecord,\n  };\n}\n\nasync function runDocumentSyncPass(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  const currentDoc = state.doc;\n  const encapsulationKeyPair = state.runtime.crypto.encapsulationKeyPair;\n  let nextRecord = state.record;\n\n  if (!currentDoc || !nextRecord || !encapsulationKeyPair) {\n    return;\n  }\n\n  const generation = captureDocumentStoreRemoteSyncGeneration(\n    state,\n    currentDoc,\n    syncLaneGeneration,\n  );\n  const attachmentGeneration = captureDocumentStoreAttachmentSyncGeneration(\n    state,\n    currentDoc,\n    syncLaneGeneration,\n  );\n  if (!generation || !attachmentGeneration) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n\n  const revalidation = await revalidateRemoteDocumentBeforeAttachments(\n    state,\n    currentDoc,\n    nextRecord,\n    encapsulationKeyPair,\n    generation,\n  );\n  nextRecord = revalidation.nextRecord;\n  if (!revalidation.canSyncAttachments) {\n    return;\n  }\n\n  const attachmentResult = await syncPendingAttachments(\n    state,\n    nextRecord,\n    encapsulationKeyPair,\n    attachmentGeneration,\n  );\n  nextRecord = attachmentResult.nextRecord;\n  if (state.pendingAttachments.length > 0) {\n    return;\n  }\n  // A settled bind and the content update carrying its digest are two server\n  // writes. Push the content in this same pass rather than re-arming a later\n  // one, so a device lost between them is the only remaining window: peers\n  // otherwise see the old digest against the new binding.\n\n  nextRecord = await syncDocumentState(\n    state,\n    currentDoc,\n    nextRecord,\n    encapsulationKeyPair,\n    generation,\n  );\n\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n\n  if (!state.doc || !state.record) return;\n\n  const pendingUpdates = await listPendingUpdates(state);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n  if (!canSyncDetachedAttachmentBindings(nextRecord, pendingUpdates.length)) {\n    return;\n  }\n\n  await syncDetachedAttachmentBindings(state, nextRecord, generation);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n  }\n}\n\nasync function runScheduledSyncIteration(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  if (!(await awaitInitializationForSync(state))) {\n    return false;\n  }\n  if (!isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)) {\n    return true;\n  }\n\n  if (!canRunScheduledSync(state)) {\n    return true;\n  }\n\n  try {\n    await runDocumentSyncPass(state, syncLaneGeneration);\n    return true;\n  } catch (error) {\n    if (isDatabaseUnavailableError(error)) {\n      return false;\n    }\n\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      state.runtime.util.reportSecurityIncident,\n      {\n        objectId: state.record?.documentId ?? state.localId,\n        objectKind: \"document\",\n        operation: \"document.sync\",\n      },\n    );\n\n    throw error;\n  }\n}\n\nasync function runScheduledSyncLoop(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  const syncingGeneration = captureDocumentStoreSyncGeneration(\n    state,\n    state.doc,\n  );\n  setDocumentSyncing(state, true);\n\n  try {\n    await runScheduledSyncIteration(state, syncLaneGeneration);\n  } finally {\n    if (\n      syncingGeneration &&\n      isDocumentStoreSyncGenerationCurrent(state, syncingGeneration) &&\n      isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n    ) {\n      setDocumentSyncing(state, false);\n    }\n  }\n}\n\nexport function registerDocumentStoreSyncLane(\n  state: DocumentStoreState,\n  getSyncLaneGeneration: () => DocumentStoreSyncLaneGeneration | null,\n): DocumentSyncLane {\n  return registerDocumentSyncLane({\n    domainScope: state.runtime.state.domainScope,\n    localId: state.localId,\n    priority: () =>\n      state.remoteUpdatePending || state.record?.snapshotEndVersion === \"\"\n        ? -1\n        : 0,\n    logError: (message, error) => {\n      // Read the runtime lazily: a store's runtime is replaced in place, and a\n      // reference captured here would report into a torn-down host.\n      const { log, logError } = state.runtime.util;\n      // Return the host's result: both callbacks are declared `=> void` but may\n      // be async, and the lane reporter only catches a rejection it is handed.\n      return logError ? logError(message, error) : log(message);\n    },\n    run: () => {\n      const syncLaneGeneration = getSyncLaneGeneration();\n      if (!syncLaneGeneration) return Promise.resolve();\n      const activeWork = getActiveDocumentRemoteWork(state);\n      if (activeWork) {\n        // Re-arm on settlement, not immediately: immediate re-requests would\n        // spin this lane and starve other work while the HTTP request is held.\n        void activeWork.then(() => {\n          if (\n            isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n          ) {\n            requestDocumentStoreSync(state);\n          }\n        });\n        return Promise.resolve();\n      }\n      return runDocumentRemoteWork(state, () =>\n        isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n          ? runScheduledSyncLoop(state, syncLaneGeneration)\n          : Promise.resolve(),\n      );\n    },\n  });\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAGL,0BAA0B,EAE1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAKL,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,0BAA0B,IAAI,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,4CAA4C,GAC7C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,4CAA4C,EAC5C,wCAAwC,EACxC,kCAAkC,EAGlC,gCAAgC,EAChC,oCAAoC,EACpC,wCAAwC,GACzC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,cAAc,CAAC;AAEtB,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO;IACL,yDAAyD;IACzD,kEAAkE;IAClE,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,KAAK,CAAC,GAAG,KAAK,IAAI;QAClB,KAAK,CAAC,QAAQ,CAAC,KAAK;QACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,IAAI;QAClD,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAO3C;IAIC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,6BAA6B,CAC1E,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,sCAAsC,CAC9D,KAAK,CAAC,KAAK,EACX,aAAa,EACb,GAAG,EAAE,CACH,yBAAyB,CAAC;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,6BAA6B,EAAE,CAAC,SAAS,EAAE,EAAE,CAC3C,4CAA4C,CAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,SAAS,CACV;QACH,cAAc,EAAE,eAAe;QAC/B,iBAAiB;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,2BAA2B,EACzB,oEAAoE;KACvE,CAAC,CACL,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAqC;IAKrC,OAAO;QACL,eAAe,EAAE,cAAc;QAC/B,iBAAiB,EAAE,cAAc,CAAC,MAAM;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsB,EACtB,kBAA0B;IAE1B,OAAO,CACL,kBAAkB,KAAK,CAAC;QACxB,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1C,CAAC,MAAM,CAAC,gCAAgC,CACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAuC;IAEvC,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,6BAA6B,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAClE,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACjD,IAAI,cAAc,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,qBAAqB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;QACpC,CAAC;QACD,IAAI,qBAAqB;YAAE,OAAO,UAAU,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,6BAA6B;QAC7B,UAAU;QACV,oBAAoB;QACpB,UAAU;QACV,UAAU;QACV,cAAc;QACd,KAAK;KACN,CAAC,CAAC;IACH,IAAI,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACxC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,UAAU;QAAE,OAAO,UAAU,CAAC;IAErD,MAAM,gBAAgB,GAAG,MAAM,+BAA+B,CAAC;QAC7D,UAAU;QACV,UAAU;QACV,cAAc;QACd,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAC1C,CAAC;IACD,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC3C,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;IAEjD,IACE,oCAAoC,CAAC;QACnC,aAAa,EAAE,gBAAgB;QAC/B,cAAc;QACd,KAAK;KACN,CAAC,EACF,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,gEAAgE;IAChE,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACxE,UAAU;QACV,oBAAoB;QACpB,UAAU;QACV,cAAc;QACd,MAAM,EAAE,gBAAgB;QACxB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACtC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,sCAAsC,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CACvE,oBAAoB,CAClB,KAAK,EACL,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,6BAA6B,EAC7B,UAAU,EACV,aAAa,EACb,cAAc,CACf,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAuC;IAEvC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,6BAA6B,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAClE,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;QAClD,KAAK;QACL,UAAU;QACV,aAAa,EAAE,UAAU;QACzB,oBAAoB;QACpB,UAAU;QACV,cAAc,EAAE,EAAE;QAClB,2BAA2B,EACzB,2FAA2F;KAC9F,CAAC,CAAC;IACH,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACtC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAChD,KAAK,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,6BAA6B,EAC7B,UAAU,EACV,EAAE,EACF,cAAc,CACf,CAAC;IACF,OAAO;QACL,kBAAkB,EAChB,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB;YACrC,eAAe,CAAC,gBAAgB,IAAI,IAAI;YACxC,eAAe,CAAC,gCAAgC,KAAK,IAAI;YACzD,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;QACzD,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAyB,EACzB,kBAAmD;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC7B,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACvE,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;IAE9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,wCAAwC,CACzD,KAAK,EACL,UAAU,EACV,kBAAkB,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,4CAA4C,CACvE,KAAK,EACL,UAAU,EACV,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACzC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,yCAAyC,CAClE,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;IACF,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,KAAK,EACL,UAAU,EACV,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC;IACzC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,wDAAwD;IAExD,UAAU,GAAG,MAAM,iBAAiB,CAClC,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;IAEF,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAExC,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,iCAAiC,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,8BAA8B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAyB,EACzB,kBAAmD;IAEnD,IAAI,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,OAAO;YACnD,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,eAAe;SAC3B,CACF,CAAC;QAEF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAyB,EACzB,kBAAmD;IAEnD,MAAM,iBAAiB,GAAG,kCAAkC,CAC1D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,IACE,iBAAiB;YACjB,oCAAoC,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAC9D,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EACnE,CAAC;YACD,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAyB,EACzB,qBAAmE;IAEnE,OAAO,wBAAwB,CAAC;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,GAAG,EAAE,CACb,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,MAAM,EAAE,kBAAkB,KAAK,EAAE;YAClE,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3B,yEAAyE;YACzE,8DAA8D;YAC9D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7C,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;YACnD,IAAI,CAAC,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,qEAAqE;gBACrE,uEAAuE;gBACvE,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;oBACxB,IACE,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EACnE,CAAC;wBACD,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,CACvC,wCAAwC,CAAC,KAAK,EAAE,kBAAkB,CAAC;gBACjE,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CACtB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../../../data/keyingProjectionVerification/error\";\nimport {\n  type DocumentRecord,\n  type DocumentSyncLane,\n  isDatabaseUnavailableError,\n  type PendingUpdateRecord,\n  registerDocumentSyncLane,\n  resolveDocumentCreateAuthor,\n} from \"../../../../workflows/documents\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport { awaitInitializationForSync } from \"../initialization\";\nimport { listPendingUpdates } from \"../persistence\";\nimport {\n  type DocumentState,\n  type DocumentStoreState,\n  type DocumentSyncAttempt,\n  type EncapsulationKeyPair,\n  setDocumentSyncing,\n} from \"../state\";\nimport { logRevalidationUnavailable as logUnavailable } from \"./remoteRevalidationTelemetry\";\nimport {\n  getActiveDocumentRemoteWork,\n  runDocumentRemoteWork,\n} from \"./remoteWork\";\nimport {\n  cleanupPreRegisteredUpdateIdsOnFailure,\n  discardPreRegisteredUpdateIds,\n  preRegisterMaterializedDocumentSyncUpdateIds,\n} from \"./syncAcceptedUpdateIds\";\nimport { syncPendingAttachments } from \"./syncAttachments\";\nimport { syncDetachedAttachmentBindings } from \"./syncDetachedAttachments\";\nimport { finalizeDocumentSync } from \"./syncFinalize\";\nimport {\n  captureDocumentStoreAttachmentSyncGeneration,\n  captureDocumentStoreRemoteSyncGeneration,\n  captureDocumentStoreSyncGeneration,\n  type DocumentStoreSyncGeneration,\n  type DocumentStoreSyncLaneGeneration,\n  isDocumentStoreRemoteSyncBlocked,\n  isDocumentStoreSyncGenerationCurrent,\n  isDocumentStoreSyncLaneGenerationCurrent,\n} from \"./syncGeneration\";\nimport { prepareDocumentOutgoingCoverage } from \"./syncOutgoingCoverage\";\nimport { requestRemoteDocumentSync } from \"./syncRequest\";\nimport { ensureSeededRemoteDocument } from \"./syncSeededCreate\";\nimport {\n  isContainerAwaitingRemoteCreate,\n  shouldSkipCleanScheduledDocumentSync,\n} from \"./syncShared\";\n\nfunction canRunScheduledSync(state: DocumentStoreState): boolean {\n  return (\n    // A deferred birth waits for its attach to carry it (see\n    // deferredInitialUpdate.ts); a pass now would ship it on its own.\n    state.deferInitialUpdate !== true &&\n    state.doc !== null &&\n    state.snapshot.ready &&\n    state.runtime.state.online &&\n    state.runtime.auth.isAuthenticated &&\n    state.runtime.crypto.encapsulationKeyPair !== null &&\n    resolveDocumentCreateAuthor(state.runtime) !== null\n  );\n}\n\nasync function requestOutgoingDocumentBatch(input: {\n  readonly currentDoc: DocumentState;\n  readonly encapsulationKeyPair: EncapsulationKeyPair;\n  readonly generation: DocumentStoreSyncGeneration;\n  readonly pendingUpdates: PendingUpdateRecord[];\n  readonly record: DocumentRecord;\n  readonly state: DocumentStoreState;\n}): Promise<{\n  sentUpdateIds: string[];\n  syncAttempt: DocumentSyncAttempt | null;\n}> {\n  const { planningUpdates, queuedUpdateCount } = prepareDocumentStoreSyncQueue(\n    input.pendingUpdates,\n  );\n  const sentUpdateIds: string[] = [];\n  const syncAttempt = await cleanupPreRegisteredUpdateIdsOnFailure(\n    input.state,\n    sentUpdateIds,\n    () =>\n      requestRemoteDocumentSync({\n        currentDoc: input.currentDoc,\n        currentRecord: input.record,\n        encapsulationKeyPair: input.encapsulationKeyPair,\n        generation: input.generation,\n        onOutgoingUpdatesMaterialized: (updateIds) =>\n          preRegisterMaterializedDocumentSyncUpdateIds(\n            input.state,\n            sentUpdateIds,\n            updateIds,\n          ),\n        pendingUpdates: planningUpdates,\n        queuedUpdateCount,\n        state: input.state,\n        unavailableWriterLogMessage:\n          \"Documents: skipped sync because the writer context is unavailable.\",\n      }),\n  );\n  return { sentUpdateIds, syncAttempt };\n}\n\n/**\n * Keep the full durable queue visible to stale-heal/checkpoint classification.\n * The workflow planner owns the final count and byte bounds, and the exact\n * materialized batch is pre-registered immediately before each submit.\n */\nexport function prepareDocumentStoreSyncQueue(\n  pendingUpdates: PendingUpdateRecord[],\n): {\n  planningUpdates: PendingUpdateRecord[];\n  queuedUpdateCount: number;\n} {\n  return {\n    planningUpdates: pendingUpdates,\n    queuedUpdateCount: pendingUpdates.length,\n  };\n}\n\nexport function canSyncDetachedAttachmentBindings(\n  record: DocumentRecord,\n  pendingUpdateCount: number,\n): boolean {\n  return (\n    pendingUpdateCount === 0 &&\n    (record.pullContinuation ?? null) === null &&\n    !record.pullContinuationRecoveryRequired\n  );\n}\n\nasync function syncDocumentState(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  nextRecord: DocumentRecord,\n  encapsulationKeyPair: EncapsulationKeyPair,\n  generation: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord> {\n  // Snapshot the remote-update signal sequence before any await. The GET below\n  // fetches server state as of its own snapshot; any remote event delivered\n  // after this point describes an update that may not be in that response, so\n  // finalizeDocumentSync must not clear the signal if this sequence has moved.\n  const consumedRemoteUpdateSignalSeq = state.remoteUpdateSignalSeq;\n  const wasRemoteProbe = state.remoteUpdatePending;\n  let pendingUpdates = await listPendingUpdates(state);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n  if (pendingUpdates.length === 0 && isDocumentStoreRemoteSyncBlocked(state)) {\n    return nextRecord;\n  }\n  // Create the remote document even when nothing is queued to send: a note\n  // created and never edited enqueues no updates, but its local row is still a\n  // pending create the write queue reports — it must flush, not sit. Defer\n  // while the container itself still awaits its remote create — with OR\n  // without queued edits, since the create cannot succeed before its parent\n  // exists and attempting it just records a spurious failure. The structural\n  // lane primes this store again as soon as the container create lands.\n  if (!nextRecord.documentId) {\n    const containerAwaitsCreate = await isContainerAwaitingRemoteCreate(state);\n    if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n      requestDocumentStoreSync(state);\n      return state.record ?? nextRecord;\n    }\n    if (containerAwaitsCreate) return nextRecord;\n  }\n  const created = await ensureSeededRemoteDocument({\n    consumedRemoteUpdateSignalSeq,\n    currentDoc,\n    encapsulationKeyPair,\n    generation,\n    nextRecord,\n    pendingUpdates,\n    state,\n  });\n  let nextRemoteRecord = created.record;\n  pendingUpdates = created.pendingUpdates;\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n  if (!nextRemoteRecord?.documentId) return nextRecord;\n\n  const preparedCoverage = await prepareDocumentOutgoingCoverage({\n    currentDoc,\n    generation,\n    pendingUpdates,\n    state,\n  });\n  if (!preparedCoverage) {\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRemoteRecord;\n  }\n  nextRemoteRecord = preparedCoverage.record;\n  pendingUpdates = preparedCoverage.pendingUpdates;\n\n  if (\n    shouldSkipCleanScheduledDocumentSync({\n      currentRecord: nextRemoteRecord,\n      pendingUpdates,\n      state,\n    })\n  ) {\n    return nextRemoteRecord;\n  }\n\n  // Pre-register the IDs we are about to send so the author's OWN\n  // `document_update_created` echo (fanned back over realtime) is classified as\n  // self-authored and never re-arms a redundant sync. Registering BEFORE the\n  // network await closes the race where the echo lands before\n  // finalizeDocumentSync records the accepted IDs — the gap that turned every\n  // fast keystroke into an extra self-triggered sync.\n  const { sentUpdateIds, syncAttempt } = await requestOutgoingDocumentBatch({\n    currentDoc,\n    encapsulationKeyPair,\n    generation,\n    pendingUpdates,\n    record: nextRemoteRecord,\n    state,\n  });\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRemoteRecord;\n  }\n  if (!syncAttempt) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    logUnavailable(state, wasRemoteProbe);\n    return nextRemoteRecord;\n  }\n\n  return cleanupPreRegisteredUpdateIdsOnFailure(state, sentUpdateIds, () =>\n    finalizeDocumentSync(\n      state,\n      currentDoc,\n      nextRemoteRecord,\n      syncAttempt,\n      consumedRemoteUpdateSignalSeq,\n      generation,\n      sentUpdateIds,\n      wasRemoteProbe,\n    ),\n  );\n}\n\nasync function revalidateRemoteDocumentBeforeAttachments(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  nextRecord: DocumentRecord,\n  encapsulationKeyPair: EncapsulationKeyPair,\n  generation: DocumentStoreSyncGeneration,\n): Promise<{ canSyncAttachments: boolean; nextRecord: DocumentRecord }> {\n  if (state.pendingAttachments.length === 0 || !nextRecord.documentId) {\n    return { canSyncAttachments: true, nextRecord };\n  }\n\n  const consumedRemoteUpdateSignalSeq = state.remoteUpdateSignalSeq;\n  const wasRemoteProbe = state.remoteUpdatePending;\n  const syncAttempt = await requestRemoteDocumentSync({\n    state,\n    currentDoc,\n    currentRecord: nextRecord,\n    encapsulationKeyPair,\n    generation,\n    pendingUpdates: [],\n    unavailableWriterLogMessage:\n      \"Documents: skipped pre-attachment revalidation because the writer context is unavailable.\",\n  });\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return { canSyncAttachments: false, nextRecord };\n  }\n  if (!syncAttempt) {\n    logUnavailable(state, wasRemoteProbe);\n    return { canSyncAttachments: false, nextRecord };\n  }\n\n  const refreshedRecord = await finalizeDocumentSync(\n    state,\n    currentDoc,\n    nextRecord,\n    syncAttempt,\n    consumedRemoteUpdateSignalSeq,\n    generation,\n    [],\n    wasRemoteProbe,\n  );\n  return {\n    canSyncAttachments:\n      !syncAttempt.synced.hasIncompletePull &&\n      refreshedRecord.pullContinuation == null &&\n      refreshedRecord.pullContinuationRecoveryRequired !== true &&\n      isDocumentStoreSyncGenerationCurrent(state, generation),\n    nextRecord: refreshedRecord,\n  };\n}\n\nasync function runDocumentSyncPass(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  const currentDoc = state.doc;\n  const encapsulationKeyPair = state.runtime.crypto.encapsulationKeyPair;\n  let nextRecord = state.record;\n\n  if (!currentDoc || !nextRecord || !encapsulationKeyPair) {\n    return;\n  }\n\n  const generation = captureDocumentStoreRemoteSyncGeneration(\n    state,\n    currentDoc,\n    syncLaneGeneration,\n  );\n  const attachmentGeneration = captureDocumentStoreAttachmentSyncGeneration(\n    state,\n    currentDoc,\n    syncLaneGeneration,\n  );\n  if (!generation || !attachmentGeneration) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n\n  const revalidation = await revalidateRemoteDocumentBeforeAttachments(\n    state,\n    currentDoc,\n    nextRecord,\n    encapsulationKeyPair,\n    generation,\n  );\n  nextRecord = revalidation.nextRecord;\n  if (!revalidation.canSyncAttachments) {\n    return;\n  }\n\n  const attachmentResult = await syncPendingAttachments(\n    state,\n    nextRecord,\n    encapsulationKeyPair,\n    attachmentGeneration,\n  );\n  nextRecord = attachmentResult.nextRecord;\n  if (state.pendingAttachments.length > 0) {\n    return;\n  }\n  // A settled bind and the content update carrying its digest are two server\n  // writes. Push the content in this same pass rather than re-arming a later\n  // one, so a device lost between them is the only remaining window: peers\n  // otherwise see the old digest against the new binding.\n\n  nextRecord = await syncDocumentState(\n    state,\n    currentDoc,\n    nextRecord,\n    encapsulationKeyPair,\n    generation,\n  );\n\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n\n  if (!state.doc || !state.record) return;\n\n  const pendingUpdates = await listPendingUpdates(state);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n    return;\n  }\n  if (!canSyncDetachedAttachmentBindings(nextRecord, pendingUpdates.length)) {\n    return;\n  }\n\n  await syncDetachedAttachmentBindings(state, nextRecord, generation);\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    requestDocumentStoreSync(state);\n  }\n}\n\nasync function runScheduledSyncIteration(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  if (!(await awaitInitializationForSync(state))) {\n    return false;\n  }\n  if (!isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)) {\n    return true;\n  }\n\n  if (!canRunScheduledSync(state)) {\n    return true;\n  }\n\n  try {\n    await runDocumentSyncPass(state, syncLaneGeneration);\n    return true;\n  } catch (error) {\n    if (isDatabaseUnavailableError(error)) {\n      return false;\n    }\n\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      state.runtime.util.reportSecurityIncident,\n      {\n        objectId: state.record?.documentId ?? state.localId,\n        objectKind: \"document\",\n        operation: \"document.sync\",\n      },\n    );\n\n    throw error;\n  }\n}\n\nasync function runScheduledSyncLoop(\n  state: DocumentStoreState,\n  syncLaneGeneration: DocumentStoreSyncLaneGeneration,\n) {\n  const syncingGeneration = captureDocumentStoreSyncGeneration(\n    state,\n    state.doc,\n  );\n  setDocumentSyncing(state, true);\n\n  try {\n    await runScheduledSyncIteration(state, syncLaneGeneration);\n  } finally {\n    if (\n      syncingGeneration &&\n      isDocumentStoreSyncGenerationCurrent(state, syncingGeneration) &&\n      isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n    ) {\n      setDocumentSyncing(state, false);\n    }\n  }\n}\n\nexport function registerDocumentStoreSyncLane(\n  state: DocumentStoreState,\n  getSyncLaneGeneration: () => DocumentStoreSyncLaneGeneration | null,\n): DocumentSyncLane {\n  return registerDocumentSyncLane({\n    domainScope: state.runtime.state.domainScope,\n    localId: state.localId,\n    priority: () =>\n      state.remoteUpdatePending || state.record?.snapshotEndVersion === \"\"\n        ? -1\n        : 0,\n    logError: (message, error) => {\n      // Read the runtime lazily: a store's runtime is replaced in place, and a\n      // reference captured here would report into a torn-down host.\n      const { log, logError } = state.runtime.util;\n      // Return the host's result: both callbacks are declared `=> void` but may\n      // be async, and the lane reporter only catches a rejection it is handed.\n      return logError ? logError(message, error) : log(message);\n    },\n    run: () => {\n      const syncLaneGeneration = getSyncLaneGeneration();\n      if (!syncLaneGeneration) return Promise.resolve();\n      const activeWork = getActiveDocumentRemoteWork(state);\n      if (activeWork) {\n        // Re-arm on settlement, not immediately: immediate re-requests would\n        // spin this lane and starve other work while the HTTP request is held.\n        void activeWork.then(() => {\n          if (\n            isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n          ) {\n            requestDocumentStoreSync(state);\n          }\n        });\n        return Promise.resolve();\n      }\n      return runDocumentRemoteWork(state, () =>\n        isDocumentStoreSyncLaneGenerationCurrent(state, syncLaneGeneration)\n          ? runScheduledSyncLoop(state, syncLaneGeneration)\n          : Promise.resolve(),\n      );\n    },\n  });\n}\n"]}

package/stores/documents/documentStore/sync/syncFinalize.js

@@ -143,11 +143,12 @@ export async function finalizeDocumentSync(state, currentDoc, currentRecord, syn
         requestDocumentStoreSync(state);
         return state.record ?? currentRecord;
     }
-    // The sent IDs were pre-registered as self-authored before the network call so
-    // the redis echo can never beat us. Reconcile against what the server actually
-    // accepted: an ID we sent but the server did not accept will never be echoed,
-    // so drop it to keep locallyAcceptedUpdateIds from leaking. Accepted IDs (a
-    // subset of what we sent) stay registered until their echo consumes them.
+    // The sent IDs were pre-registered as self-authored before the network call
+    // so the realtime echo can never beat us. Reconcile against what the server
+    // actually accepted: an ID we sent but the server did not accept will never
+    // be echoed, so drop it to keep locallyAcceptedUpdateIds from leaking.
+    // Accepted IDs (a subset of what we sent) stay registered until their echo
+    // consumes them.
     discardUnacceptedPreRegisteredUpdateIds(state, sentUpdateIds, synced.response.acceptedOutgoingUpdateIds);
     // Persist on the identity-write chain: synced.persistedState carries this
     // pass's documentId, so it would clobber a relink that landed mid-pass. If

package/stores/documents/documentStore/sync/syncFinalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncFinalize.js","sourceRoot":"","sources":["syncFinalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAEL,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAO9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,sBAAsB,IAAI,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,SAAS,2CAA2C,CAClD,gBAEC,EACD,MAAqC;IAErC,OAAO,CACL,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QAC/C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,eAAe;QAClD,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB;YACnD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB;QACtD,gBAAgB,CAAC,gBAAgB,CAAC,UAAU;YAC1C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU;QAC7C,gBAAgB,CAAC,kBAAkB,CAAC,mBAAmB;YACrD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,mBAAmB;QACxD,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB;YACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,KAAyB,EACzB,MAAqC;IAErC,MAAM,gBAAgB,GACpB,MAAM,CAAC,gBAAgB;QACvB,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU;YAC5D,CAAC,CAAC,KAAK,CAAC,gBAAgB;YACxB,CAAC,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,gBAAgB;QACrB,2CAA2C,CAAC,gBAAgB,EAAE,MAAM,CAAC;QACrE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAqC;IACjE,OAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,KAAyB,EACzB,aAA6B,EAC7B,MAAqC;IAErC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,kBAAkB,CAAC;IACxE,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YACrD,CAAC,CAAC,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,mBAAmB,CAAC;YACtC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAC5B,CAAC,MAAM,EAAE,EAAE,CACT,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACnE;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,WAAgC;IAEhC,OAAO;QACL,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAC,uBAAuB;QACpE,gBAAgB,EAAE,uCAAuC,CACvD,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,mBAAmB,CAChC;QACD,iBAAiB,EAAE;YACjB,gBAAgB,EAAE,WAAW,CAAC,wBAAwB;YACtD,MAAM,EAAE,WAAW,CAAC,aAAa;SAClC;QACD,mBAAmB,EAAE,QAAQ;QAC7B,cAAc,EAAE,oBAAoB,CAAC,WAAW,CAAC,MAAM,CAAC;QACxD,gCAAgC,EAAE,IAAI;QACtC,oBAAoB,EAAE,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,WAAgC,EAChC,UAAuC;IAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,KAAK,EACL,SAAS,EACT;YACE,GAAG,MAAM,CAAC,cAAc;YACxB,aAAa,EACX,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,aAAa,CAAC,aAAa,IAAI,IAAI;YAClE,gBAAgB,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC;SACrD,EACD;YACE,GAAG,OAAO;YACV,0BAA0B,EAAE,6BAA6B,CAAC;gBACxD,WAAW,EAAE,KAAK,CAAC,kBAAkB;gBACrC,eAAe,EAAE,mBAAmB,CAAC,SAAS,CAAC;gBAC/C,KAAK,EAAE,OAAO;aACf,CAAC;SACH,EACD,UAAU,CACX,CAAC;QACF,IACE,SAAS;YACT,SAAS,EAAE;YACX,CAAC,SAAS,CAAC,0BAA0B;YACrC,CAAC,SAAS,CAAC,sBAAsB,EACjC,CAAC;YACD,uEAAuE;YACvE,sEAAsE;YACtE,yDAAyD;YACzD,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,0BAA0B,CACxB,KAAK,EACL,UAAU,EACV,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,UAAU,CACX,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,wBAAwB,CACnC,KAAK,EACL,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,OAAO,EACP,SAAS,CACV,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAyB,EACzB,WAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,KAAK,EAAE;QAClE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;QAC/D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,CAAC,MAAM;QACzD,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,CAAC,MAAM;QACzD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAC,CAAC;IACH,OAAO,CACL,MAAM,CAAC,yBAAyB;QAChC,MAAM,CAAC,iBAAiB;QACxB,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,WAAgC,EAChC,6BAAqC,EACrC,UAAuC,EACvC,aAAgC,EAChC,cAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC;IACvC,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,uCAAuC,CACrC,KAAK,EACL,aAAa,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAC1C,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QAChC,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;YACxD,CAAC,0BAA0B,CACzB,UAAU,EACV,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,UAAU,CACvB,EACD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,aAAa,EAAE,CAAC;QACjD,CAAC;QAED,+BAA+B,CAC7B,KAAK,EACL,qCAAqC,CAAC,KAAK,EAAE,MAAM,CAAC,EACpD,WAAW,CAAC,0BAA0B,CACvC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,KAAK,EACL,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,CACX,CAAC;QACF,IACE,CAAC,SAAS;YACV,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EACxD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACnE,IAAI,SAAS,CAAC,0BAA0B,EAAE,CAAC;YACzC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,oEAAoE;QACpE,0EAA0E;QAC1E,mEAAmE;QACnE,eAAe,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,+BAA+B,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChD,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACxE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9E,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  emptyVersionVector,\n  encodeVersionVector,\n  getImportBlobMetadata,\n  mergeVersionVectors,\n} from \"@tearleads/loro\";\nimport { readPullContinuation } from \"../../../../data/documents/shared/sync/syncPagination\";\nimport {\n  type DocumentRecord,\n  settleOutgoingPassAndDecideReArm,\n  shouldClearDocumentSyncFailureAfterPass,\n} from \"../../../../workflows/documents\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport { hydrateAttachmentBlobs } from \"../attachments/attachmentHydration\";\nimport { chainIdentityWrite } from \"../identityWriteChain\";\nimport { publishPersistedDocument, saveDocumentRecord } from \"../persistence\";\nimport type {\n  DocumentState,\n  DocumentStoreState,\n  DocumentSyncAttempt,\n  SaveDocumentRecordOptions,\n} from \"../state\";\nimport { installDocumentWriterProjection } from \"../writerProjectionGeneration\";\nimport { logRevalidationApplied as logApplied } from \"./remoteRevalidationTelemetry\";\nimport {\n  discardPreRegisteredUpdateIds,\n  discardUnacceptedPreRegisteredUpdateIds,\n} from \"./syncAcceptedUpdateIds\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { clearConsumedRemoteUpdateSignal } from \"./syncRemoteSignals\";\nimport {\n  applyIncomingSyncedUpdates,\n  documentSyncContextMatches,\n  importSyncedDocumentUpdates,\n} from \"./syncUpdateImport\";\nimport { extendDocumentVersionCoverage } from \"./versionCoverage\";\n\nfunction documentWriterProjectionMatchesSyncResponse(\n  writerProjection: NonNullable<\n    DocumentSyncAttempt[\"synced\"][\"writerProjection\"]\n  >,\n  synced: DocumentSyncAttempt[\"synced\"],\n): boolean {\n  return (\n    writerProjection.contentKeyBundle.contentKeyEpoch ===\n      synced.response.contentKeyBundle.contentKeyEpoch &&\n    writerProjection.contentKeyBundle.linkSetManifestHash ===\n      synced.response.contentKeyBundle.linkSetManifestHash &&\n    writerProjection.contentKeyBundle.targetHash ===\n      synced.response.contentKeyBundle.targetHash &&\n    writerProjection.documentKekTargets.linkSetManifestHash ===\n      synced.response.documentKekTargets.linkSetManifestHash &&\n    writerProjection.documentKekTargets.documentKeyTargetHash ===\n      synced.response.documentKekTargets.documentKeyTargetHash\n  );\n}\n\nfunction resolveSyncedDocumentWriterProjection(\n  state: DocumentStoreState,\n  synced: DocumentSyncAttempt[\"synced\"],\n) {\n  const writerProjection =\n    synced.writerProjection ??\n    (state.writerProjection?.documentId === synced.plan.documentId\n      ? state.writerProjection\n      : null);\n  return writerProjection &&\n    documentWriterProjectionMatchesSyncResponse(writerProjection, synced)\n    ? writerProjection\n    : null;\n}\n\n/**\n * Durable-history tail: append pulled updates BEFORE the record persist so\n * the tail stays a superset of what the snapshot covers (duplicates are\n * idempotent by op identity; a crash between the writes can only leave the\n * safe superset).\n */\nfunction pulledHistoryUpdates(synced: DocumentSyncAttempt[\"synced\"]): string[] {\n  return synced.decryptedUpdates.map((update) =>\n    bytesToBase64(update.updateData),\n  );\n}\n\n/**\n * The frontier a finalize persist may publish: the stored frontier advanced\n * by exactly the pulled updates just appended to the durable tail — never the\n * live document's version, which can transiently include an in-flight local\n * edit whose durable row has not landed yet.\n */\nfunction coveredSyncFrontier(\n  state: DocumentStoreState,\n  currentRecord: DocumentRecord,\n  synced: DocumentSyncAttempt[\"synced\"],\n): { snapshotEndVersion: string } | Record<string, never> {\n  const liveFrontier = (state.record ?? currentRecord).snapshotEndVersion;\n  if (synced.decryptedUpdates.length === 0) {\n    // A completed empty pull distinguishes a real blank note from discovery.\n    // An intermediate page cannot establish that no content exists yet.\n    return liveFrontier === \"\" && !synced.hasIncompletePull\n      ? { snapshotEndVersion: emptyVersionVector() }\n      : {};\n  }\n  return {\n    snapshotEndVersion: mergeVersionVectors([\n      ...(liveFrontier.length > 0 ? [liveFrontier] : []),\n      ...synced.decryptedUpdates.map(\n        (update) =>\n          getImportBlobMetadata(update.updateData).partialEndVersionVector,\n      ),\n    ]),\n  };\n}\n\nfunction documentSyncSaveOptions(\n  syncAttempt: DocumentSyncAttempt,\n): SaveDocumentRecordOptions {\n  return {\n    acceptedPendingUpdateIds: syncAttempt.synced.settledPendingUpdateIds,\n    clearSyncFailure: shouldClearDocumentSyncFailureAfterPass(\n      syncAttempt.synced,\n      syncAttempt.outgoingUpdateCount,\n    ),\n    expectedSyncState: {\n      pullContinuation: syncAttempt.consumedPullContinuation,\n      record: syncAttempt.requestRecord,\n    },\n    historyUpdateOrigin: \"remote\",\n    historyUpdates: pulledHistoryUpdates(syncAttempt.synced),\n    preserveSnapshotStructuredFields: true,\n    preserveSnapshotText: true,\n  };\n}\n\nasync function persistSyncedDocument(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord,\n  syncAttempt: DocumentSyncAttempt,\n  generation: DocumentStoreSyncGeneration,\n) {\n  const { synced } = syncAttempt;\n  const updates = synced.decryptedUpdates;\n  const candidate = currentDoc.fork();\n  const previousDocumentId = state.record?.documentId ?? null;\n  const options = documentSyncSaveOptions(syncAttempt);\n  const isCurrent = () =>\n    isDocumentStoreSyncGenerationCurrent(state, generation);\n  try {\n    importSyncedDocumentUpdates(candidate, updates);\n    if (state.pendingBaseVersion === null) {\n      throw new Error(\"Document sync requires an initialized pending base\");\n    }\n    const persisted = await saveDocumentRecord(\n      state,\n      candidate,\n      {\n        ...synced.persistedState,\n        lastCommitLsn:\n          synced.response.commitLsn ?? currentRecord.lastCommitLsn ?? null,\n        pullContinuation: readPullContinuation(synced.response),\n        ...coveredSyncFrontier(state, currentRecord, synced),\n      },\n      {\n        ...options,\n        pendingBaseVersionOverride: extendDocumentVersionCoverage({\n          baseVersion: state.pendingBaseVersion,\n          documentVersion: encodeVersionVector(candidate),\n          spans: updates,\n        }),\n      },\n      generation,\n    );\n    if (\n      persisted &&\n      isCurrent() &&\n      !persisted.pullContinuationSuperseded &&\n      !persisted.syncIdentitySuperseded\n    ) {\n      // Publish a remote edit only once its history and continuation commit.\n      // Importing earlier lets a losing CAS expose text that the next local\n      // write authors against an older, reloaded CRDT history.\n      // The durable CAS already checked the request's complete context. The\n      // successful row is now live, so publication uses that committed context\n      // (which may contain refreshed keying metadata) and the same generation.\n      applyIncomingSyncedUpdates(\n        state,\n        currentDoc,\n        persisted.record,\n        syncAttempt,\n        generation,\n      );\n    }\n    return await publishPersistedDocument(\n      state,\n      currentDoc,\n      persisted,\n      previousDocumentId,\n      options,\n      isCurrent,\n    );\n  } finally {\n    candidate.free();\n  }\n}\n\nexport function shouldReArmDocumentSync(\n  state: DocumentStoreState,\n  syncAttempt: DocumentSyncAttempt,\n): boolean {\n  const { synced } = syncAttempt;\n  const shouldReArmOutgoing = settleOutgoingPassAndDecideReArm(state, {\n    exhaustedPendingUpdateCount: synced.exhaustedPendingUpdateCount,\n    outgoingUpdateCount: syncAttempt.outgoingUpdateCount,\n    rekeyedUpdateCount: synced.rekeyedPendingUpdateIds.length,\n    settledUpdateCount: synced.settledPendingUpdateIds.length,\n    acceptedRecoveryBaseline: synced.acceptedRecoveryBaseline,\n  });\n  return (\n    synced.hasDeferredPendingUpdates ||\n    synced.hasIncompletePull ||\n    shouldReArmOutgoing\n  );\n}\n\nexport async function finalizeDocumentSync(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord,\n  syncAttempt: DocumentSyncAttempt,\n  consumedRemoteUpdateSignalSeq: number,\n  generation: DocumentStoreSyncGeneration,\n  sentUpdateIds: readonly string[],\n  wasRemoteProbe: boolean,\n): Promise<DocumentRecord> {\n  const { synced } = syncAttempt;\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? currentRecord;\n  }\n\n  // The sent IDs were pre-registered as self-authored before the network call so\n  // the redis echo can never beat us. Reconcile against what the server actually\n  // accepted: an ID we sent but the server did not accept will never be echoed,\n  // so drop it to keep locallyAcceptedUpdateIds from leaking. Accepted IDs (a\n  // subset of what we sent) stay registered until their echo consumes them.\n  discardUnacceptedPreRegisteredUpdateIds(\n    state,\n    sentUpdateIds,\n    synced.response.acceptedOutgoingUpdateIds,\n  );\n  // Persist on the identity-write chain: synced.persistedState carries this\n  // pass's documentId, so it would clobber a relink that landed mid-pass. If\n  // the identity moved, the response describes the OLD document — skip every\n  // response-derived in-memory mutation and let the new identity's own sync\n  // pass take over.\n  let responseApplied = false;\n  const { record: nextRecord } = await chainIdentityWrite(state, async () => {\n    const liveRecord = state.record;\n    if (\n      !isDocumentStoreSyncGenerationCurrent(state, generation) ||\n      !documentSyncContextMatches(\n        liveRecord,\n        currentRecord,\n        synced.plan.documentId,\n      )\n    ) {\n      return { record: liveRecord ?? currentRecord };\n    }\n\n    installDocumentWriterProjection(\n      state,\n      resolveSyncedDocumentWriterProjection(state, synced),\n      syncAttempt.writerProjectionGeneration,\n    );\n    const persisted = await persistSyncedDocument(\n      state,\n      currentDoc,\n      currentRecord,\n      syncAttempt,\n      generation,\n    );\n    if (\n      !persisted ||\n      !isDocumentStoreSyncGenerationCurrent(state, generation)\n    ) {\n      return { record: state.record ?? currentRecord };\n    }\n\n    state.pullContinuation = persisted.record.pullContinuation ?? null;\n    if (persisted.pullContinuationSuperseded) {\n      state.writerProjection = null;\n    }\n    // A CAS loss means neither this response's acknowledgements nor its\n    // continuation were committed. Keep the pass unapplied so its signals and\n    // accepted-id registrations cannot be cleared without a follow-up.\n    responseApplied = !persisted.pullContinuationSuperseded;\n    return persisted;\n  });\n  if (!responseApplied) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return nextRecord;\n  }\n\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n\n  // A bounded pull request owns the whole page chain. Completing the signal on\n  // an intermediate page would let a failed/null continuation pass report the\n  // original request as successful even though the server frontier was never\n  // drained.\n  if (!synced.hasIncompletePull) {\n    clearConsumedRemoteUpdateSignal(state, consumedRemoteUpdateSignalSeq);\n  }\n\n  if (shouldReArmDocumentSync(state, syncAttempt)) {\n    requestDocumentStoreSync(state);\n  }\n\n  await hydrateAttachmentBlobs(state, currentDoc, nextRecord, generation);\n  logApplied(state, currentDoc, synced.decryptedUpdates.length, wasRemoteProbe);\n  return nextRecord;\n}\n"]}
+{"version":3,"file":"syncFinalize.js","sourceRoot":"","sources":["syncFinalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAEL,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAO9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,sBAAsB,IAAI,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,SAAS,2CAA2C,CAClD,gBAEC,EACD,MAAqC;IAErC,OAAO,CACL,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QAC/C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,eAAe;QAClD,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB;YACnD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB;QACtD,gBAAgB,CAAC,gBAAgB,CAAC,UAAU;YAC1C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU;QAC7C,gBAAgB,CAAC,kBAAkB,CAAC,mBAAmB;YACrD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,mBAAmB;QACxD,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB;YACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,KAAyB,EACzB,MAAqC;IAErC,MAAM,gBAAgB,GACpB,MAAM,CAAC,gBAAgB;QACvB,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU;YAC5D,CAAC,CAAC,KAAK,CAAC,gBAAgB;YACxB,CAAC,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,gBAAgB;QACrB,2CAA2C,CAAC,gBAAgB,EAAE,MAAM,CAAC;QACrE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAqC;IACjE,OAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,KAAyB,EACzB,aAA6B,EAC7B,MAAqC;IAErC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,kBAAkB,CAAC;IACxE,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YACrD,CAAC,CAAC,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,mBAAmB,CAAC;YACtC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAC5B,CAAC,MAAM,EAAE,EAAE,CACT,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACnE;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,WAAgC;IAEhC,OAAO;QACL,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAC,uBAAuB;QACpE,gBAAgB,EAAE,uCAAuC,CACvD,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,mBAAmB,CAChC;QACD,iBAAiB,EAAE;YACjB,gBAAgB,EAAE,WAAW,CAAC,wBAAwB;YACtD,MAAM,EAAE,WAAW,CAAC,aAAa;SAClC;QACD,mBAAmB,EAAE,QAAQ;QAC7B,cAAc,EAAE,oBAAoB,CAAC,WAAW,CAAC,MAAM,CAAC;QACxD,gCAAgC,EAAE,IAAI;QACtC,oBAAoB,EAAE,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,WAAgC,EAChC,UAAuC;IAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,KAAK,EACL,SAAS,EACT;YACE,GAAG,MAAM,CAAC,cAAc;YACxB,aAAa,EACX,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,aAAa,CAAC,aAAa,IAAI,IAAI;YAClE,gBAAgB,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC;SACrD,EACD;YACE,GAAG,OAAO;YACV,0BAA0B,EAAE,6BAA6B,CAAC;gBACxD,WAAW,EAAE,KAAK,CAAC,kBAAkB;gBACrC,eAAe,EAAE,mBAAmB,CAAC,SAAS,CAAC;gBAC/C,KAAK,EAAE,OAAO;aACf,CAAC;SACH,EACD,UAAU,CACX,CAAC;QACF,IACE,SAAS;YACT,SAAS,EAAE;YACX,CAAC,SAAS,CAAC,0BAA0B;YACrC,CAAC,SAAS,CAAC,sBAAsB,EACjC,CAAC;YACD,uEAAuE;YACvE,sEAAsE;YACtE,yDAAyD;YACzD,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,0BAA0B,CACxB,KAAK,EACL,UAAU,EACV,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,UAAU,CACX,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,wBAAwB,CACnC,KAAK,EACL,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,OAAO,EACP,SAAS,CACV,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAyB,EACzB,WAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,KAAK,EAAE;QAClE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;QAC/D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,CAAC,MAAM;QACzD,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,CAAC,MAAM;QACzD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAC,CAAC;IACH,OAAO,CACL,MAAM,CAAC,yBAAyB;QAChC,MAAM,CAAC,iBAAiB;QACxB,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,WAAgC,EAChC,6BAAqC,EACrC,UAAuC,EACvC,aAAgC,EAChC,cAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;IAC/B,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC;IACvC,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,uCAAuC,CACrC,KAAK,EACL,aAAa,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAC1C,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QAChC,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;YACxD,CAAC,0BAA0B,CACzB,UAAU,EACV,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,UAAU,CACvB,EACD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,aAAa,EAAE,CAAC;QACjD,CAAC;QAED,+BAA+B,CAC7B,KAAK,EACL,qCAAqC,CAAC,KAAK,EAAE,MAAM,CAAC,EACpD,WAAW,CAAC,0BAA0B,CACvC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,KAAK,EACL,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,CACX,CAAC;QACF,IACE,CAAC,SAAS;YACV,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EACxD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACnE,IAAI,SAAS,CAAC,0BAA0B,EAAE,CAAC;YACzC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,oEAAoE;QACpE,0EAA0E;QAC1E,mEAAmE;QACnE,eAAe,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACpC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,+BAA+B,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChD,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACxE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9E,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  emptyVersionVector,\n  encodeVersionVector,\n  getImportBlobMetadata,\n  mergeVersionVectors,\n} from \"@tearleads/loro\";\nimport { readPullContinuation } from \"../../../../data/documents/shared/sync/syncPagination\";\nimport {\n  type DocumentRecord,\n  settleOutgoingPassAndDecideReArm,\n  shouldClearDocumentSyncFailureAfterPass,\n} from \"../../../../workflows/documents\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport { hydrateAttachmentBlobs } from \"../attachments/attachmentHydration\";\nimport { chainIdentityWrite } from \"../identityWriteChain\";\nimport { publishPersistedDocument, saveDocumentRecord } from \"../persistence\";\nimport type {\n  DocumentState,\n  DocumentStoreState,\n  DocumentSyncAttempt,\n  SaveDocumentRecordOptions,\n} from \"../state\";\nimport { installDocumentWriterProjection } from \"../writerProjectionGeneration\";\nimport { logRevalidationApplied as logApplied } from \"./remoteRevalidationTelemetry\";\nimport {\n  discardPreRegisteredUpdateIds,\n  discardUnacceptedPreRegisteredUpdateIds,\n} from \"./syncAcceptedUpdateIds\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { clearConsumedRemoteUpdateSignal } from \"./syncRemoteSignals\";\nimport {\n  applyIncomingSyncedUpdates,\n  documentSyncContextMatches,\n  importSyncedDocumentUpdates,\n} from \"./syncUpdateImport\";\nimport { extendDocumentVersionCoverage } from \"./versionCoverage\";\n\nfunction documentWriterProjectionMatchesSyncResponse(\n  writerProjection: NonNullable<\n    DocumentSyncAttempt[\"synced\"][\"writerProjection\"]\n  >,\n  synced: DocumentSyncAttempt[\"synced\"],\n): boolean {\n  return (\n    writerProjection.contentKeyBundle.contentKeyEpoch ===\n      synced.response.contentKeyBundle.contentKeyEpoch &&\n    writerProjection.contentKeyBundle.linkSetManifestHash ===\n      synced.response.contentKeyBundle.linkSetManifestHash &&\n    writerProjection.contentKeyBundle.targetHash ===\n      synced.response.contentKeyBundle.targetHash &&\n    writerProjection.documentKekTargets.linkSetManifestHash ===\n      synced.response.documentKekTargets.linkSetManifestHash &&\n    writerProjection.documentKekTargets.documentKeyTargetHash ===\n      synced.response.documentKekTargets.documentKeyTargetHash\n  );\n}\n\nfunction resolveSyncedDocumentWriterProjection(\n  state: DocumentStoreState,\n  synced: DocumentSyncAttempt[\"synced\"],\n) {\n  const writerProjection =\n    synced.writerProjection ??\n    (state.writerProjection?.documentId === synced.plan.documentId\n      ? state.writerProjection\n      : null);\n  return writerProjection &&\n    documentWriterProjectionMatchesSyncResponse(writerProjection, synced)\n    ? writerProjection\n    : null;\n}\n\n/**\n * Durable-history tail: append pulled updates BEFORE the record persist so\n * the tail stays a superset of what the snapshot covers (duplicates are\n * idempotent by op identity; a crash between the writes can only leave the\n * safe superset).\n */\nfunction pulledHistoryUpdates(synced: DocumentSyncAttempt[\"synced\"]): string[] {\n  return synced.decryptedUpdates.map((update) =>\n    bytesToBase64(update.updateData),\n  );\n}\n\n/**\n * The frontier a finalize persist may publish: the stored frontier advanced\n * by exactly the pulled updates just appended to the durable tail — never the\n * live document's version, which can transiently include an in-flight local\n * edit whose durable row has not landed yet.\n */\nfunction coveredSyncFrontier(\n  state: DocumentStoreState,\n  currentRecord: DocumentRecord,\n  synced: DocumentSyncAttempt[\"synced\"],\n): { snapshotEndVersion: string } | Record<string, never> {\n  const liveFrontier = (state.record ?? currentRecord).snapshotEndVersion;\n  if (synced.decryptedUpdates.length === 0) {\n    // A completed empty pull distinguishes a real blank note from discovery.\n    // An intermediate page cannot establish that no content exists yet.\n    return liveFrontier === \"\" && !synced.hasIncompletePull\n      ? { snapshotEndVersion: emptyVersionVector() }\n      : {};\n  }\n  return {\n    snapshotEndVersion: mergeVersionVectors([\n      ...(liveFrontier.length > 0 ? [liveFrontier] : []),\n      ...synced.decryptedUpdates.map(\n        (update) =>\n          getImportBlobMetadata(update.updateData).partialEndVersionVector,\n      ),\n    ]),\n  };\n}\n\nfunction documentSyncSaveOptions(\n  syncAttempt: DocumentSyncAttempt,\n): SaveDocumentRecordOptions {\n  return {\n    acceptedPendingUpdateIds: syncAttempt.synced.settledPendingUpdateIds,\n    clearSyncFailure: shouldClearDocumentSyncFailureAfterPass(\n      syncAttempt.synced,\n      syncAttempt.outgoingUpdateCount,\n    ),\n    expectedSyncState: {\n      pullContinuation: syncAttempt.consumedPullContinuation,\n      record: syncAttempt.requestRecord,\n    },\n    historyUpdateOrigin: \"remote\",\n    historyUpdates: pulledHistoryUpdates(syncAttempt.synced),\n    preserveSnapshotStructuredFields: true,\n    preserveSnapshotText: true,\n  };\n}\n\nasync function persistSyncedDocument(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord,\n  syncAttempt: DocumentSyncAttempt,\n  generation: DocumentStoreSyncGeneration,\n) {\n  const { synced } = syncAttempt;\n  const updates = synced.decryptedUpdates;\n  const candidate = currentDoc.fork();\n  const previousDocumentId = state.record?.documentId ?? null;\n  const options = documentSyncSaveOptions(syncAttempt);\n  const isCurrent = () =>\n    isDocumentStoreSyncGenerationCurrent(state, generation);\n  try {\n    importSyncedDocumentUpdates(candidate, updates);\n    if (state.pendingBaseVersion === null) {\n      throw new Error(\"Document sync requires an initialized pending base\");\n    }\n    const persisted = await saveDocumentRecord(\n      state,\n      candidate,\n      {\n        ...synced.persistedState,\n        lastCommitLsn:\n          synced.response.commitLsn ?? currentRecord.lastCommitLsn ?? null,\n        pullContinuation: readPullContinuation(synced.response),\n        ...coveredSyncFrontier(state, currentRecord, synced),\n      },\n      {\n        ...options,\n        pendingBaseVersionOverride: extendDocumentVersionCoverage({\n          baseVersion: state.pendingBaseVersion,\n          documentVersion: encodeVersionVector(candidate),\n          spans: updates,\n        }),\n      },\n      generation,\n    );\n    if (\n      persisted &&\n      isCurrent() &&\n      !persisted.pullContinuationSuperseded &&\n      !persisted.syncIdentitySuperseded\n    ) {\n      // Publish a remote edit only once its history and continuation commit.\n      // Importing earlier lets a losing CAS expose text that the next local\n      // write authors against an older, reloaded CRDT history.\n      // The durable CAS already checked the request's complete context. The\n      // successful row is now live, so publication uses that committed context\n      // (which may contain refreshed keying metadata) and the same generation.\n      applyIncomingSyncedUpdates(\n        state,\n        currentDoc,\n        persisted.record,\n        syncAttempt,\n        generation,\n      );\n    }\n    return await publishPersistedDocument(\n      state,\n      currentDoc,\n      persisted,\n      previousDocumentId,\n      options,\n      isCurrent,\n    );\n  } finally {\n    candidate.free();\n  }\n}\n\nexport function shouldReArmDocumentSync(\n  state: DocumentStoreState,\n  syncAttempt: DocumentSyncAttempt,\n): boolean {\n  const { synced } = syncAttempt;\n  const shouldReArmOutgoing = settleOutgoingPassAndDecideReArm(state, {\n    exhaustedPendingUpdateCount: synced.exhaustedPendingUpdateCount,\n    outgoingUpdateCount: syncAttempt.outgoingUpdateCount,\n    rekeyedUpdateCount: synced.rekeyedPendingUpdateIds.length,\n    settledUpdateCount: synced.settledPendingUpdateIds.length,\n    acceptedRecoveryBaseline: synced.acceptedRecoveryBaseline,\n  });\n  return (\n    synced.hasDeferredPendingUpdates ||\n    synced.hasIncompletePull ||\n    shouldReArmOutgoing\n  );\n}\n\nexport async function finalizeDocumentSync(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord,\n  syncAttempt: DocumentSyncAttempt,\n  consumedRemoteUpdateSignalSeq: number,\n  generation: DocumentStoreSyncGeneration,\n  sentUpdateIds: readonly string[],\n  wasRemoteProbe: boolean,\n): Promise<DocumentRecord> {\n  const { synced } = syncAttempt;\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? currentRecord;\n  }\n\n  // The sent IDs were pre-registered as self-authored before the network call\n  // so the realtime echo can never beat us. Reconcile against what the server\n  // actually accepted: an ID we sent but the server did not accept will never\n  // be echoed, so drop it to keep locallyAcceptedUpdateIds from leaking.\n  // Accepted IDs (a subset of what we sent) stay registered until their echo\n  // consumes them.\n  discardUnacceptedPreRegisteredUpdateIds(\n    state,\n    sentUpdateIds,\n    synced.response.acceptedOutgoingUpdateIds,\n  );\n  // Persist on the identity-write chain: synced.persistedState carries this\n  // pass's documentId, so it would clobber a relink that landed mid-pass. If\n  // the identity moved, the response describes the OLD document — skip every\n  // response-derived in-memory mutation and let the new identity's own sync\n  // pass take over.\n  let responseApplied = false;\n  const { record: nextRecord } = await chainIdentityWrite(state, async () => {\n    const liveRecord = state.record;\n    if (\n      !isDocumentStoreSyncGenerationCurrent(state, generation) ||\n      !documentSyncContextMatches(\n        liveRecord,\n        currentRecord,\n        synced.plan.documentId,\n      )\n    ) {\n      return { record: liveRecord ?? currentRecord };\n    }\n\n    installDocumentWriterProjection(\n      state,\n      resolveSyncedDocumentWriterProjection(state, synced),\n      syncAttempt.writerProjectionGeneration,\n    );\n    const persisted = await persistSyncedDocument(\n      state,\n      currentDoc,\n      currentRecord,\n      syncAttempt,\n      generation,\n    );\n    if (\n      !persisted ||\n      !isDocumentStoreSyncGenerationCurrent(state, generation)\n    ) {\n      return { record: state.record ?? currentRecord };\n    }\n\n    state.pullContinuation = persisted.record.pullContinuation ?? null;\n    if (persisted.pullContinuationSuperseded) {\n      state.writerProjection = null;\n    }\n    // A CAS loss means neither this response's acknowledgements nor its\n    // continuation were committed. Keep the pass unapplied so its signals and\n    // accepted-id registrations cannot be cleared without a follow-up.\n    responseApplied = !persisted.pullContinuationSuperseded;\n    return persisted;\n  });\n  if (!responseApplied) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return nextRecord;\n  }\n\n  if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n    discardPreRegisteredUpdateIds(state, sentUpdateIds);\n    requestDocumentStoreSync(state);\n    return state.record ?? nextRecord;\n  }\n\n  // A bounded pull request owns the whole page chain. Completing the signal on\n  // an intermediate page would let a failed/null continuation pass report the\n  // original request as successful even though the server frontier was never\n  // drained.\n  if (!synced.hasIncompletePull) {\n    clearConsumedRemoteUpdateSignal(state, consumedRemoteUpdateSignalSeq);\n  }\n\n  if (shouldReArmDocumentSync(state, syncAttempt)) {\n    requestDocumentStoreSync(state);\n  }\n\n  await hydrateAttachmentBlobs(state, currentDoc, nextRecord, generation);\n  logApplied(state, currentDoc, synced.decryptedUpdates.length, wasRemoteProbe);\n  return nextRecord;\n}\n"]}

package/workflows/containers/child/share/currentShareGrantMutation.js

@@ -3,7 +3,7 @@ import { createRuntimeGroupMetadataAccess } from "../../../organizations/groupMe
 import { commitCurrentGroupPolicyMutation } from "../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation.js";
 import { buildSetGroupContainerGrantPolicyRequest } from "../../../organizations/groupPolicy/groupPolicyRequests.js";
 import { groupPolicyNameMismatch } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
-import { preparePrincipalContainerRematerializationBatch, } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
+import { preparePrincipalContainerRematerializationBatch, } from "../../rematerialization/index.js";
 import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
 /** Fresh mutation authority rechecks the chosen name before authoring a grant. */
 export async function commitCurrentShareGrant(input) {

package/workflows/containers/child/share/currentShareGrantMutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,wCAAwC,EAAE,MAAM,wDAAwD,CAAC;AAKlH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAEL,+CAA+C,GAChD,MAAM,8EAA8E,CAAC;AAGtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { commitCurrentGroupPolicyMutation } from \"../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../../organizations/groupPolicy/groupPolicyRequests\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport { groupPolicyNameMismatch } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}
+{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,wCAAwC,EAAE,MAAM,wDAAwD,CAAC;AAKlH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAEL,+CAA+C,GAChD,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { commitCurrentGroupPolicyMutation } from \"../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../../organizations/groupPolicy/groupPolicyRequests\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport { groupPolicyNameMismatch } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../rematerialization\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}

package/workflows/containers/child/share/index.js

@@ -5,7 +5,7 @@ import { requireTrustedUserIdentityResolver, } from "../../../../data/trustedUse
 import { createGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataAccess.js";
 import { createGroupMetadataContainerVerifier } from "../../../organizations/groupMetadata/groupMetadataContainerAuthority.js";
 import { setOrganizationGroupContainerGrant } from "../../../organizations/principalPolicy/index.js";
-import { preparePrincipalContainerRematerializationBatch } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
+import { preparePrincipalContainerRematerializationBatch } from "../../rematerialization/index.js";
 import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "../mutationSubmit.js";
 import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
 import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "./sharePrincipalPolicy.js";

package/workflows/containers/child/share/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,sCAAsC,EACtC,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAGpH,OAAO,EACL,kCAAkC,GAEnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,sEAAsE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAAE,+CAA+C,EAAE,MAAM,8EAA8E,CAAC;AAC/I,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAE5B,qCAAqC,GACtC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC;AAqCD,SAAS,gCAAgC,CACvC,KAEkB;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,+CAA+C,CAAC;QACrD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,UAAU,CAAC,gBAAgB;QACpC,UAAU;QACV,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAOrC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACxE,6BAA6B,EAC3B,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;KACF,CAAC;IACF,IAAI,cAIS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,GAAG,EAAE;gBACpB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,oCAAoC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,yBAAyB,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;gBACjE,cAAc,GAAG,MAAM,iCAAiC,CAAC;oBACvD,aAAa;oBACb,UAAU;oBACV,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,oCAAoC;YACrD,sCAAsC,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnD,MAAM,WAAW,GAAG,cAAc,EAAE,KAAK,CAAC,SAAS,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,CAAC;IACF,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GACd,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,QAAQ;QACT,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,iBAAgC;IAC5D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAqC;IACjE,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QACvD,iBAAiB,EACf,KAAK,CAAC,iBAAiB;YACvB,yBAAyB,CAAC;gBACxB,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,oCAAoC,CAAC;oBAC5D,GAAG,KAAK;oBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBACjD,CAAC;aACH,CAAC,CAAC,QAAQ;QACb,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAqC;IAErC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACrD,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,uBAAuB,EACvB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,oBAAoB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,uCAAuC,CAC3D,uBAAuB,CAAC,kBAAkB,CAC3C;QACD,kBAAkB;QAClB,SAAS,EAAE;YACT,eAAe,EAAE,uBAAuB,CAAC,MAAM;YAC/C,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,WAAW,EAAE,OAAO;SACrB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,uBAAuB,CAAC,kBAAkB;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,uBAAuB,CAAC,MAAM,EAC9B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../../data/trustedUserIdentity\";\nimport { createGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/groupMetadataContainerAuthority\";\nimport { setOrganizationGroupContainerGrant } from \"../../../organizations/principalPolicy\";\nimport type { GroupPolicyNameReader } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { preparePrincipalContainerRematerializationBatch } from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport {\n  advanceVerifiedSharePolicies,\n  type ContainerManagedPrincipalShareApi,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"./sharePrincipalPolicy\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\nclass ContainerShareGenerationExpiredError extends Error {}\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n\ninterface RemoteContainerGroupShareInput {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerManagedPrincipalShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /**\n   * The display name the user chose the group by, checked against the name\n   * committed in the verified group policy so a relabeled read-model row\n   * cannot redirect the share onto another group. `null` is reserved for the\n   * grant-preserving re-wrap: a share that would mint a new grant without a\n   * name is refused.\n   */\n  expectedGroupName: string | null;\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ninterface RemoteContainerGroupShareResult {\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n}\n\nfunction isMaterializedContainerSharePlan(\n  value: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >[\"plans\"][number],\n): value is MaterializedContainerSharePlan {\n  return value.plan.body.eventType === \"container.grant\";\n}\n\nasync function prepareMissingGroupGrantMutations(input: {\n  currentPolicy: PrincipalPolicyBundleResponse;\n  nextPolicy: VerifiedPrincipalPolicy;\n  shareInput: RemoteContainerGroupShareInput;\n}) {\n  const { currentPolicy, nextPolicy, shareInput } = input;\n  return preparePrincipalContainerRematerializationBatch({\n    reportSecurityIncident: shareInput.reportSecurityIncident,\n    apiClient: shareInput.apiClient,\n    author: shareInput.author,\n    execSql: shareInput.execSql,\n    grants: [\n      ...new Map(\n        [...currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: shareInput.recipientGroupId,\n    nextPolicy,\n    resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,\n    stillCurrent: shareInput.stillCurrent,\n    targetSecretKey: shareInput.targetSecretKey,\n    warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,\n  });\n}\n\nasync function commitMissingGroupGrantPolicy(\n  input: RemoteContainerGroupShareInput,\n): Promise<{\n  preparedTarget: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >;\n  storedPolicy: Awaited<ReturnType<typeof setOrganizationGroupContainerGrant>>;\n} | null> {\n  const signingKeyPair = input.signingKeyPair;\n  if (!signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  const policyApi = {\n    recoverPendingPrincipalMutation:\n      input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),\n    commitOrganizationGroupPolicy:\n      input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n  };\n  let preparedTarget:\n    | Awaited<\n        ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n      >\n    | undefined;\n  try {\n    const storedPolicy = await setOrganizationGroupContainerGrant({\n      accessLevel: input.accessLevel,\n      apiClient: policyApi,\n      assertCanCommit: () => {\n        if (input.stillCurrent?.() === false) {\n          throw new ContainerShareGenerationExpiredError();\n        }\n      },\n      containerId: input.containerId,\n      execSql: input.execSql,\n      groupId: input.recipientGroupId,\n      organizationId: input.author.organizationId,\n      prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {\n        preparedTarget = await prepareMissingGroupGrantMutations({\n          currentPolicy,\n          nextPolicy,\n          shareInput: input,\n        });\n        return preparedTarget;\n      },\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      signerUserId: input.author.signerUserId,\n      signingFingerprint: input.author.signerKeyFingerprint,\n      signingKeyPair,\n    });\n    if (!preparedTarget) {\n      throw new Error(\"Container group share preparation is incomplete\");\n    }\n    return { preparedTarget, storedPolicy };\n  } catch (error) {\n    if (\n      error instanceof ContainerShareGenerationExpiredError ||\n      isProjectionVerificationCancelledError(error)\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function commitMissingGroupGrant(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (!input.signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const committed = await commitMissingGroupGrantPolicy(input);\n  if (!committed) return null;\n  const { preparedTarget, storedPolicy } = committed;\n  const targetIndex = preparedTarget?.plans.findIndex(\n    (planned) => planned.plan.containerId === input.containerId,\n  );\n  const response =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : storedPolicy.containerMutations[targetIndex];\n  const targetPlan =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : preparedTarget?.plans[targetIndex];\n  if (\n    !targetPlan ||\n    !response ||\n    !isMaterializedContainerSharePlan(targetPlan)\n  ) {\n    throw new Error(\"Container group share acknowledgement is incomplete\");\n  }\n  return {\n    containerKey: targetPlan.containerKey,\n    plan: targetPlan.plan,\n    response,\n  };\n}\n\n// Only a re-wrap of an existing signed grant may run without the chosen name;\n// minting a grant is exactly the operation the name binding protects.\nfunction assertGrantMintNamed(expectedGroupName: string | null): void {\n  if (expectedGroupName === null) {\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  }\n}\n\nfunction loadShareGroupPolicy(input: RemoteContainerGroupShareInput) {\n  return loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedGroupName: input.expectedGroupName ?? undefined,\n    readEncryptedName:\n      input.readEncryptedName ??\n      createGroupMetadataAccess({\n        ...input,\n        organizationId: input.author.organizationId,\n        verifyMetadataContainer: createGroupMetadataContainerVerifier({\n          ...input,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        }),\n      }).readName,\n    groupId: input.recipientGroupId,\n    organizationId: input.author.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function shareRemoteContainerWithGroup(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  await input.apiClient.recoverPendingPrincipalMutation?.(\n    input.author.organizationId,\n  );\n  if (input.stillCurrent?.() === false) return null;\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n  const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);\n  if (input.stillCurrent?.() === false) return null;\n  await advanceVerifiedSharePolicies(\n    input.execSql,\n    verifiedPrincipalPolicy,\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedGrant = verifiedPrincipalPolicy.policy.grants.find(\n    (grant) => grant.containerId === input.containerId,\n  );\n  if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {\n    assertGrantMintNamed(input.expectedGroupName);\n    return commitMissingGroupGrant(input);\n  }\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    principalPolicyCache: principalPolicyCacheForVerifiedPolicies(\n      verifiedPrincipalPolicy.checkpointPolicies,\n    ),\n    previousProjection,\n    recipient: {\n      principalPolicy: verifiedPrincipalPolicy.policy,\n      subjectId: input.recipientGroupId,\n      subjectType: \"group\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  const result = await submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n  if (!result) return null;\n\n  // Keep the previously cached group epoch available until the old container\n  // wrap has been unwrapped and the replacement has committed. Root has no\n  // parent fallback, so caching the rotated policy any earlier destroys the\n  // only local path to the KEK that must be re-wrapped.\n  if (input.stillCurrent?.() !== false) {\n    await savePrincipalPolicyBundle(\n      input.execSql,\n      verifiedPrincipalPolicy.bundle,\n      new Date().toISOString(),\n      input.author.organizationId,\n      { stillCurrent: input.stillCurrent },\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n\n  return result;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,sCAAsC,EACtC,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAGpH,OAAO,EACL,kCAAkC,GAEnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,sEAAsE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAAE,+CAA+C,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAE5B,qCAAqC,GACtC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC;AAqCD,SAAS,gCAAgC,CACvC,KAEkB;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,+CAA+C,CAAC;QACrD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,UAAU,CAAC,gBAAgB;QACpC,UAAU;QACV,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAOrC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACxE,6BAA6B,EAC3B,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;KACF,CAAC;IACF,IAAI,cAIS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,GAAG,EAAE;gBACpB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,oCAAoC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,yBAAyB,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;gBACjE,cAAc,GAAG,MAAM,iCAAiC,CAAC;oBACvD,aAAa;oBACb,UAAU;oBACV,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,oCAAoC;YACrD,sCAAsC,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnD,MAAM,WAAW,GAAG,cAAc,EAAE,KAAK,CAAC,SAAS,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,CAAC;IACF,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GACd,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,QAAQ;QACT,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,iBAAgC;IAC5D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAqC;IACjE,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QACvD,iBAAiB,EACf,KAAK,CAAC,iBAAiB;YACvB,yBAAyB,CAAC;gBACxB,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,oCAAoC,CAAC;oBAC5D,GAAG,KAAK;oBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBACjD,CAAC;aACH,CAAC,CAAC,QAAQ;QACb,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAqC;IAErC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACrD,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,uBAAuB,EACvB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,oBAAoB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,uCAAuC,CAC3D,uBAAuB,CAAC,kBAAkB,CAC3C;QACD,kBAAkB;QAClB,SAAS,EAAE;YACT,eAAe,EAAE,uBAAuB,CAAC,MAAM;YAC/C,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,WAAW,EAAE,OAAO;SACrB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,uBAAuB,CAAC,kBAAkB;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,uBAAuB,CAAC,MAAM,EAC9B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../../data/trustedUserIdentity\";\nimport { createGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/groupMetadataContainerAuthority\";\nimport { setOrganizationGroupContainerGrant } from \"../../../organizations/principalPolicy\";\nimport type { GroupPolicyNameReader } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { preparePrincipalContainerRematerializationBatch } from \"../../rematerialization\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport {\n  advanceVerifiedSharePolicies,\n  type ContainerManagedPrincipalShareApi,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"./sharePrincipalPolicy\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\nclass ContainerShareGenerationExpiredError extends Error {}\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n\ninterface RemoteContainerGroupShareInput {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerManagedPrincipalShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /**\n   * The display name the user chose the group by, checked against the name\n   * committed in the verified group policy so a relabeled read-model row\n   * cannot redirect the share onto another group. `null` is reserved for the\n   * grant-preserving re-wrap: a share that would mint a new grant without a\n   * name is refused.\n   */\n  expectedGroupName: string | null;\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ninterface RemoteContainerGroupShareResult {\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n}\n\nfunction isMaterializedContainerSharePlan(\n  value: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >[\"plans\"][number],\n): value is MaterializedContainerSharePlan {\n  return value.plan.body.eventType === \"container.grant\";\n}\n\nasync function prepareMissingGroupGrantMutations(input: {\n  currentPolicy: PrincipalPolicyBundleResponse;\n  nextPolicy: VerifiedPrincipalPolicy;\n  shareInput: RemoteContainerGroupShareInput;\n}) {\n  const { currentPolicy, nextPolicy, shareInput } = input;\n  return preparePrincipalContainerRematerializationBatch({\n    reportSecurityIncident: shareInput.reportSecurityIncident,\n    apiClient: shareInput.apiClient,\n    author: shareInput.author,\n    execSql: shareInput.execSql,\n    grants: [\n      ...new Map(\n        [...currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: shareInput.recipientGroupId,\n    nextPolicy,\n    resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,\n    stillCurrent: shareInput.stillCurrent,\n    targetSecretKey: shareInput.targetSecretKey,\n    warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,\n  });\n}\n\nasync function commitMissingGroupGrantPolicy(\n  input: RemoteContainerGroupShareInput,\n): Promise<{\n  preparedTarget: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >;\n  storedPolicy: Awaited<ReturnType<typeof setOrganizationGroupContainerGrant>>;\n} | null> {\n  const signingKeyPair = input.signingKeyPair;\n  if (!signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  const policyApi = {\n    recoverPendingPrincipalMutation:\n      input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),\n    commitOrganizationGroupPolicy:\n      input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n  };\n  let preparedTarget:\n    | Awaited<\n        ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n      >\n    | undefined;\n  try {\n    const storedPolicy = await setOrganizationGroupContainerGrant({\n      accessLevel: input.accessLevel,\n      apiClient: policyApi,\n      assertCanCommit: () => {\n        if (input.stillCurrent?.() === false) {\n          throw new ContainerShareGenerationExpiredError();\n        }\n      },\n      containerId: input.containerId,\n      execSql: input.execSql,\n      groupId: input.recipientGroupId,\n      organizationId: input.author.organizationId,\n      prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {\n        preparedTarget = await prepareMissingGroupGrantMutations({\n          currentPolicy,\n          nextPolicy,\n          shareInput: input,\n        });\n        return preparedTarget;\n      },\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      signerUserId: input.author.signerUserId,\n      signingFingerprint: input.author.signerKeyFingerprint,\n      signingKeyPair,\n    });\n    if (!preparedTarget) {\n      throw new Error(\"Container group share preparation is incomplete\");\n    }\n    return { preparedTarget, storedPolicy };\n  } catch (error) {\n    if (\n      error instanceof ContainerShareGenerationExpiredError ||\n      isProjectionVerificationCancelledError(error)\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function commitMissingGroupGrant(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (!input.signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const committed = await commitMissingGroupGrantPolicy(input);\n  if (!committed) return null;\n  const { preparedTarget, storedPolicy } = committed;\n  const targetIndex = preparedTarget?.plans.findIndex(\n    (planned) => planned.plan.containerId === input.containerId,\n  );\n  const response =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : storedPolicy.containerMutations[targetIndex];\n  const targetPlan =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : preparedTarget?.plans[targetIndex];\n  if (\n    !targetPlan ||\n    !response ||\n    !isMaterializedContainerSharePlan(targetPlan)\n  ) {\n    throw new Error(\"Container group share acknowledgement is incomplete\");\n  }\n  return {\n    containerKey: targetPlan.containerKey,\n    plan: targetPlan.plan,\n    response,\n  };\n}\n\n// Only a re-wrap of an existing signed grant may run without the chosen name;\n// minting a grant is exactly the operation the name binding protects.\nfunction assertGrantMintNamed(expectedGroupName: string | null): void {\n  if (expectedGroupName === null) {\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  }\n}\n\nfunction loadShareGroupPolicy(input: RemoteContainerGroupShareInput) {\n  return loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedGroupName: input.expectedGroupName ?? undefined,\n    readEncryptedName:\n      input.readEncryptedName ??\n      createGroupMetadataAccess({\n        ...input,\n        organizationId: input.author.organizationId,\n        verifyMetadataContainer: createGroupMetadataContainerVerifier({\n          ...input,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        }),\n      }).readName,\n    groupId: input.recipientGroupId,\n    organizationId: input.author.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function shareRemoteContainerWithGroup(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  await input.apiClient.recoverPendingPrincipalMutation?.(\n    input.author.organizationId,\n  );\n  if (input.stillCurrent?.() === false) return null;\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n  const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);\n  if (input.stillCurrent?.() === false) return null;\n  await advanceVerifiedSharePolicies(\n    input.execSql,\n    verifiedPrincipalPolicy,\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedGrant = verifiedPrincipalPolicy.policy.grants.find(\n    (grant) => grant.containerId === input.containerId,\n  );\n  if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {\n    assertGrantMintNamed(input.expectedGroupName);\n    return commitMissingGroupGrant(input);\n  }\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    principalPolicyCache: principalPolicyCacheForVerifiedPolicies(\n      verifiedPrincipalPolicy.checkpointPolicies,\n    ),\n    previousProjection,\n    recipient: {\n      principalPolicy: verifiedPrincipalPolicy.policy,\n      subjectId: input.recipientGroupId,\n      subjectType: \"group\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  const result = await submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n  if (!result) return null;\n\n  // Keep the previously cached group epoch available until the old container\n  // wrap has been unwrapped and the replacement has committed. Root has no\n  // parent fallback, so caching the rotated policy any earlier destroys the\n  // only local path to the KEK that must be re-wrapped.\n  if (input.stillCurrent?.() !== false) {\n    await savePrincipalPolicyBundle(\n      input.execSql,\n      verifiedPrincipalPolicy.bundle,\n      new Date().toISOString(),\n      input.author.organizationId,\n      { stillCurrent: input.stillCurrent },\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n\n  return result;\n}\n"]}

package/workflows/containers/rematerialization/index.js

@@ -0,0 +1,4 @@
+// A principal policy change re-wraps every container it grants or revokes.
+// Group-policy commits and group shares prepare that batch through this surface.
+export { preparePrincipalContainerRematerializationBatch, } from "./principalContainerRematerialization.js";
+//# sourceMappingURL=index.js.map

package/workflows/containers/rematerialization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,OAAO,EAEL,+CAA+C,GAChD,MAAM,uCAAuC,CAAC","sourcesContent":["// A principal policy change re-wraps every container it grants or revokes.\n// Group-policy commits and group shares prepare that batch through this surface.\nexport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"./principalContainerRematerialization\";\nexport type { PrincipalRematerializationPredecessor } from \"./principalContainerRematerializationPlanning\";\n"]}

package/workflows/{organizations → containers}/rematerialization/precedingPrincipalRematerialization.js

@@ -1,4 +1,4 @@
-import { rebaseOnDeepestAncestor } from "../../containers/child/rekey/carriedDescendantRekeys.js";
+import { rebaseOnDeepestAncestor } from "../child/rekey/carriedDescendantRekeys.js";
 import { withAuthoredPrincipalPolicies } from "./authoredPrincipalPolicyWarmer.js";
 /** Plan the next group against container heads authored earlier in the same transaction. */
 export function withPrecedingRematerialization(input) {

package/workflows/containers/rematerialization/precedingPrincipalRematerialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precedingPrincipalRematerialization.js","sourceRoot":"","sources":["precedingPrincipalRematerialization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,4FAA4F;AAC5F,MAAM,UAAU,8BAA8B,CAC5C,KAA+C;IAE/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,MAAyC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,CAAC;QACjC,OAAO,CACL,uBAAuB,CAAC,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,UAAU;YACtE,UAAU,CACX,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,6BAA6B,CAC5D,KAAK,CAAC,+BAA+B,EACrC,SAAS,CAAC,QAAQ,IAAI,EAAE,CACzB;QACD,SAAS,EAAE;YACT,GAAG,KAAK,CAAC,SAAS;YAClB,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,4BAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;gBAClD,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;gBAClE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC;YACD,kCAAkC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { rebaseOnDeepestAncestor } from \"../child/rekey/carriedDescendantRekeys\";\nimport { withAuthoredPrincipalPolicies } from \"./authoredPrincipalPolicyWarmer\";\nimport type { PrincipalContainerRematerializationInput } from \"./principalContainerRematerializationPlanning\";\n\n/** Plan the next group against container heads authored earlier in the same transaction. */\nexport function withPrecedingRematerialization(\n  input: PrincipalContainerRematerializationInput,\n): PrincipalContainerRematerializationInput {\n  const preceding = input.preceding;\n  if (!preceding) return input;\n  const rebase = (served: ContainerWriterProjectionResponse) => {\n    const own = preceding.projections.findLast(\n      (projection) => projection.containerId === served.containerId,\n    );\n    const projection = own ?? served;\n    return (\n      rebaseOnDeepestAncestor(projection, preceding.projections)?.projection ??\n      projection\n    );\n  };\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: withAuthoredPrincipalPolicies(\n      input.warmReferencedPrincipalPolicies,\n      preceding.authored ?? [],\n    ),\n    apiClient: {\n      ...input.apiClient,\n      reciteContainer: input.apiClient.reciteContainer.bind(input.apiClient),\n      getContainerWriterProjection: async (containerId) => {\n        const projection =\n          await input.apiClient.getContainerWriterProjection(containerId);\n        return projection ? rebase(projection) : null;\n      },\n      getContainerWriterProjectionResult: async (containerId, options) => {\n        const result = await input.apiClient.getContainerWriterProjectionResult(\n          containerId,\n          options,\n        );\n        return result.ok ? { ...result, data: rebase(result.data) } : result;\n      },\n    },\n  };\n}\n"]}

package/workflows/{organizations → containers}/rematerialization/principalContainerRematerialization.js

@@ -4,13 +4,13 @@ import { acknowledgeContainerMutationBatch } from "../../../data/containers/shar
 import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
 import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
 import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
-import { scheduleHeldDescendantRecitations } from "../../containers/child/recite.js";
-import { buildMaterializedContainerRekeyPlan } from "../../containers/child/rekey/index.js";
-import { rebaseOnDeepestAncestor } from "../../containers/child/rekey/carriedDescendantRekeys.js";
-import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../../containers/child/rekey/rekeyProjection.js";
-import { buildMaterializedContainerRevokePlan } from "../../containers/child/revoke.js";
-import { selectReplacementPrincipalPolicyReferences } from "../../containers/child/rotation/replacementPrincipalPolicyReferences.js";
-import { buildMaterializedContainerSharePlan } from "../../containers/child/share/shareMaterialization.js";
+import { scheduleHeldDescendantRecitations } from "../child/recite.js";
+import { buildMaterializedContainerRekeyPlan } from "../child/rekey/index.js";
+import { rebaseOnDeepestAncestor } from "../child/rekey/carriedDescendantRekeys.js";
+import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../child/rekey/rekeyProjection.js";
+import { buildMaterializedContainerRevokePlan } from "../child/revoke.js";
+import { selectReplacementPrincipalPolicyReferences } from "../child/rotation/replacementPrincipalPolicyReferences.js";
+import { buildMaterializedContainerSharePlan } from "../child/share/shareMaterialization.js";
 import { withPrecedingRematerialization } from "./precedingPrincipalRematerialization.js";
 import { addPlan, carryLevel, staleLevelsAbove, } from "./principalContainerRematerializationPlanning.js";
 import { loadRematerializationTargets, loadServedProjection, seededPrincipalPolicyCache, } from "./principalContainerRematerializationTargets.js";

package/workflows/containers/rematerialization/principalContainerRematerialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalContainerRematerialization.js","sourceRoot":"","sources":["principalContainerRematerialization.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,yDAAyD,CAAC;AAC5G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAC7G,OAAO,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oCAAoC,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,0CAA0C,EAAE,MAAM,wDAAwD,CAAC;AACpH,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EACL,OAAO,EAEP,UAAU,EAGV,gBAAgB,GACjB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EAIpB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AAEtD,SAAS,kBAAkB,CAAC,KAG3B;IACC,OAAO,CACL,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAKhC;IACC,OAAO,CACL,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,EAAE,QAAQ,IAAI,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA+C,EAC/C,QAAiC,EACjC,UAA6C,EAC7C,oBAA0C;IAE1C,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,oBAAoB;QACpB,UAAU;QACV,cAAc,EAAE,+BAA+B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,4CAA4C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,iCAAiC,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,KAA+C;IAE/C,OAAO,CACL,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAwBD,SAAS,oBAAoB,CAC3B,OAAmD;IAEnD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,4CAA4C,CAAC,KAY3D;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,iBAAiB,GAAG;QACxB,GAAG,KAAK,CAAC,iBAAiB;QAC1B,UAAU,EAAE,MAAM,0CAA0C,CAAC;YAC3D,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,UAAU;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,+BAA+B,EAC7B,KAAK,CAAC,iBAAiB,CAAC,+BAA+B;SAC1D,CAAC;KACH,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAC7C,MAAM,2BAA2B,CAC/B,iBAAiB,EACjB,QAAQ,EACR,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACJ,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,iBAAiB,CAAC,MAAM;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;KAC1C,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,kBAAkB,EAAE,UAAU;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,2CAA2C,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,GAAG,WAAW;YACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;YACxD,cAAc,EAAE;gBACd,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,0CAA0C,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjE,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,GAAG,WAAW;QACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAoB,EACpB,MAA+B;IAE/B,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,gBAAgB,CACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CACzD;QACH,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,CACd,KAAK,EACL,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,gEAAgE;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,kBAAkB;QAC9B,iBAAiB;QACjB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,MAAM,cAAc,GAClB,SAAS,IAAI,OAAO,CAAC,IAAI;QACvB,CAAC,CAAC,MAAM,yCAAyC,CAAC;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC;QACJ,CAAC,CAAC,MAAM,sCAAsC,CAAC;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC,CAAC;IACT,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,KAAK;QACd,OAAO;QACP,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC1D,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6CAA6C,CAC1D,KAA+C,EAC/C,sBAAyC,EAAE;IAM3C,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9C,IACE,KAAK,CAAC,kBAAkB;QACxB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,4BAA4B,CAAC;QAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAkB;QAC3B,kBAAkB,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC;QAChE,KAAK,EAAE,EAAE;QACT,2EAA2E;QAC3E,0EAA0E;QAC1E,oBAAoB,EAAE,IAAI,GAAG,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvD,GAAG,0BAA0B,CAAC,MAAM,CAAC;aACtC,CAAC;YACF,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;SAChD,CAAC;QACF,iBAAiB,EAAE,KAAK;QACxB,wBAAwB,EAAE,+BAA+B,CAAC;YACxD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,EAAE;KACjB,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,mBAAmB;QACnB,SAAS,EAAE;YACT,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;YAClE,WAAW,EAAE;gBACX,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC;gBACvC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD;aACF;YACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,KAA0C,EAC1C,oBAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB;SACnC,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC;SACvC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,aAAa,SAAS,+CAA+C,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CACnE,KAA+C;IAE/C,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAC7C,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,SAAS;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,mBAAmB;YACrB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK;YACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE;YACpC,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,6CAA6C,CACnE,KAAK,EACL,oBAAoB,CACrB,CAAC;YACF,4BAA4B,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACtE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;YACpD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YAChC,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;YAC7C,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;gBAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK;gBACZ,SAAS;gBACT,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO;YAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;YACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,mBAAmB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACtE,IAAI,CAAC;oBACH,8BAA8B,CAAC;wBAC7B,cAAc;wBACd,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,KAAK,EAAE,EAAE;wBACT,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,SAAS;gBACX,CAAC;gBACD,iCAAiC,CAAC;oBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE;oBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,SAAS;oBACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerDirectGrant,\n  PrincipalContainerGrant,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { acknowledgeContainerMutationBatch } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  type PrincipalPolicyCache,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport { scheduleHeldDescendantRecitations } from \"../child/recite\";\nimport { buildMaterializedContainerRekeyPlan } from \"../child/rekey\";\nimport { rebaseOnDeepestAncestor } from \"../child/rekey/carriedDescendantRekeys\";\nimport {\n  containerWriterProjectionFromRotationPlan,\n  containerWriterProjectionFromSharePlan,\n  isSpeculativeContainerWriterProjection,\n} from \"../child/rekey/rekeyProjection\";\nimport { buildMaterializedContainerRevokePlan } from \"../child/revoke\";\nimport { selectReplacementPrincipalPolicyReferences } from \"../child/rotation/replacementPrincipalPolicyReferences\";\nimport { buildMaterializedContainerSharePlan } from \"../child/share/shareMaterialization\";\nimport { withPrecedingRematerialization } from \"./precedingPrincipalRematerialization\";\nimport {\n  addPlan,\n  type BatchPlanning,\n  carryLevel,\n  type PrincipalContainerRematerializationInput,\n  type PrincipalRematerializationPredecessor,\n  staleLevelsAbove,\n} from \"./principalContainerRematerializationPlanning\";\nimport {\n  loadRematerializationTargets,\n  loadServedProjection,\n  type MaterializedPrincipalContainerMutationPlan,\n  type PlannedRematerialization,\n  type RematerializationTarget,\n  seededPrincipalPolicyCache,\n} from \"./principalContainerRematerializationTargets\";\n\nfunction matchingGroupGrant(input: {\n  readonly directGrants: readonly ContainerDirectGrant[];\n  readonly groupId: string;\n}): ContainerDirectGrant | null {\n  return (\n    input.directGrants.find(\n      (grant) =>\n        grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n    ) ?? null\n  );\n}\n\nfunction referencedGroupKeyEpoch(input: {\n  readonly groupId: string;\n  readonly referencedPrincipalHeads: ReturnType<\n    typeof readContainerState\n  >[\"referencedPrincipalHeads\"];\n}): number | null {\n  return (\n    input.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.groupId,\n    )?.keyEpoch ?? null\n  );\n}\n\nasync function loadGrantedContainerContext(\n  input: PrincipalContainerRematerializationInput,\n  grantRow: PrincipalContainerGrant,\n  projection: ContainerWriterProjectionResponse,\n  principalPolicyCache: PrincipalPolicyCache,\n) {\n  // A projection re-rooted on a rotation this batch has yet to commit must\n  // not pin anything: its heads are speculative until acknowledged, and a\n  // pin past the group's served head would refuse the other served paths.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    principalPolicyCache,\n    projection,\n    resolveUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const state = readContainerState(\n    getTargetContainerContext(projection).manifest,\n  );\n  const grant = matchingGroupGrant({\n    directGrants: state.directGrants,\n    groupId: input.groupId,\n  });\n  if (grant && grant.accessLevel !== grantRow.accessLevel) {\n    const nextGrant = input.nextPolicy.grants.find(\n      (candidate) => candidate.containerId === grantRow.containerId,\n    );\n    if (!nextGrant || nextGrant.accessLevel !== grantRow.accessLevel) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the expected group grant`,\n      );\n    }\n  }\n  const referencedKeyEpoch = referencedGroupKeyEpoch({\n    groupId: input.groupId,\n    referencedPrincipalHeads: state.referencedPrincipalHeads,\n  });\n  if (grant && referencedKeyEpoch === null) {\n    throw new Error(\n      `Container ${grantRow.containerId} is missing its group reference`,\n    );\n  }\n  return { grant, projection, referencedKeyEpoch };\n}\n\nexport async function buildPrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<ContainerMutationRequest[]> {\n  return (\n    await buildPrincipalContainerRematerializationPlans(input)\n  ).entries.map((entry) => entry.planned.plan.request);\n}\n\nexport interface PreparedPrincipalContainerRematerializationBatch {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /**\n   * Re-sign the batch with the descendant rekeys the server named for its\n   * rotations woven in, parent-first, each against the path the batch will\n   * leave behind. A named container the batch already rotates is re-planned\n   * under what is carried above it, so no container rotates twice. Returns the\n   * whole request list, which replaces `requests`; `acknowledge` then expects\n   * the responses in that order.\n   */\n  readonly carry: (\n    requiredContainerIds: readonly string[],\n  ) => Promise<readonly ContainerMutationRequest[]>;\n  readonly plans: readonly MaterializedPrincipalContainerMutationPlan[];\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\nfunction authoredMutationHead(\n  planned: MaterializedPrincipalContainerMutationPlan,\n): AuthoredContainerMutationHead {\n  return planned.plan;\n}\n\nasync function buildPrincipalContainerRematerializationPlan(input: {\n  readonly grantRow: PrincipalContainerGrant;\n  /** Keys the batch minted above this container; see `BatchPlanning`. */\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  /** Holds the policy this batch commits, which rebased paths already cite. */\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  /** The served projection, re-rooted on any rotation planned above it. */\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n}): Promise<MaterializedPrincipalContainerMutationPlan> {\n  const { grantRow } = input;\n  const rematerialization = {\n    ...input.rematerialization,\n    nextPolicy: await selectReplacementPrincipalPolicyReferences({\n      policy: input.rematerialization.nextPolicy,\n      projection: input.projection,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveAuthoredPolicyReferences:\n        input.rematerialization.resolveAuthoredPolicyReferences,\n    }),\n  };\n  const { grant, projection, referencedKeyEpoch } =\n    await loadGrantedContainerContext(\n      rematerialization,\n      grantRow,\n      input.projection,\n      input.principalPolicyCache,\n    );\n  const nextGrant = rematerialization.nextPolicy.grants.find(\n    (candidate) => candidate.containerId === grantRow.containerId,\n  );\n  const author = {\n    ...rematerialization.author,\n    organizationId: projection.organizationId,\n  };\n  const sharedInput = {\n    author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Planning against a path this batch has yet to commit pins nothing; the\n    // acknowledgement advances every head at once. The rekey planner applies\n    // this rule itself; revoke and grant planning take it from here.\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    previousProjection: projection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  };\n  if (grantRow.containerId === rematerialization.revokedContainerId) {\n    if (!grant) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the revoked group grant`,\n      );\n    }\n    return buildMaterializedContainerRevokePlan({\n      ...sharedInput,\n      replacementPrincipalPolicy: rematerialization.nextPolicy,\n      revokedSubject: {\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (!grant || grant.accessLevel !== nextGrant?.accessLevel) {\n    if (!nextGrant) {\n      throw new Error(\n        `Container ${grantRow.containerId} is absent from the next group grant set`,\n      );\n    }\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: nextGrant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (referencedKeyEpoch === rematerialization.nextPolicy.keyEpoch) {\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: grant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  return buildMaterializedContainerRekeyPlan({\n    ...sharedInput,\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n  });\n}\n\n/**\n * Plan one target against the paths already planned above it. A grant's\n * rematerialization extends the served head; a rotation's, and every carried\n * rekey, extends the epoch the batch mints above it.\n */\nasync function planRematerializationTarget(\n  batch: BatchPlanning,\n  target: RematerializationTarget,\n): Promise<void> {\n  const { rematerialization } = batch;\n  let rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  const stale = rebased\n    ? staleLevelsAbove(\n        rebased.projection,\n        rebased.ancestor.containerKeks.at(-1)?.containerId ?? \"\",\n      )\n    : [];\n  for (const containerId of stale) {\n    await carryLevel(\n      batch,\n      await loadServedProjection(rematerialization.apiClient, containerId),\n    );\n  }\n  if (!target.grantRow) {\n    await carryLevel(batch, target.projection);\n    return;\n  }\n  // Each level carried above re-roots the target one step deeper.\n  if (stale.length > 0) {\n    rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  }\n  const previousProjection = rebased?.projection ?? target.projection;\n  const planned = await buildPrincipalContainerRematerializationPlan({\n    grantRow: target.grantRow,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    projection: previousProjection,\n    rematerialization,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n  });\n  const nextProjection =\n    \"keyring\" in planned.plan\n      ? await containerWriterProjectionFromRotationPlan({\n          plan: planned.plan,\n          previousProjection,\n        })\n      : await containerWriterProjectionFromSharePlan({\n          plan: planned.plan,\n          previousProjection,\n        });\n  addPlan(batch, {\n    carried: false,\n    planned,\n    rotated: \"keyring\" in planned.plan ? nextProjection : null,\n    nextProjection,\n  });\n}\n\n/**\n * Sign the batch parent-first. `carriedContainerIds` are the descendant rekeys\n * a refused attempt was told to carry; woven in by depth, each sits under the\n * rotation it rides, and a named container the batch rematerializes anyway is\n * re-planned there rather than rotated twice.\n */\nasync function buildPrincipalContainerRematerializationPlans(\n  input: PrincipalContainerRematerializationInput,\n  carriedContainerIds: readonly string[] = [],\n): Promise<{\n  entries: PlannedRematerialization[];\n  retiredContainerIds: readonly string[];\n  preceding: PrincipalRematerializationPredecessor;\n}> {\n  input = withPrecedingRematerialization(input);\n  if (\n    input.revokedContainerId &&\n    !input.grants.some(\n      (grant) => grant.containerId === input.revokedContainerId,\n    )\n  ) {\n    throw new Error(\"Revoked container is not granted to the group\");\n  }\n  const { targets, retiredContainerIds } = await loadRematerializationTargets({\n    apiClient: input.apiClient,\n    carriedContainerIds,\n    grants: input.grants,\n  });\n  const batch: BatchPlanning = {\n    knownContainerKeks: new Map(input.preceding?.knownContainerKeks),\n    plans: [],\n    // A rotation planned above cites the group at the head this batch commits,\n    // which no store holds yet; the cache is what lets a rebased path verify.\n    principalPolicyCache: new Map([\n      ...(input.preceding?.policies ?? []).flatMap((policy) => [\n        ...seededPrincipalPolicyCache(policy),\n      ]),\n      ...seededPrincipalPolicyCache(input.nextPolicy),\n    ]),\n    rematerialization: input,\n    resolveProjectionUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    rotatedAbove: [],\n  };\n  for (const target of targets) {\n    await planRematerializationTarget(batch, target);\n  }\n  return {\n    entries: batch.plans,\n    retiredContainerIds,\n    preceding: {\n      policies: [...(input.preceding?.policies ?? []), input.nextPolicy],\n      projections: [\n        ...(input.preceding?.projections ?? []),\n        ...batch.plans.flatMap((entry) =>\n          entry.nextProjection ? [entry.nextProjection] : [],\n        ),\n      ],\n      knownContainerKeks: batch.knownContainerKeks,\n    },\n  };\n}\n\n/**\n * The server names a level it found pinned to a retired epoch. A batch answers\n * with a rotation of it: a carried rekey, or its own rematerialization when\n * that is a rekey or revoke. A rematerialized grant rotates nothing, so a\n * batch that both grants a container and must re-key it cannot be signed;\n * no policy change the SDK builds combines the two.\n */\nfunction assertNamedContainersRotated(\n  plans: readonly PlannedRematerialization[],\n  requiredContainerIds: readonly string[],\n): void {\n  const rotatedIds = new Set(\n    plans.flatMap((entry) =>\n      entry.rotated ? [entry.planned.plan.containerId] : [],\n    ),\n  );\n  const unrotated = requiredContainerIds\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS)\n    .find((containerId) => !rotatedIds.has(containerId));\n  if (unrotated !== undefined) {\n    throw new Error(\n      `Container ${unrotated} needs a rekey this policy change only grants`,\n    );\n  }\n}\n\nexport async function preparePrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  let { entries, retiredContainerIds, preceding } =\n    await buildPrincipalContainerRematerializationPlans(input);\n  const requests = () => entries.map((entry) => entry.planned.plan.request);\n  return {\n    get preceding() {\n      return preceding;\n    },\n    get retiredContainerIds() {\n      return retiredContainerIds;\n    },\n    get plans() {\n      return entries.map((entry) => entry.planned);\n    },\n    get requests() {\n      return requests();\n    },\n    carry: async (requiredContainerIds) => {\n      // The refused attempt rolled back whole, so every served head still\n      // stands; the batch is signed again from them with the named levels in.\n      const replanned = await buildPrincipalContainerRematerializationPlans(\n        input,\n        requiredContainerIds,\n      );\n      assertNamedContainersRotated(replanned.entries, requiredContainerIds);\n      entries = replanned.entries;\n      retiredContainerIds = replanned.retiredContainerIds;\n      preceding = replanned.preceding;\n      return requests();\n    },\n    acknowledge: async (responses, stillCurrent) => {\n      const isCurrent = () =>\n        input.stillCurrent?.() !== false && stillCurrent?.() !== false;\n      const heads = entries.map((entry) => authoredMutationHead(entry.planned));\n      const acknowledged = await acknowledgeContainerMutationBatch({\n        execSql: input.execSql,\n        plans: heads,\n        responses,\n        stillCurrent: isCurrent,\n      });\n      if (!acknowledged || !isCurrent()) return;\n      const plansByOrganization = new Map<\n        string,\n        AuthoredContainerMutationHead[]\n      >();\n      for (const head of heads) {\n        const organizationId = head.state.organizationId;\n        const group = plansByOrganization.get(organizationId) ?? [];\n        group.push(head);\n        plansByOrganization.set(organizationId, group);\n      }\n      for (const [organizationId, organizationPlans] of plansByOrganization) {\n        try {\n          rememberVerifiedContainerHeads({\n            organizationId,\n            execSql: input.execSql,\n            heads: [],\n            policies: [input.nextPolicy],\n          });\n        } catch {\n          // Cache failure must not invalidate the durably acknowledged batch.\n          continue;\n        }\n        scheduleHeldDescendantRecitations({\n          apiClient: input.apiClient,\n          author: { ...input.author, organizationId },\n          execSql: input.execSql,\n          plans: organizationPlans,\n          stillCurrent: input.recitationStillCurrent ?? isCurrent,\n          reportSecurityIncident: input.reportSecurityIncident,\n        });\n      }\n    },\n  };\n}\n"]}

package/workflows/{organizations → containers}/rematerialization/principalContainerRematerializationPlanning.js

@@ -1,5 +1,5 @@
 import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
-import { planCarriedDescendantRekey, } from "../../containers/child/rekey/carriedDescendantRekeys.js";
+import { planCarriedDescendantRekey, } from "../child/rekey/carriedDescendantRekeys.js";
 /** How many rekeys the batch carries beyond its rematerializations. */
 function carriedCount(batch) {
     return batch.plans.filter((entry) => entry.carried).length;

package/workflows/containers/rematerialization/principalContainerRematerializationPlanning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalContainerRematerializationPlanning.js","sourceRoot":"","sources":["principalContainerRematerializationPlanning.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAc3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAC;AA2DhD,uEAAuE;AACvE,SAAS,YAAY,CAAC,KAAoB;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAoB,EACpB,MAAyC;IAEzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,6BAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,6BAA6B,oBAAoB,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,8DAA8D;QAC9D,sDAAsD;QACtD,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;QACxD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;QACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,YAAY;QAC3B,MAAM;QACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,IAAI;QACb,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,gBAAgB;QACjC,cAAc,EAAE,OAAO,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAoB,EACpB,KAA+B;IAE/B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO;IAC3B,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACvE,IAAI,MAAM;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6C,EAC7C,iBAAyB;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,iBAAiB,CAC/C,CAAC;IACF,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAClC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,KAAK,GAAG,CAAC;QACT,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAC5E,CAAC;IACF,OAAO,UAAU,GAAG,CAAC;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ResolvedPrincipalPolicyEvidence } from \"../../../data/keyingProjectionVerification/types\";\nimport type { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  planCarriedDescendantRekey,\n  type SpeculativePath,\n} from \"../child/rekey/carriedDescendantRekeys\";\nimport type { PlannedRematerialization } from \"./principalContainerRematerializationTargets\";\n\nexport interface RematerializationApi\n  extends ContainerReciteApi,\n    Pick<ApiClient, \"getContainerWriterProjectionResult\"> {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\nexport interface PrincipalRematerializationPredecessor {\n  readonly authored?: readonly ResolvedPrincipalPolicyEvidence[] | undefined;\n  readonly policies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly projections: readonly ContainerWriterProjectionResponse[];\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n}\n\nexport interface PrincipalContainerRematerializationInput {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly apiClient: RematerializationApi;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  readonly grants: readonly PrincipalContainerGrant[];\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly revokedContainerId?: string | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /** Session lifetime for best-effort work after durable acknowledgement. */\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** What the batch has signed so far, in the order it will be submitted. */\nexport interface BatchPlanning {\n  /**\n   * Keys the batch minted, by epoch id. A rotation wraps its successor to the\n   * group at the head this batch commits, which no store can open yet; a\n   * level planned beneath it opens that epoch with the key minted here, and\n   * its keyring then opens the retired epoch the level below is pinned to.\n   */\n  readonly knownContainerKeks: Map<string, Uint8Array>;\n  readonly plans: PlannedRematerialization[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n  readonly rotatedAbove: SpeculativePath[];\n}\n\n/** How many rekeys the batch carries beyond its rematerializations. */\nfunction carriedCount(batch: BatchPlanning): number {\n  return batch.plans.filter((entry) => entry.carried).length;\n}\n\n/**\n * Sign a rekey of `served` under the batch's rotations above it, and add it.\n * The server accepts at most `MAX_ROTATION_CONTAINER_REKEYS` carried entries;\n * past that a rematerialization below them could not be signed on a current\n * path, so the batch is refused here, before signing what the server would\n * refuse anyway, and the policy change has to wait for a lazy repair of the\n * tree. Groups granted that far apart on one chain are not a shape the SDK\n * creates.\n */\nexport async function carryLevel(\n  batch: BatchPlanning,\n  served: ContainerWriterProjectionResponse,\n): Promise<void> {\n  const { rematerialization } = batch;\n  if (carriedCount(batch) >= MAX_ROTATION_CONTAINER_REKEYS) {\n    throw new Error(\n      `Policy change would carry more than ${MAX_ROTATION_CONTAINER_REKEYS} descendant rekeys`,\n    );\n  }\n  const planned = await planCarriedDescendantRekey({\n    apiClient: rematerialization.apiClient,\n    author: rematerialization.author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    // Its path cites the policy this batch commits, so like every\n    // rematerialized rotation it must cite the successor.\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n    resolveAuthoredPolicyReferences:\n      rematerialization.resolveAuthoredPolicyReferences,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n    rotated: batch.rotatedAbove,\n    served,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  });\n  addPlan(batch, {\n    carried: true,\n    planned,\n    rotated: planned.writerProjection,\n    nextProjection: planned.writerProjection,\n  });\n}\n\nexport function addPlan(\n  batch: BatchPlanning,\n  entry: PlannedRematerialization,\n): void {\n  batch.plans.push(entry);\n  if (!entry.rotated) return;\n  batch.rotatedAbove.push(entry.rotated);\n  const minted = entry.rotated.containerKeks.at(-1)?.containerKeyEpochId;\n  if (minted) batch.knownContainerKeks.set(minted, entry.planned.containerKey);\n}\n\n/**\n * Levels of a re-rooted path pinned to an epoch the batch retires above them:\n * those strictly between the rotated ancestor the path was re-rooted on and\n * the target, parent-first, from the first stale one down. A rotation planned\n * above a target strands every level between the two, and each must be\n * re-keyed under the one above before the target can be signed. The batch\n * carries them without waiting to be told: they are proper ancestors of a\n * granted container, so the server would name them, and a refusal per level\n * is a round trip each. Anything stale above the rotated ancestor is not this\n * batch's doing and is left alone. `carryLevel` holds the count to the cap.\n */\nexport function staleLevelsAbove(\n  projection: ContainerWriterProjectionResponse,\n  rotatedAncestorId: string,\n): string[] {\n  const keks = projection.containerKeks;\n  const ancestor = keks.findIndex(\n    (kek) => kek.containerId === rotatedAncestorId,\n  );\n  if (ancestor < 0) return [];\n  const between = keks.slice(ancestor, -1);\n  const firstStale = between.findIndex(\n    (kek, index) =>\n      index > 0 &&\n      kek.parentContainerKeyEpochId !== between[index - 1]?.containerKeyEpochId,\n  );\n  return firstStale < 0\n    ? []\n    : between.slice(firstStale).map((kek) => kek.containerId);\n}\n"]}

package/workflows/containers/rematerialization/principalContainerRematerializationTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalContainerRematerializationTargets.js","sourceRoot":"","sources":["principalContainerRematerializationTargets.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAO9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iFAAiF,CAAC;AA4B/H;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAOhD,KAAmB;IACnB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM;QAC1D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAC1E,CAAC;AACJ,CAAC;AAQD,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAwB,EACxB,WAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,+CAA+C,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IAIC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC3C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CACvE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3C,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,IACE,QAAQ;gBACR,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,0BAA0B,CAAC,MAAM,CAAC,EAClC,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,kDAAkD,MAAM,CAAC,OAAO,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,OAAO,CAAC;QACpD,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,UAA0C;IAE1C,OAAO,IAAI,GAAG,CAAC;QACb;YACE,4BAA4B,CAAC;gBAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,UAAU;SACX;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n  MaterializedContainerRekeyPlan,\n  MaterializedContainerRevokePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport { referencedPrincipalPolicyKey } from \"../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SpeculativePath } from \"../child/rekey/carriedDescendantRekeys\";\n\nexport type MaterializedPrincipalContainerMutationPlan =\n  | MaterializedContainerRekeyPlan\n  | MaterializedContainerRevokePlan\n  | MaterializedContainerSharePlan;\n\n/** Authored paths for chaining plans; only rotated is null for a grant. */\nexport interface PlannedRematerialization {\n  /** The authored successor for either a grant or a rotation. */\n  readonly nextProjection?: ContainerWriterProjectionResponse | undefined;\n  /** A descendant rekey carried for a rotation above, not a rematerialization. */\n  readonly carried: boolean;\n  readonly planned: MaterializedPrincipalContainerMutationPlan;\n  readonly rotated: SpeculativePath | null;\n}\n\n/**\n * One container a batch signs for: a group grant it rematerializes, or a\n * descendant rekey it carries for a rotation above (`grantRow` null).\n */\nexport interface RematerializationTarget {\n  readonly grantRow: PrincipalContainerGrant | null;\n  readonly projection: ContainerWriterProjectionResponse;\n}\n\n/**\n * Order a batch parent-first, by served depth. A group granted on a container\n * and on one of its descendants rotates both, and the lower rotation must be\n * signed against the epoch the upper one mints in this same batch, or it\n * extends a head the batch itself retires. A carried rekey sits below the\n * rotation it rides for the same reason. Ties keep id order for stability.\n */\nexport function orderRematerializationsParentFirst<\n  T extends {\n    readonly projection: {\n      readonly containerId: string;\n      readonly path: readonly unknown[];\n    };\n  },\n>(batch: readonly T[]): T[] {\n  return [...batch].sort(\n    (left, right) =>\n      left.projection.path.length - right.projection.path.length ||\n      left.projection.containerId.localeCompare(right.projection.containerId),\n  );\n}\n\ninterface ProjectionApi {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\n/** The served projection of a container the batch will sign for. */\nexport async function loadServedProjection(\n  apiClient: ProjectionApi,\n  containerId: string,\n): Promise<ContainerWriterProjectionResponse> {\n  const projection = await apiClient.getContainerWriterProjection(containerId);\n  if (!projection) {\n    throw new Error(\n      `Container ${containerId} could not be prepared for principal rotation`,\n    );\n  }\n  if (projection.containerId !== containerId) {\n    throw new Error(\"Served projection describes another container\");\n  }\n  return projection;\n}\n\n/**\n * Fetch what the batch signs for, parent-first. A named descendant the batch\n * already rematerializes is not fetched twice: its own rotation is re-planned\n * under whatever the batch carries above it. Names are a hint from the server,\n * never an authority; each is verified where it is planned.\n */\nexport async function loadRematerializationTargets(input: {\n  readonly apiClient: Pick<ApiClient, \"getContainerWriterProjectionResult\">;\n  readonly carriedContainerIds: readonly string[];\n  readonly grants: readonly PrincipalContainerGrant[];\n}): Promise<{\n  targets: RematerializationTarget[];\n  retiredContainerIds: string[];\n}> {\n  const grantByContainerId = new Map(\n    input.grants.map((grant) => [grant.containerId, grant] as const),\n  );\n  const carried = [...new Set(input.carriedContainerIds)]\n    .filter((containerId) => !grantByContainerId.has(containerId))\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS);\n  const targets: RematerializationTarget[] = [];\n  const retiredContainerIds: string[] = [];\n  for (const containerId of [...grantByContainerId.keys(), ...carried].sort(\n    (left, right) => left.localeCompare(right),\n  )) {\n    const grantRow = grantByContainerId.get(containerId) ?? null;\n    const result = await input.apiClient.getContainerWriterProjectionResult(\n      containerId,\n      { reportErrors: false },\n    );\n    if (!result.ok) {\n      // This is only a planning hint. Keep the signed grant intact; the API\n      // independently requires every live grant under the organization lock.\n      if (\n        grantRow &&\n        result.kind === \"http\" &&\n        isContainerNotFoundFailure(result)\n      ) {\n        retiredContainerIds.push(containerId);\n        continue;\n      }\n      result.report();\n      throw new Error(\n        `Container ${containerId} could not be prepared for principal rotation: ${result.message}`,\n      );\n    }\n    if (result.data.containerId !== containerId)\n      throw new Error(\"Served projection describes another container\");\n    targets.push({ grantRow, projection: result.data });\n  }\n  return {\n    targets: orderRematerializationsParentFirst(targets),\n    retiredContainerIds,\n  };\n}\n\n/** An in-memory cache holding only the policy this batch is about to commit. */\nexport function seededPrincipalPolicyCache(\n  nextPolicy: PrincipalPolicyCurrentEvidence,\n): PrincipalPolicyCache {\n  return new Map([\n    [\n      referencedPrincipalPolicyKey({\n        keyEpoch: nextPolicy.keyEpoch,\n        keyFingerprint: nextPolicy.state.keyFingerprint,\n        principalId: nextPolicy.principalId,\n        principalType: nextPolicy.principalType,\n        stateHash: nextPolicy.stateHash,\n        version: nextPolicy.version,\n      }),\n      nextPolicy,\n    ],\n  ]);\n}\n"]}

package/workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAIxG,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAsBpE,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CACpD,KAAK,EACL,MAAM,EACN,MAAM,EAAE,SAAS,CAClB,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CAChD,KAAK,EACL,YAAY,EACZ,MAAM,EAAE,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;QACpC,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,sCAAsC,CAC1C;QACE,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,kBAAkB,EAAE,mBAAmB;QACvC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,gBAAgB,EACd,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY;YACnC,CAAC,CAAC;gBACE;oBACE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;oBAC7B,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,mBAAmB;iBAC1D;aACF;YACH,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAC/B,QAAQ,CAAC,YAAY,CAAC,kBAAkB,EACxC,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,MAAyE,EACzE,SAAiD;IAEjD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;QACnD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,yBAAyB,CACrD,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC3B,CAAC,CAAC;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,QAAQ,EAAE;oBACR,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;oBAC9B;wBACE,cAAc,EACZ,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc;wBACtD,MAAM,EAAE,UAAU;wBAClB,YAAY,EAAE;4BACZ,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM;4BACzC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM;yBACnC;wBACD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;qBAC1C;iBACF;aACF;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,YAAiE,EACjE,UAA2E;IAE3E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IACE,KAAK,CAAC,MAAM;QACZ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YAC1D,OAAO,CAAC,aAAa;YACrB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY;iBAC1D,SAAS;gBACV,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;QAE/D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,IAAI,UAAU,GAAG,4BAA4B,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,UAAU;QACZ,UAAU,GAAG,4BAA4B,CAAC;YACxC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,UAAU,EAAE;YAC7D,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;IACL,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,4CAA4C,CAAC;QAClD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"../groups/organizationGroupDirectory\";\nimport { assertAuthoredPrincipalMutationReceipt } from \"../principalMutations/principalMutationReceipt\";\nimport type { RuntimeCurrentGroupMutationContext } from \"../principalMutations/runtimeCurrentGroupMutation\";\nimport type { PreparedPrincipalContainerRematerializationBatch } from \"../rematerialization/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../rematerialization/principalContainerRematerializationPlanning\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\n\ninterface GroupPolicyChange {\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n    preceding?: PrincipalRematerializationPredecessor | undefined,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}\n\ninterface CommitInput extends GroupPolicyChange {\n  readonly member?: GroupPolicyChange | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\n/** Commit and retain the group, optional roster enrollment and directory together. */\nexport async function commitCurrentGroupPolicyMutation(\n  input: CommitInput,\n): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const member = input.member\n    ? await prepareChange(input.member, signer)\n    : null;\n  const { expectedHead, prepared } = await prepareChange(\n    input,\n    signer,\n    member?.preceding,\n  );\n  const organizationRequest = await prepareDirectory(\n    input,\n    expectedHead,\n    member?.expectedHead,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    memberRequest: input.member?.request,\n    // A compound retry must rebuild both batches' shared speculative heads.\n    // Refuse the whole transaction if a damaged-key repair needs extra rekeys;\n    // ordinary adds preserve key epochs and need no descendant carry retry.\n    carryDescendantRekeys: member ? undefined : prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await assertAuthoredPrincipalMutationReceipt(\n    {\n      groupPolicy: input.request,\n      organizationPolicy: organizationRequest,\n      ...(input.member ? { memberPolicy: input.member.request } : {}),\n    },\n    response,\n  );\n  await context.retainAcknowledged({\n    additionalGroups:\n      input.member && response.memberPolicy\n        ? [\n            {\n              ...input.member.context.groupRetention,\n              request: input.member.request,\n              response: response.memberPolicy,\n              retiredContainerIds: member?.prepared.retiredContainerIds,\n            },\n          ]\n        : [],\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  if (member && response.memberPolicy) {\n    await member.prepared.acknowledge(\n      response.memberPolicy.containerMutations,\n      context.stillCurrent,\n    );\n  }\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n\nasync function prepareChange(\n  change: GroupPolicyChange,\n  signer: Awaited<ReturnType<typeof resolveRequiredUserIdentities>>[number],\n  preceding?: PrincipalRematerializationPredecessor,\n) {\n  const expectedHead = await groupPolicyMutationHead(change.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,\n    expectedHead,\n    request: change.request,\n    signerPublicKeys: [signer],\n    externalAuthority: change.context.externalAuthority,\n    localPolicyCheckpoint: change.context.localPolicyCheckpoint,\n    stillCurrent: change.context.stillCurrent,\n  });\n  const prepared = await change.prepareContainerMutations(\n    nextPolicy,\n    preceding,\n  );\n  change.request.containerMutations = [...prepared.requests];\n  return {\n    expectedHead,\n    prepared,\n    preceding: prepared.preceding\n      ? {\n          ...prepared.preceding,\n          authored: [\n            ...(preceding?.authored ?? []),\n            {\n              organizationId:\n                change.context.organizationDescriptor.organizationId,\n              policy: nextPolicy,\n              dependencies: [\n                change.context.organizationCurrent.policy,\n                change.context.adminCurrent.policy,\n              ],\n              stillCurrent: change.context.stillCurrent,\n            },\n          ],\n        }\n      : undefined,\n  };\n}\n\nasync function prepareDirectory(\n  input: CommitInput,\n  expectedHead: Awaited<ReturnType<typeof groupPolicyMutationHead>>,\n  memberHead: Awaited<ReturnType<typeof groupPolicyMutationHead>> | undefined,\n) {\n  const { context } = input;\n  if (\n    input.member &&\n    (input.member.context.currentPolicy.currentState.principalId !==\n      context.memberGroupId ||\n      input.member.context.organizationCurrent.current.currentState\n        .stateHash !==\n        context.organizationCurrent.current.currentState.stateHash)\n  )\n    throw new Error(\n      \"Roster and group changes must share the same organization policy\",\n    );\n  let groupHeads = replaceOrganizationGroupHead({\n    descriptor: context.organizationDescriptor,\n    nextHead: expectedHead,\n  });\n  if (memberHead)\n    groupHeads = replaceOrganizationGroupHead({\n      descriptor: { ...context.organizationDescriptor, groupHeads },\n      nextHead: memberHead,\n    });\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  return buildOrganizationGroupDirectoryPolicyRequest({\n    adminProjection,\n    adminUsers,\n    currentPolicy: context.organizationCurrent.current,\n    descriptor: context.organizationDescriptor,\n    groupHeads,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}
+{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAMvG,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAExG,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAsBpE,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CACpD,KAAK,EACL,MAAM,EACN,MAAM,EAAE,SAAS,CAClB,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CAChD,KAAK,EACL,YAAY,EACZ,MAAM,EAAE,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;QACpC,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,sCAAsC,CAC1C;QACE,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,kBAAkB,EAAE,mBAAmB;QACvC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,gBAAgB,EACd,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY;YACnC,CAAC,CAAC;gBACE;oBACE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;oBAC7B,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,mBAAmB;iBAC1D;aACF;YACH,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAC/B,QAAQ,CAAC,YAAY,CAAC,kBAAkB,EACxC,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,MAAyE,EACzE,SAAiD;IAEjD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;QACnD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,yBAAyB,CACrD,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC3B,CAAC,CAAC;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,QAAQ,EAAE;oBACR,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;oBAC9B;wBACE,cAAc,EACZ,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc;wBACtD,MAAM,EAAE,UAAU;wBAClB,YAAY,EAAE;4BACZ,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM;4BACzC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM;yBACnC;wBACD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;qBAC1C;iBACF;aACF;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,YAAiE,EACjE,UAA2E;IAE3E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IACE,KAAK,CAAC,MAAM;QACZ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YAC1D,OAAO,CAAC,aAAa;YACrB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY;iBAC1D,SAAS;gBACV,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;QAE/D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,IAAI,UAAU,GAAG,4BAA4B,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,UAAU;QACZ,UAAU,GAAG,4BAA4B,CAAC;YACxC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,UAAU,EAAE;YAC7D,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;IACL,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,4CAA4C,CAAC;QAClD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type {\n  PreparedPrincipalContainerRematerializationBatch,\n  PrincipalRematerializationPredecessor,\n} from \"../../containers/rematerialization\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"../groups/organizationGroupDirectory\";\nimport { assertAuthoredPrincipalMutationReceipt } from \"../principalMutations/principalMutationReceipt\";\nimport type { RuntimeCurrentGroupMutationContext } from \"../principalMutations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\n\ninterface GroupPolicyChange {\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n    preceding?: PrincipalRematerializationPredecessor | undefined,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}\n\ninterface CommitInput extends GroupPolicyChange {\n  readonly member?: GroupPolicyChange | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\n/** Commit and retain the group, optional roster enrollment and directory together. */\nexport async function commitCurrentGroupPolicyMutation(\n  input: CommitInput,\n): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const member = input.member\n    ? await prepareChange(input.member, signer)\n    : null;\n  const { expectedHead, prepared } = await prepareChange(\n    input,\n    signer,\n    member?.preceding,\n  );\n  const organizationRequest = await prepareDirectory(\n    input,\n    expectedHead,\n    member?.expectedHead,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    memberRequest: input.member?.request,\n    // A compound retry must rebuild both batches' shared speculative heads.\n    // Refuse the whole transaction if a damaged-key repair needs extra rekeys;\n    // ordinary adds preserve key epochs and need no descendant carry retry.\n    carryDescendantRekeys: member ? undefined : prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await assertAuthoredPrincipalMutationReceipt(\n    {\n      groupPolicy: input.request,\n      organizationPolicy: organizationRequest,\n      ...(input.member ? { memberPolicy: input.member.request } : {}),\n    },\n    response,\n  );\n  await context.retainAcknowledged({\n    additionalGroups:\n      input.member && response.memberPolicy\n        ? [\n            {\n              ...input.member.context.groupRetention,\n              request: input.member.request,\n              response: response.memberPolicy,\n              retiredContainerIds: member?.prepared.retiredContainerIds,\n            },\n          ]\n        : [],\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  if (member && response.memberPolicy) {\n    await member.prepared.acknowledge(\n      response.memberPolicy.containerMutations,\n      context.stillCurrent,\n    );\n  }\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n\nasync function prepareChange(\n  change: GroupPolicyChange,\n  signer: Awaited<ReturnType<typeof resolveRequiredUserIdentities>>[number],\n  preceding?: PrincipalRematerializationPredecessor,\n) {\n  const expectedHead = await groupPolicyMutationHead(change.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,\n    expectedHead,\n    request: change.request,\n    signerPublicKeys: [signer],\n    externalAuthority: change.context.externalAuthority,\n    localPolicyCheckpoint: change.context.localPolicyCheckpoint,\n    stillCurrent: change.context.stillCurrent,\n  });\n  const prepared = await change.prepareContainerMutations(\n    nextPolicy,\n    preceding,\n  );\n  change.request.containerMutations = [...prepared.requests];\n  return {\n    expectedHead,\n    prepared,\n    preceding: prepared.preceding\n      ? {\n          ...prepared.preceding,\n          authored: [\n            ...(preceding?.authored ?? []),\n            {\n              organizationId:\n                change.context.organizationDescriptor.organizationId,\n              policy: nextPolicy,\n              dependencies: [\n                change.context.organizationCurrent.policy,\n                change.context.adminCurrent.policy,\n              ],\n              stillCurrent: change.context.stillCurrent,\n            },\n          ],\n        }\n      : undefined,\n  };\n}\n\nasync function prepareDirectory(\n  input: CommitInput,\n  expectedHead: Awaited<ReturnType<typeof groupPolicyMutationHead>>,\n  memberHead: Awaited<ReturnType<typeof groupPolicyMutationHead>> | undefined,\n) {\n  const { context } = input;\n  if (\n    input.member &&\n    (input.member.context.currentPolicy.currentState.principalId !==\n      context.memberGroupId ||\n      input.member.context.organizationCurrent.current.currentState\n        .stateHash !==\n        context.organizationCurrent.current.currentState.stateHash)\n  )\n    throw new Error(\n      \"Roster and group changes must share the same organization policy\",\n    );\n  let groupHeads = replaceOrganizationGroupHead({\n    descriptor: context.organizationDescriptor,\n    nextHead: expectedHead,\n  });\n  if (memberHead)\n    groupHeads = replaceOrganizationGroupHead({\n      descriptor: { ...context.organizationDescriptor, groupHeads },\n      nextHead: memberHead,\n    });\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  return buildOrganizationGroupDirectoryPolicyRequest({\n    adminProjection,\n    adminUsers,\n    currentPolicy: context.organizationCurrent.current,\n    descriptor: context.organizationDescriptor,\n    groupHeads,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}

package/workflows/organizations/rematerialization/precedingPrincipalRematerialization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"precedingPrincipalRematerialization.js","sourceRoot":"","sources":["precedingPrincipalRematerialization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,4FAA4F;AAC5F,MAAM,UAAU,8BAA8B,CAC5C,KAA+C;IAE/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,MAAyC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,CAAC;QACjC,OAAO,CACL,uBAAuB,CAAC,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,UAAU;YACtE,UAAU,CACX,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,6BAA6B,CAC5D,KAAK,CAAC,+BAA+B,EACrC,SAAS,CAAC,QAAQ,IAAI,EAAE,CACzB;QACD,SAAS,EAAE;YACT,GAAG,KAAK,CAAC,SAAS;YAClB,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,4BAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;gBAClD,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;gBAClE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC;YACD,kCAAkC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { rebaseOnDeepestAncestor } from \"../../containers/child/rekey/carriedDescendantRekeys\";\nimport { withAuthoredPrincipalPolicies } from \"./authoredPrincipalPolicyWarmer\";\nimport type { PrincipalContainerRematerializationInput } from \"./principalContainerRematerializationPlanning\";\n\n/** Plan the next group against container heads authored earlier in the same transaction. */\nexport function withPrecedingRematerialization(\n  input: PrincipalContainerRematerializationInput,\n): PrincipalContainerRematerializationInput {\n  const preceding = input.preceding;\n  if (!preceding) return input;\n  const rebase = (served: ContainerWriterProjectionResponse) => {\n    const own = preceding.projections.findLast(\n      (projection) => projection.containerId === served.containerId,\n    );\n    const projection = own ?? served;\n    return (\n      rebaseOnDeepestAncestor(projection, preceding.projections)?.projection ??\n      projection\n    );\n  };\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: withAuthoredPrincipalPolicies(\n      input.warmReferencedPrincipalPolicies,\n      preceding.authored ?? [],\n    ),\n    apiClient: {\n      ...input.apiClient,\n      reciteContainer: input.apiClient.reciteContainer.bind(input.apiClient),\n      getContainerWriterProjection: async (containerId) => {\n        const projection =\n          await input.apiClient.getContainerWriterProjection(containerId);\n        return projection ? rebase(projection) : null;\n      },\n      getContainerWriterProjectionResult: async (containerId, options) => {\n        const result = await input.apiClient.getContainerWriterProjectionResult(\n          containerId,\n          options,\n        );\n        return result.ok ? { ...result, data: rebase(result.data) } : result;\n      },\n    },\n  };\n}\n"]}

package/workflows/organizations/rematerialization/principalContainerRematerialization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerialization.js","sourceRoot":"","sources":["principalContainerRematerialization.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,yDAAyD,CAAC;AAC5G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAC7G,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,sEAAsE,CAAC;AAClI,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EACL,OAAO,EAEP,UAAU,EAGV,gBAAgB,GACjB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EAIpB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AAEtD,SAAS,kBAAkB,CAAC,KAG3B;IACC,OAAO,CACL,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAKhC;IACC,OAAO,CACL,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,EAAE,QAAQ,IAAI,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA+C,EAC/C,QAAiC,EACjC,UAA6C,EAC7C,oBAA0C;IAE1C,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,oBAAoB;QACpB,UAAU;QACV,cAAc,EAAE,+BAA+B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,4CAA4C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,iCAAiC,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,KAA+C;IAE/C,OAAO,CACL,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAwBD,SAAS,oBAAoB,CAC3B,OAAmD;IAEnD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,4CAA4C,CAAC,KAY3D;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,iBAAiB,GAAG;QACxB,GAAG,KAAK,CAAC,iBAAiB;QAC1B,UAAU,EAAE,MAAM,0CAA0C,CAAC;YAC3D,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,UAAU;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,+BAA+B,EAC7B,KAAK,CAAC,iBAAiB,CAAC,+BAA+B;SAC1D,CAAC;KACH,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAC7C,MAAM,2BAA2B,CAC/B,iBAAiB,EACjB,QAAQ,EACR,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACJ,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,iBAAiB,CAAC,MAAM;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;KAC1C,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,8BAA8B,EAC5B,CAAC,sCAAsC,CAAC,UAAU,CAAC;QACrD,kBAAkB,EAAE,UAAU;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,2CAA2C,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,GAAG,WAAW;YACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;YACxD,cAAc,EAAE;gBACd,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,WAAW,0CAA0C,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjE,OAAO,mCAAmC,CAAC;YACzC,GAAG,WAAW;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE;gBACT,eAAe,EAAE,iBAAiB,CAAC,UAAU;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,OAAO;gBACpC,WAAW,EAAE,OAAO;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,GAAG,WAAW;QACd,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAoB,EACpB,MAA+B;IAE/B,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,gBAAgB,CACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CACzD;QACH,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,CACd,KAAK,EACL,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,gEAAgE;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,kBAAkB;QAC9B,iBAAiB;QACjB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,MAAM,cAAc,GAClB,SAAS,IAAI,OAAO,CAAC,IAAI;QACvB,CAAC,CAAC,MAAM,yCAAyC,CAAC;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC;QACJ,CAAC,CAAC,MAAM,sCAAsC,CAAC;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,kBAAkB;SACnB,CAAC,CAAC;IACT,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,KAAK;QACd,OAAO;QACP,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC1D,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6CAA6C,CAC1D,KAA+C,EAC/C,sBAAyC,EAAE;IAM3C,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9C,IACE,KAAK,CAAC,kBAAkB;QACxB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,4BAA4B,CAAC;QAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAkB;QAC3B,kBAAkB,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC;QAChE,KAAK,EAAE,EAAE;QACT,2EAA2E;QAC3E,0EAA0E;QAC1E,oBAAoB,EAAE,IAAI,GAAG,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvD,GAAG,0BAA0B,CAAC,MAAM,CAAC;aACtC,CAAC;YACF,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;SAChD,CAAC;QACF,iBAAiB,EAAE,KAAK;QACxB,wBAAwB,EAAE,+BAA+B,CAAC;YACxD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,YAAY,EAAE,EAAE;KACjB,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,mBAAmB;QACnB,SAAS,EAAE;YACT,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;YAClE,WAAW,EAAE;gBACX,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC;gBACvC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD;aACF;YACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,KAA0C,EAC1C,oBAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB;SACnC,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC;SACvC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,aAAa,SAAS,+CAA+C,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CACnE,KAA+C;IAE/C,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAC7C,MAAM,6CAA6C,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,SAAS;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,mBAAmB;YACrB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK;YACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE;YACpC,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,6CAA6C,CACnE,KAAK,EACL,oBAAoB,CACrB,CAAC;YACF,4BAA4B,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACtE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;YACpD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YAChC,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;YAC7C,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;gBAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK;gBACZ,SAAS;gBACT,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO;YAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;YACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,mBAAmB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACtE,IAAI,CAAC;oBACH,8BAA8B,CAAC;wBAC7B,cAAc;wBACd,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,KAAK,EAAE,EAAE;wBACT,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,SAAS;gBACX,CAAC;gBACD,iCAAiC,CAAC;oBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE;oBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,SAAS;oBACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerDirectGrant,\n  PrincipalContainerGrant,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { acknowledgeContainerMutationBatch } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  type PrincipalPolicyCache,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport { scheduleHeldDescendantRecitations } from \"../../containers/child/recite\";\nimport { buildMaterializedContainerRekeyPlan } from \"../../containers/child/rekey\";\nimport { rebaseOnDeepestAncestor } from \"../../containers/child/rekey/carriedDescendantRekeys\";\nimport {\n  containerWriterProjectionFromRotationPlan,\n  containerWriterProjectionFromSharePlan,\n  isSpeculativeContainerWriterProjection,\n} from \"../../containers/child/rekey/rekeyProjection\";\nimport { buildMaterializedContainerRevokePlan } from \"../../containers/child/revoke\";\nimport { selectReplacementPrincipalPolicyReferences } from \"../../containers/child/rotation/replacementPrincipalPolicyReferences\";\nimport { buildMaterializedContainerSharePlan } from \"../../containers/child/share/shareMaterialization\";\nimport { withPrecedingRematerialization } from \"./precedingPrincipalRematerialization\";\nimport {\n  addPlan,\n  type BatchPlanning,\n  carryLevel,\n  type PrincipalContainerRematerializationInput,\n  type PrincipalRematerializationPredecessor,\n  staleLevelsAbove,\n} from \"./principalContainerRematerializationPlanning\";\nimport {\n  loadRematerializationTargets,\n  loadServedProjection,\n  type MaterializedPrincipalContainerMutationPlan,\n  type PlannedRematerialization,\n  type RematerializationTarget,\n  seededPrincipalPolicyCache,\n} from \"./principalContainerRematerializationTargets\";\n\nfunction matchingGroupGrant(input: {\n  readonly directGrants: readonly ContainerDirectGrant[];\n  readonly groupId: string;\n}): ContainerDirectGrant | null {\n  return (\n    input.directGrants.find(\n      (grant) =>\n        grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n    ) ?? null\n  );\n}\n\nfunction referencedGroupKeyEpoch(input: {\n  readonly groupId: string;\n  readonly referencedPrincipalHeads: ReturnType<\n    typeof readContainerState\n  >[\"referencedPrincipalHeads\"];\n}): number | null {\n  return (\n    input.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.groupId,\n    )?.keyEpoch ?? null\n  );\n}\n\nasync function loadGrantedContainerContext(\n  input: PrincipalContainerRematerializationInput,\n  grantRow: PrincipalContainerGrant,\n  projection: ContainerWriterProjectionResponse,\n  principalPolicyCache: PrincipalPolicyCache,\n) {\n  // A projection re-rooted on a rotation this batch has yet to commit must\n  // not pin anything: its heads are speculative until acknowledged, and a\n  // pin past the group's served head would refuse the other served paths.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    principalPolicyCache,\n    projection,\n    resolveUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const state = readContainerState(\n    getTargetContainerContext(projection).manifest,\n  );\n  const grant = matchingGroupGrant({\n    directGrants: state.directGrants,\n    groupId: input.groupId,\n  });\n  if (grant && grant.accessLevel !== grantRow.accessLevel) {\n    const nextGrant = input.nextPolicy.grants.find(\n      (candidate) => candidate.containerId === grantRow.containerId,\n    );\n    if (!nextGrant || nextGrant.accessLevel !== grantRow.accessLevel) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the expected group grant`,\n      );\n    }\n  }\n  const referencedKeyEpoch = referencedGroupKeyEpoch({\n    groupId: input.groupId,\n    referencedPrincipalHeads: state.referencedPrincipalHeads,\n  });\n  if (grant && referencedKeyEpoch === null) {\n    throw new Error(\n      `Container ${grantRow.containerId} is missing its group reference`,\n    );\n  }\n  return { grant, projection, referencedKeyEpoch };\n}\n\nexport async function buildPrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<ContainerMutationRequest[]> {\n  return (\n    await buildPrincipalContainerRematerializationPlans(input)\n  ).entries.map((entry) => entry.planned.plan.request);\n}\n\nexport interface PreparedPrincipalContainerRematerializationBatch {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /**\n   * Re-sign the batch with the descendant rekeys the server named for its\n   * rotations woven in, parent-first, each against the path the batch will\n   * leave behind. A named container the batch already rotates is re-planned\n   * under what is carried above it, so no container rotates twice. Returns the\n   * whole request list, which replaces `requests`; `acknowledge` then expects\n   * the responses in that order.\n   */\n  readonly carry: (\n    requiredContainerIds: readonly string[],\n  ) => Promise<readonly ContainerMutationRequest[]>;\n  readonly plans: readonly MaterializedPrincipalContainerMutationPlan[];\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\nfunction authoredMutationHead(\n  planned: MaterializedPrincipalContainerMutationPlan,\n): AuthoredContainerMutationHead {\n  return planned.plan;\n}\n\nasync function buildPrincipalContainerRematerializationPlan(input: {\n  readonly grantRow: PrincipalContainerGrant;\n  /** Keys the batch minted above this container; see `BatchPlanning`. */\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  /** Holds the policy this batch commits, which rebased paths already cite. */\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  /** The served projection, re-rooted on any rotation planned above it. */\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n}): Promise<MaterializedPrincipalContainerMutationPlan> {\n  const { grantRow } = input;\n  const rematerialization = {\n    ...input.rematerialization,\n    nextPolicy: await selectReplacementPrincipalPolicyReferences({\n      policy: input.rematerialization.nextPolicy,\n      projection: input.projection,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveAuthoredPolicyReferences:\n        input.rematerialization.resolveAuthoredPolicyReferences,\n    }),\n  };\n  const { grant, projection, referencedKeyEpoch } =\n    await loadGrantedContainerContext(\n      rematerialization,\n      grantRow,\n      input.projection,\n      input.principalPolicyCache,\n    );\n  const nextGrant = rematerialization.nextPolicy.grants.find(\n    (candidate) => candidate.containerId === grantRow.containerId,\n  );\n  const author = {\n    ...rematerialization.author,\n    organizationId: projection.organizationId,\n  };\n  const sharedInput = {\n    author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Planning against a path this batch has yet to commit pins nothing; the\n    // acknowledgement advances every head at once. The rekey planner applies\n    // this rule itself; revoke and grant planning take it from here.\n    persistVerificationCheckpoints:\n      !isSpeculativeContainerWriterProjection(projection),\n    previousProjection: projection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  };\n  if (grantRow.containerId === rematerialization.revokedContainerId) {\n    if (!grant) {\n      throw new Error(\n        `Container ${grantRow.containerId} does not contain the revoked group grant`,\n      );\n    }\n    return buildMaterializedContainerRevokePlan({\n      ...sharedInput,\n      replacementPrincipalPolicy: rematerialization.nextPolicy,\n      revokedSubject: {\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (!grant || grant.accessLevel !== nextGrant?.accessLevel) {\n    if (!nextGrant) {\n      throw new Error(\n        `Container ${grantRow.containerId} is absent from the next group grant set`,\n      );\n    }\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: nextGrant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  if (referencedKeyEpoch === rematerialization.nextPolicy.keyEpoch) {\n    return buildMaterializedContainerSharePlan({\n      ...sharedInput,\n      accessLevel: grant.accessLevel,\n      recipient: {\n        principalPolicy: rematerialization.nextPolicy,\n        subjectId: rematerialization.groupId,\n        subjectType: \"group\",\n      },\n    });\n  }\n  return buildMaterializedContainerRekeyPlan({\n    ...sharedInput,\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n  });\n}\n\n/**\n * Plan one target against the paths already planned above it. A grant's\n * rematerialization extends the served head; a rotation's, and every carried\n * rekey, extends the epoch the batch mints above it.\n */\nasync function planRematerializationTarget(\n  batch: BatchPlanning,\n  target: RematerializationTarget,\n): Promise<void> {\n  const { rematerialization } = batch;\n  let rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  const stale = rebased\n    ? staleLevelsAbove(\n        rebased.projection,\n        rebased.ancestor.containerKeks.at(-1)?.containerId ?? \"\",\n      )\n    : [];\n  for (const containerId of stale) {\n    await carryLevel(\n      batch,\n      await loadServedProjection(rematerialization.apiClient, containerId),\n    );\n  }\n  if (!target.grantRow) {\n    await carryLevel(batch, target.projection);\n    return;\n  }\n  // Each level carried above re-roots the target one step deeper.\n  if (stale.length > 0) {\n    rebased = rebaseOnDeepestAncestor(target.projection, batch.rotatedAbove);\n  }\n  const previousProjection = rebased?.projection ?? target.projection;\n  const planned = await buildPrincipalContainerRematerializationPlan({\n    grantRow: target.grantRow,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    projection: previousProjection,\n    rematerialization,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n  });\n  const nextProjection =\n    \"keyring\" in planned.plan\n      ? await containerWriterProjectionFromRotationPlan({\n          plan: planned.plan,\n          previousProjection,\n        })\n      : await containerWriterProjectionFromSharePlan({\n          plan: planned.plan,\n          previousProjection,\n        });\n  addPlan(batch, {\n    carried: false,\n    planned,\n    rotated: \"keyring\" in planned.plan ? nextProjection : null,\n    nextProjection,\n  });\n}\n\n/**\n * Sign the batch parent-first. `carriedContainerIds` are the descendant rekeys\n * a refused attempt was told to carry; woven in by depth, each sits under the\n * rotation it rides, and a named container the batch rematerializes anyway is\n * re-planned there rather than rotated twice.\n */\nasync function buildPrincipalContainerRematerializationPlans(\n  input: PrincipalContainerRematerializationInput,\n  carriedContainerIds: readonly string[] = [],\n): Promise<{\n  entries: PlannedRematerialization[];\n  retiredContainerIds: readonly string[];\n  preceding: PrincipalRematerializationPredecessor;\n}> {\n  input = withPrecedingRematerialization(input);\n  if (\n    input.revokedContainerId &&\n    !input.grants.some(\n      (grant) => grant.containerId === input.revokedContainerId,\n    )\n  ) {\n    throw new Error(\"Revoked container is not granted to the group\");\n  }\n  const { targets, retiredContainerIds } = await loadRematerializationTargets({\n    apiClient: input.apiClient,\n    carriedContainerIds,\n    grants: input.grants,\n  });\n  const batch: BatchPlanning = {\n    knownContainerKeks: new Map(input.preceding?.knownContainerKeks),\n    plans: [],\n    // A rotation planned above cites the group at the head this batch commits,\n    // which no store holds yet; the cache is what lets a rebased path verify.\n    principalPolicyCache: new Map([\n      ...(input.preceding?.policies ?? []).flatMap((policy) => [\n        ...seededPrincipalPolicyCache(policy),\n      ]),\n      ...seededPrincipalPolicyCache(input.nextPolicy),\n    ]),\n    rematerialization: input,\n    resolveProjectionUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    rotatedAbove: [],\n  };\n  for (const target of targets) {\n    await planRematerializationTarget(batch, target);\n  }\n  return {\n    entries: batch.plans,\n    retiredContainerIds,\n    preceding: {\n      policies: [...(input.preceding?.policies ?? []), input.nextPolicy],\n      projections: [\n        ...(input.preceding?.projections ?? []),\n        ...batch.plans.flatMap((entry) =>\n          entry.nextProjection ? [entry.nextProjection] : [],\n        ),\n      ],\n      knownContainerKeks: batch.knownContainerKeks,\n    },\n  };\n}\n\n/**\n * The server names a level it found pinned to a retired epoch. A batch answers\n * with a rotation of it: a carried rekey, or its own rematerialization when\n * that is a rekey or revoke. A rematerialized grant rotates nothing, so a\n * batch that both grants a container and must re-key it cannot be signed;\n * no policy change the SDK builds combines the two.\n */\nfunction assertNamedContainersRotated(\n  plans: readonly PlannedRematerialization[],\n  requiredContainerIds: readonly string[],\n): void {\n  const rotatedIds = new Set(\n    plans.flatMap((entry) =>\n      entry.rotated ? [entry.planned.plan.containerId] : [],\n    ),\n  );\n  const unrotated = requiredContainerIds\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS)\n    .find((containerId) => !rotatedIds.has(containerId));\n  if (unrotated !== undefined) {\n    throw new Error(\n      `Container ${unrotated} needs a rekey this policy change only grants`,\n    );\n  }\n}\n\nexport async function preparePrincipalContainerRematerializationBatch(\n  input: PrincipalContainerRematerializationInput,\n): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  let { entries, retiredContainerIds, preceding } =\n    await buildPrincipalContainerRematerializationPlans(input);\n  const requests = () => entries.map((entry) => entry.planned.plan.request);\n  return {\n    get preceding() {\n      return preceding;\n    },\n    get retiredContainerIds() {\n      return retiredContainerIds;\n    },\n    get plans() {\n      return entries.map((entry) => entry.planned);\n    },\n    get requests() {\n      return requests();\n    },\n    carry: async (requiredContainerIds) => {\n      // The refused attempt rolled back whole, so every served head still\n      // stands; the batch is signed again from them with the named levels in.\n      const replanned = await buildPrincipalContainerRematerializationPlans(\n        input,\n        requiredContainerIds,\n      );\n      assertNamedContainersRotated(replanned.entries, requiredContainerIds);\n      entries = replanned.entries;\n      retiredContainerIds = replanned.retiredContainerIds;\n      preceding = replanned.preceding;\n      return requests();\n    },\n    acknowledge: async (responses, stillCurrent) => {\n      const isCurrent = () =>\n        input.stillCurrent?.() !== false && stillCurrent?.() !== false;\n      const heads = entries.map((entry) => authoredMutationHead(entry.planned));\n      const acknowledged = await acknowledgeContainerMutationBatch({\n        execSql: input.execSql,\n        plans: heads,\n        responses,\n        stillCurrent: isCurrent,\n      });\n      if (!acknowledged || !isCurrent()) return;\n      const plansByOrganization = new Map<\n        string,\n        AuthoredContainerMutationHead[]\n      >();\n      for (const head of heads) {\n        const organizationId = head.state.organizationId;\n        const group = plansByOrganization.get(organizationId) ?? [];\n        group.push(head);\n        plansByOrganization.set(organizationId, group);\n      }\n      for (const [organizationId, organizationPlans] of plansByOrganization) {\n        try {\n          rememberVerifiedContainerHeads({\n            organizationId,\n            execSql: input.execSql,\n            heads: [],\n            policies: [input.nextPolicy],\n          });\n        } catch {\n          // Cache failure must not invalidate the durably acknowledged batch.\n          continue;\n        }\n        scheduleHeldDescendantRecitations({\n          apiClient: input.apiClient,\n          author: { ...input.author, organizationId },\n          execSql: input.execSql,\n          plans: organizationPlans,\n          stillCurrent: input.recitationStillCurrent ?? isCurrent,\n          reportSecurityIncident: input.reportSecurityIncident,\n        });\n      }\n    },\n  };\n}\n"]}

package/workflows/organizations/rematerialization/principalContainerRematerializationPlanning.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerializationPlanning.js","sourceRoot":"","sources":["principalContainerRematerializationPlanning.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAc3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,sDAAsD,CAAC;AA2D9D,uEAAuE;AACvE,SAAS,YAAY,CAAC,KAAoB;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAoB,EACpB,MAAyC;IAEzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,6BAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,6BAA6B,oBAAoB,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,8DAA8D;QAC9D,sDAAsD;QACtD,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;QACxD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;QACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,YAAY;QAC3B,MAAM;QACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,IAAI;QACb,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,gBAAgB;QACjC,cAAc,EAAE,OAAO,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAoB,EACpB,KAA+B;IAE/B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO;IAC3B,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACvE,IAAI,MAAM;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6C,EAC7C,iBAAyB;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,iBAAiB,CAC/C,CAAC;IACF,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAClC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,KAAK,GAAG,CAAC;QACT,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAC5E,CAAC;IACF,OAAO,UAAU,GAAG,CAAC;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ResolvedPrincipalPolicyEvidence } from \"../../../data/keyingProjectionVerification/types\";\nimport type { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  planCarriedDescendantRekey,\n  type SpeculativePath,\n} from \"../../containers/child/rekey/carriedDescendantRekeys\";\nimport type { PlannedRematerialization } from \"./principalContainerRematerializationTargets\";\n\nexport interface RematerializationApi\n  extends ContainerReciteApi,\n    Pick<ApiClient, \"getContainerWriterProjectionResult\"> {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\nexport interface PrincipalRematerializationPredecessor {\n  readonly authored?: readonly ResolvedPrincipalPolicyEvidence[] | undefined;\n  readonly policies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly projections: readonly ContainerWriterProjectionResponse[];\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n}\n\nexport interface PrincipalContainerRematerializationInput {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly apiClient: RematerializationApi;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  readonly grants: readonly PrincipalContainerGrant[];\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly revokedContainerId?: string | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /** Session lifetime for best-effort work after durable acknowledgement. */\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** What the batch has signed so far, in the order it will be submitted. */\nexport interface BatchPlanning {\n  /**\n   * Keys the batch minted, by epoch id. A rotation wraps its successor to the\n   * group at the head this batch commits, which no store can open yet; a\n   * level planned beneath it opens that epoch with the key minted here, and\n   * its keyring then opens the retired epoch the level below is pinned to.\n   */\n  readonly knownContainerKeks: Map<string, Uint8Array>;\n  readonly plans: PlannedRematerialization[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n  readonly rotatedAbove: SpeculativePath[];\n}\n\n/** How many rekeys the batch carries beyond its rematerializations. */\nfunction carriedCount(batch: BatchPlanning): number {\n  return batch.plans.filter((entry) => entry.carried).length;\n}\n\n/**\n * Sign a rekey of `served` under the batch's rotations above it, and add it.\n * The server accepts at most `MAX_ROTATION_CONTAINER_REKEYS` carried entries;\n * past that a rematerialization below them could not be signed on a current\n * path, so the batch is refused here, before signing what the server would\n * refuse anyway, and the policy change has to wait for a lazy repair of the\n * tree. Groups granted that far apart on one chain are not a shape the SDK\n * creates.\n */\nexport async function carryLevel(\n  batch: BatchPlanning,\n  served: ContainerWriterProjectionResponse,\n): Promise<void> {\n  const { rematerialization } = batch;\n  if (carriedCount(batch) >= MAX_ROTATION_CONTAINER_REKEYS) {\n    throw new Error(\n      `Policy change would carry more than ${MAX_ROTATION_CONTAINER_REKEYS} descendant rekeys`,\n    );\n  }\n  const planned = await planCarriedDescendantRekey({\n    apiClient: rematerialization.apiClient,\n    author: rematerialization.author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    // Its path cites the policy this batch commits, so like every\n    // rematerialized rotation it must cite the successor.\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n    resolveAuthoredPolicyReferences:\n      rematerialization.resolveAuthoredPolicyReferences,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n    rotated: batch.rotatedAbove,\n    served,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  });\n  addPlan(batch, {\n    carried: true,\n    planned,\n    rotated: planned.writerProjection,\n    nextProjection: planned.writerProjection,\n  });\n}\n\nexport function addPlan(\n  batch: BatchPlanning,\n  entry: PlannedRematerialization,\n): void {\n  batch.plans.push(entry);\n  if (!entry.rotated) return;\n  batch.rotatedAbove.push(entry.rotated);\n  const minted = entry.rotated.containerKeks.at(-1)?.containerKeyEpochId;\n  if (minted) batch.knownContainerKeks.set(minted, entry.planned.containerKey);\n}\n\n/**\n * Levels of a re-rooted path pinned to an epoch the batch retires above them:\n * those strictly between the rotated ancestor the path was re-rooted on and\n * the target, parent-first, from the first stale one down. A rotation planned\n * above a target strands every level between the two, and each must be\n * re-keyed under the one above before the target can be signed. The batch\n * carries them without waiting to be told: they are proper ancestors of a\n * granted container, so the server would name them, and a refusal per level\n * is a round trip each. Anything stale above the rotated ancestor is not this\n * batch's doing and is left alone. `carryLevel` holds the count to the cap.\n */\nexport function staleLevelsAbove(\n  projection: ContainerWriterProjectionResponse,\n  rotatedAncestorId: string,\n): string[] {\n  const keks = projection.containerKeks;\n  const ancestor = keks.findIndex(\n    (kek) => kek.containerId === rotatedAncestorId,\n  );\n  if (ancestor < 0) return [];\n  const between = keks.slice(ancestor, -1);\n  const firstStale = between.findIndex(\n    (kek, index) =>\n      index > 0 &&\n      kek.parentContainerKeyEpochId !== between[index - 1]?.containerKeyEpochId,\n  );\n  return firstStale < 0\n    ? []\n    : between.slice(firstStale).map((kek) => kek.containerId);\n}\n"]}

package/workflows/organizations/rematerialization/principalContainerRematerializationTargets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerializationTargets.js","sourceRoot":"","sources":["principalContainerRematerializationTargets.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAO9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iFAAiF,CAAC;AA4B/H;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAOhD,KAAmB;IACnB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM;QAC1D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAC1E,CAAC;AACJ,CAAC;AAQD,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAwB,EACxB,WAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,+CAA+C,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IAIC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC3C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CACvE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3C,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,IACE,QAAQ;gBACR,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,0BAA0B,CAAC,MAAM,CAAC,EAClC,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,kDAAkD,MAAM,CAAC,OAAO,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,OAAO,CAAC;QACpD,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,UAA0C;IAE1C,OAAO,IAAI,GAAG,CAAC;QACb;YACE,4BAA4B,CAAC;gBAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,UAAU;SACX;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type {\n  MaterializedContainerRekeyPlan,\n  MaterializedContainerRevokePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport { referencedPrincipalPolicyKey } from \"../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SpeculativePath } from \"../../containers/child/rekey/carriedDescendantRekeys\";\n\nexport type MaterializedPrincipalContainerMutationPlan =\n  | MaterializedContainerRekeyPlan\n  | MaterializedContainerRevokePlan\n  | MaterializedContainerSharePlan;\n\n/** Authored paths for chaining plans; only rotated is null for a grant. */\nexport interface PlannedRematerialization {\n  /** The authored successor for either a grant or a rotation. */\n  readonly nextProjection?: ContainerWriterProjectionResponse | undefined;\n  /** A descendant rekey carried for a rotation above, not a rematerialization. */\n  readonly carried: boolean;\n  readonly planned: MaterializedPrincipalContainerMutationPlan;\n  readonly rotated: SpeculativePath | null;\n}\n\n/**\n * One container a batch signs for: a group grant it rematerializes, or a\n * descendant rekey it carries for a rotation above (`grantRow` null).\n */\nexport interface RematerializationTarget {\n  readonly grantRow: PrincipalContainerGrant | null;\n  readonly projection: ContainerWriterProjectionResponse;\n}\n\n/**\n * Order a batch parent-first, by served depth. A group granted on a container\n * and on one of its descendants rotates both, and the lower rotation must be\n * signed against the epoch the upper one mints in this same batch, or it\n * extends a head the batch itself retires. A carried rekey sits below the\n * rotation it rides for the same reason. Ties keep id order for stability.\n */\nexport function orderRematerializationsParentFirst<\n  T extends {\n    readonly projection: {\n      readonly containerId: string;\n      readonly path: readonly unknown[];\n    };\n  },\n>(batch: readonly T[]): T[] {\n  return [...batch].sort(\n    (left, right) =>\n      left.projection.path.length - right.projection.path.length ||\n      left.projection.containerId.localeCompare(right.projection.containerId),\n  );\n}\n\ninterface ProjectionApi {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\n/** The served projection of a container the batch will sign for. */\nexport async function loadServedProjection(\n  apiClient: ProjectionApi,\n  containerId: string,\n): Promise<ContainerWriterProjectionResponse> {\n  const projection = await apiClient.getContainerWriterProjection(containerId);\n  if (!projection) {\n    throw new Error(\n      `Container ${containerId} could not be prepared for principal rotation`,\n    );\n  }\n  if (projection.containerId !== containerId) {\n    throw new Error(\"Served projection describes another container\");\n  }\n  return projection;\n}\n\n/**\n * Fetch what the batch signs for, parent-first. A named descendant the batch\n * already rematerializes is not fetched twice: its own rotation is re-planned\n * under whatever the batch carries above it. Names are a hint from the server,\n * never an authority; each is verified where it is planned.\n */\nexport async function loadRematerializationTargets(input: {\n  readonly apiClient: Pick<ApiClient, \"getContainerWriterProjectionResult\">;\n  readonly carriedContainerIds: readonly string[];\n  readonly grants: readonly PrincipalContainerGrant[];\n}): Promise<{\n  targets: RematerializationTarget[];\n  retiredContainerIds: string[];\n}> {\n  const grantByContainerId = new Map(\n    input.grants.map((grant) => [grant.containerId, grant] as const),\n  );\n  const carried = [...new Set(input.carriedContainerIds)]\n    .filter((containerId) => !grantByContainerId.has(containerId))\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS);\n  const targets: RematerializationTarget[] = [];\n  const retiredContainerIds: string[] = [];\n  for (const containerId of [...grantByContainerId.keys(), ...carried].sort(\n    (left, right) => left.localeCompare(right),\n  )) {\n    const grantRow = grantByContainerId.get(containerId) ?? null;\n    const result = await input.apiClient.getContainerWriterProjectionResult(\n      containerId,\n      { reportErrors: false },\n    );\n    if (!result.ok) {\n      // This is only a planning hint. Keep the signed grant intact; the API\n      // independently requires every live grant under the organization lock.\n      if (\n        grantRow &&\n        result.kind === \"http\" &&\n        isContainerNotFoundFailure(result)\n      ) {\n        retiredContainerIds.push(containerId);\n        continue;\n      }\n      result.report();\n      throw new Error(\n        `Container ${containerId} could not be prepared for principal rotation: ${result.message}`,\n      );\n    }\n    if (result.data.containerId !== containerId)\n      throw new Error(\"Served projection describes another container\");\n    targets.push({ grantRow, projection: result.data });\n  }\n  return {\n    targets: orderRematerializationsParentFirst(targets),\n    retiredContainerIds,\n  };\n}\n\n/** An in-memory cache holding only the policy this batch is about to commit. */\nexport function seededPrincipalPolicyCache(\n  nextPolicy: PrincipalPolicyCurrentEvidence,\n): PrincipalPolicyCache {\n  return new Map([\n    [\n      referencedPrincipalPolicyKey({\n        keyEpoch: nextPolicy.keyEpoch,\n        keyFingerprint: nextPolicy.state.keyFingerprint,\n        principalId: nextPolicy.principalId,\n        principalType: nextPolicy.principalType,\n        stateHash: nextPolicy.stateHash,\n        version: nextPolicy.version,\n      }),\n      nextPolicy,\n    ],\n  ]);\n}\n"]}