npm - @tearleads/client-sdk - Versions diffs - 0.1.76 → 0.1.78 - Mend

@tearleads/client-sdk 0.1.76 → 0.1.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (179) hide show

package/workflows/container-contents/remoteHydration/remoteContainers/remoteContainerState.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"remoteContainerState.js","sourceRoot":"","sources":["remoteContainerState.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,sCAAsC,EAAE,MAAM,qDAAqD,CAAC;AAE7G,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,6CAA6C,GAC9C,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,8CAA8C;AAC9C,qFAAqF;AACrF,4EAA4E;AAC5E,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,KAGxE;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACzD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,wCAAwC,GAAG,IAAI,GAAG,EAAU,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,wCAAwC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAGtE;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;QACtE,MAAM,sBAAsB,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAC3D,eAAe,CAAC,EAAE,CACnB,EAAE,SAAS,CAAC,cAAc,CAAC;QAE5B,OAAO,sBAAsB;YAC3B,sBAAsB,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC;YACnE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,OAAO,IAAI,GAAG,CACZ,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAC9D,OAAO,EACP,YAAY,CACb,CACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAOvC;IACC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;QACnE,OAAO;IACT,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,2BAA2B,CACzB,KAAK,CAAC,kBAAkB,EACxB,eAAe,CAAC,EAAE,EAClB,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,aAA6B,EAC7B,eAAgC;IAEhC,OAAO;QACL,GAAG,aAAa;QAChB,SAAS,EAAE,8BAA8B,CACvC,aAAa,CAAC,SAAS,EACvB,eAAe,CAChB;QACD,yBAAyB,EAAE,IAAI;QAC/B,4BAA4B,EAAE,eAAe,CAAC,4BAA4B;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,aAA6B,EAC7B,SAAyB,EACzB,IAAkC;IAElC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC;IACrE,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC9C,aAAa,CAAC,yBAAyB,GAAG,SAAS,CAAC,yBAAyB,CAAC;IAC9E,aAAa,CAAC,4BAA4B;QACxC,SAAS,CAAC,4BAA4B,CAAC;IACzC,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,oBAAoB,CAAC,aAAa,CAAC,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACzE,aAAa,CAAC,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;IAC9E,8BAA8B,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,IAAI,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI;QACjE,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KASjD;IACC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GACvE,KAAK,CAAC;IACR,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC1D,MAAM,sBAAsB,GAAG,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC;IACtE,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,0BAA0B,GAC9B,KAAK,CAAC,wCAAwC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,0BAA0B;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;IAC7B,MAAM,cAAc,GAAG,6CAA6C,CAAC;QACnE,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;QAC9C,0BAA0B;QAC1B,sBAAsB;QACtB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,iCAAiC,CACjD,aAAa,EACb,eAAe,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACxD,SAAS,EACT;QACE,WAAW,EAAE,eAAe,CAAC,mBAAmB;QAChD,eAAe,EAAE,eAAe,CAAC,uBAAuB;QACxD,UAAU,EAAE,eAAe,CAAC,kBAAkB;QAC9C,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,UAAU,EAAE,eAAe,CAAC,UAAU,IAAI,IAAI;QAC9C,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,EACD,KAAK,EACL,mCAAmC,CAAC;QAClC,cAAc;QACd,eAAe;KAChB,CAAC,EACF;QACE,mCAAmC,EAAE,IAAI;KAC1C,CACF,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,8BAA8B,CAAC;YAC7B,kBAAkB;YAClB,aAAa;YACb,IAAI;YACJ,gBAAgB;YAChB,eAAe;YACf,KAAK;SACN,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;IACjD,8BAA8B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,SAAS,CAAC,SAAS,GAAG;QACpB,GAAG,SAAS,CAAC,SAAS;QACtB,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;KACvC,CAAC;IAEF,kCAAkC,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,yBAAyB,CACvB,kBAAkB,EAClB,eAAe,CAAC,EAAE,EAClB,gBAAgB,EAChB,aAAa,CAAC,SAAS,CAAC,QAAQ,CACjC,CAAC;IACF,MAAM,gCAAgC,CAAC;QACrC,kBAAkB;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,aAAa;QAC9B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,KAAK;KACN,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAsC;IAEtC,IAAI,2BAAiE,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACpD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACN,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC;IACrC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,iBAAiB,GACrB,CAAC,iCAAiC,CAAC,WAAW,EAAE,MAAM,CAAC;QACvD,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,4BAA4B,CACzD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAClE,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;QACtD,GAAG,KAAK;QACR,WAAW;QACX,iBAAiB;QACjB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B;QAC3C,oBAAoB,EAAE,CAAC,UAAU,EAAE,EAAE;YACnC,2BAA2B,GAAG,UAAU,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAClD,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,gCAAgC,CACxD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAC/C;QACE,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,2BAA2B;QACtC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,EACD,KAAK,IAAI,EAAE,CACT,CAAC,MAAM,sBAAsB,CAAC;QAC5B,aAAa;QACb,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;KACT,CAAC,CAAC;QACD,CAAC,CAAC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,aAAa;YACb,2BAA2B;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CACX,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAsC;IAEtC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,yBAAyB,CAAC,KAAK,CAAC;YACjC,CAAC,sCAAsC,CAAC,KAAK,CAAC;YAE9C,MAAM,KAAK,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAGC;IAED,MAAM,EAAE,aAAa,EAAE,2BAA2B,EAAE,GAAG,KAAK,CAAC;IAC7D,OAAO,aAAa;QAClB,CAAC,CAAC,kCAAkC,CAAC;YACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;YAC9C,wCAAwC,EACtC,KAAK,CAAC,wCAAwC;YAChD,aAAa;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACJ,CAAC,CAAC,0BAA0B,CAAC;YACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,IAAI,IAAI;YACpE,2BAA2B;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type { AccessManifestCheckpoint } from \"@tearleads/crypto\";\nimport {\n heldContainerBinding,\n listingRepeatsHeldOrdinaryBinding,\n} from \"../../../../data/containers/containerBinding\";\nimport {\n isKeyingVerificationError,\n runWithSecurityIncidentReporting,\n} from \"../../../../data/keyingProjectionVerification/error\";\nimport { isProjectionVerificationCancelledError } from \"../../../../data/keyingProjectionVerification/types\";\nimport type { ContainerHydrationTombstone } from \"../../containerPersistence\";\nimport { installContainerMetadataRecord } from \"../../metadata/metadataPersistence\";\nimport { projectionGeneration } from \"../../projectionGeneration\";\nimport type { PrefetchedDestinationProjection } from \"../destination/destinationPrefetch\";\nimport { verifyRemoteContainerDestination } from \"../destination/verifiedDestination\";\nimport { rebindReHomedContainer } from \"../heldContainerRebind\";\nimport {\n moveIndexedContainerChild,\n removeIndexedContainerChild,\n} from \"../lanes/childIndex\";\nimport {\n reconcileLocalOnlyRootContainers,\n reconcileLocalOnlySystemContainers,\n} from \"../reconciliation\";\nimport type {\n ContainerChildIndex,\n ContainerState,\n RemoteContainer,\n RemoteContainerHydrationHost,\n RemoteContainerHydrationState,\n} from \"../types\";\nimport { insertRemoteContainerState } from \"./insertRemoteContainer\";\nimport {\n applyRemoteContainerTimestamps,\n remoteContainerHydrationSaveOptions,\n resolveRemoteContainerHydrationLocalUpdatedAt,\n} from \"./remoteContainerTimestamps\";\n\n// Container ids (restricted to the inbound page) that carry an unsynced local\n// create or move intent. Such a container's parent and local-edit timestamp are\n// owned by its structural-intent lane until that lane reconciles, so inbound\n// hydration must not revert parentId to the server value nor collapse\n// localUpdatedAt — doing so silently undoes a queued move and falsely reads\n// \"synced\". Move intents are read via listUnsyncedMoveIntents so a blocked\n// move — one whose destination parent has not synced yet, the common boot-time\n// case — is protected too. Pending metadata\n// updates are handled separately (listRemoteContainerIdsWithPendingMetadataUpdates);\n// structural intents live in the local outbox's container lanes, which that\n// query does not cover.\nexport async function listRemoteContainerIdsWithPendingStructuralIntents(input: {\n remoteContainers: ReadonlyArray<RemoteContainer>;\n state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n if (input.remoteContainers.length === 0) {\n return new Set();\n }\n const remoteContainerIds = new Set(\n input.remoteContainers.map((remoteContainer) => remoteContainer.id),\n );\n\n const execSql = input.state.runtime.infra.execSql;\n const [pendingCreateIntents, unsyncedMoveIntents] = await Promise.all([\n input.state.persistence.listPendingCreateIntents(execSql),\n input.state.persistence.listUnsyncedMoveIntents(execSql),\n ]);\n const containerIdsWithPendingStructuralIntents = new Set<string>();\n for (const intent of pendingCreateIntents) {\n if (remoteContainerIds.has(intent.containerId)) {\n containerIdsWithPendingStructuralIntents.add(intent.containerId);\n }\n }\n for (const intent of unsyncedMoveIntents) {\n if (remoteContainerIds.has(intent.containerId)) {\n containerIdsWithPendingStructuralIntents.add(intent.containerId);\n }\n }\n return containerIdsWithPendingStructuralIntents;\n}\n\nexport async function listRemoteContainerIdsWithPendingMetadataUpdates(input: {\n remoteContainers: ReadonlyArray<RemoteContainer>;\n state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n const containerIds = input.remoteContainers.flatMap((remoteContainer) => {\n const previousLocalUpdatedAt = input.state.containersById.get(\n remoteContainer.id,\n )?.container.localUpdatedAt;\n\n return previousLocalUpdatedAt &&\n previousLocalUpdatedAt.localeCompare(remoteContainer.updatedAt) > 0\n ? [remoteContainer.id]\n : [];\n });\n if (containerIds.length === 0) {\n return new Set();\n }\n\n const execSql = input.state.runtime.infra.execSql;\n return new Set(\n await input.state.persistence.listContainerIdsWithPendingUpdates(\n execSql,\n containerIds,\n ),\n );\n}\n\nfunction removeMissingHydratedContainer(input: {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n existingState: ContainerState;\n host: RemoteContainerHydrationHost;\n previousParentId: string \| null;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): void {\n const { existingState, remoteContainer, state } = input;\n if (state.containersById.get(remoteContainer.id) !== existingState) {\n return;\n }\n\n state.containersById.delete(remoteContainer.id);\n if (input.childIdsByParentId) {\n removeIndexedContainerChild(\n input.childIdsByParentId,\n remoteContainer.id,\n input.previousParentId,\n );\n input.childIdsByParentId.delete(remoteContainer.id);\n }\n input.host.updateSnapshot();\n}\n\nfunction createUpdatedRemoteContainerState(\n existingState: ContainerState,\n remoteContainer: RemoteContainer,\n): ContainerState {\n return {\n ...existingState,\n container: applyRemoteContainerTimestamps(\n existingState.container,\n remoteContainer,\n ),\n containerWriterProjection: null,\n metadataReferencedPrincipals: remoteContainer.metadataReferencedPrincipals,\n };\n}\n\nfunction installUpdatedRemoteContainerState(\n existingState: ContainerState,\n nextState: ContainerState,\n host: RemoteContainerHydrationHost,\n): void {\n const wasLocalOnly = existingState.container.serverCreatedAt == null;\n existingState.container = nextState.container;\n existingState.containerWriterProjection = nextState.containerWriterProjection;\n existingState.metadataReferencedPrincipals =\n nextState.metadataReferencedPrincipals;\n // The snapshot copied the live generation when it was taken; a hint that\n // landed during the persist leaves the live metadata projection dropped.\n if (projectionGeneration(existingState) === projectionGeneration(nextState))\n existingState.metadataWriterProjection = nextState.metadataWriterProjection;\n installContainerMetadataRecord(existingState, nextState.record);\n // A document pass may have deferred while this root was awaiting proof.\n // The first durable remote acknowledgement makes its pending creates runnable.\n if (wasLocalOnly && existingState.container.serverCreatedAt != null)\n host.requestDocumentPriming?.();\n}\n\nasync function updateExistingRemoteContainerState(input: {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n host: RemoteContainerHydrationHost;\n isCurrent?: (() => boolean) \| undefined;\n existingState: ContainerState;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): Promise<ContainerState \| null> {\n const { childIdsByParentId, existingState, host, remoteContainer, state } =\n input;\n const previousParentId = existingState.container.parentId;\n const previousLocalUpdatedAt = existingState.container.localUpdatedAt;\n // A queued, not-yet-synced local move/create owns this container's parent\n // until its intent lane reconciles. Omit the remote parent when the page scan\n // saw one; persistence also rechecks the intent transactionally so a move\n // created after that scan wins. Both paths preserve the durable local clock.\n const hasPendingStructuralIntent =\n input.containerIdsWithPendingStructuralIntents.has(remoteContainer.id);\n const nextParentId = hasPendingStructuralIntent\n ? undefined\n : remoteContainer.parentId;\n const localUpdatedAt = resolveRemoteContainerHydrationLocalUpdatedAt({\n containerIdsWithPendingMetadataUpdates:\n input.containerIdsWithPendingMetadataUpdates,\n hasPendingStructuralIntent,\n previousLocalUpdatedAt,\n remoteContainer,\n });\n const nextState = createUpdatedRemoteContainerState(\n existingState,\n remoteContainer,\n );\n const persistenceResult = await host.persistContainerState(\n nextState,\n {\n accessEpoch: remoteContainer.metadataAccessEpoch,\n accessStateHash: remoteContainer.metadataAccessStateHash,\n documentId: remoteContainer.metadataDocumentId,\n effectiveAccessLevel: remoteContainer.effectiveAccessLevel,\n metadataDocumentId: remoteContainer.metadataDocumentId,\n systemSlot: remoteContainer.systemSlot ?? null,\n organizationId: remoteContainer.organizationId,\n ...(nextParentId !== undefined ? { parentId: nextParentId } : {}),\n },\n false,\n remoteContainerHydrationSaveOptions({\n localUpdatedAt,\n remoteContainer,\n }),\n {\n preserveDurableStructureWhenPending: true,\n },\n );\n if (persistenceResult.status === \"missing\") {\n // Hydration persists a detached candidate so an in-flight response cannot\n // mutate mapped state before its guards settle. Retire the exact state this\n // hydration read because store-level reference cleanup cannot see the clone.\n removeMissingHydratedContainer({\n childIdsByParentId,\n existingState,\n host,\n previousParentId,\n remoteContainer,\n state,\n });\n return null;\n }\n if (persistenceResult.status !== \"persisted\") return null;\n const { record: nextRecord } = persistenceResult;\n installContainerMetadataRecord(nextState, nextRecord);\n if (input.isCurrent?.() === false) {\n return existingState;\n }\n nextState.container = {\n ...nextState.container,\n metadataDocumentId: remoteContainer.metadataDocumentId,\n organizationId: remoteContainer.organizationId,\n parentId: nextState.container.parentId,\n };\n\n installUpdatedRemoteContainerState(existingState, nextState, host);\n moveIndexedContainerChild(\n childIdsByParentId,\n remoteContainer.id,\n previousParentId,\n existingState.container.parentId,\n );\n await reconcileLocalOnlyRootContainers({\n childIdsByParentId,\n isCurrent: input.isCurrent,\n remoteRootState: existingState,\n requestDocumentPriming: host.requestDocumentPriming,\n state,\n });\n return existingState;\n}\n\ninterface UpsertRemoteContainerStateInput {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n host: RemoteContainerHydrationHost;\n expectedHydrationTombstone?: ContainerHydrationTombstone \| null \| undefined;\n isCurrent?: (() => boolean) \| undefined;\n prefetchedProjection?: PrefetchedDestinationProjection \| undefined;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}\n\nexport async function upsertRemoteContainerState(\n input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState \| null> {\n let expectedPlacementCheckpoint: AccessManifestCheckpoint \| undefined;\n const heldState = input.state.containersById.get(input.remoteContainer.id);\n const heldBinding = heldState\n ? heldContainerBinding(heldState)\n : await input.state.persistence.loadHeldContainerBinding(\n input.state.runtime.infra.execSql,\n input.remoteContainer.id,\n );\n const listed = input.remoteContainer;\n // A folder re-homed away from the listed organization never returns there,\n // whatever binding (possibly none, after a reset) the device holds now.\n const supersededListing =\n !listingRepeatsHeldOrdinaryBinding(heldBinding, listed) &&\n (await input.state.persistence.isSupersededContainerBinding(\n input.state.runtime.infra.execSql,\n { containerId: listed.id, organizationId: listed.organizationId },\n ));\n if (input.isCurrent?.() === false) return null;\n const verified = await verifyRemoteContainerDestination({\n ...input,\n heldBinding,\n supersededListing,\n refresh: !!input.expectedHydrationTombstone,\n onVerifiedCheckpoint: (checkpoint) => {\n expectedPlacementCheckpoint = checkpoint;\n },\n });\n if (!verified \|\| input.isCurrent?.() === false) return null;\n input = { ...input, remoteContainer: verified };\n const existingState = input.state.containersById.get(\n input.remoteContainer.id,\n );\n const remoteState = await runWithSecurityIncidentReporting(\n input.state.runtime.util.reportSecurityIncident,\n {\n objectId: verified.id,\n objectKind: \"container\",\n operation: \"container.binding.persist\",\n organizationId: verified.organizationId,\n },\n async () =>\n (await rebindReHomedContainer({\n existingState,\n heldBinding,\n isCurrent: input.isCurrent,\n state: input.state,\n verified,\n }))\n ? persistVerifiedRemoteContainer({\n ...input,\n existingState,\n expectedPlacementCheckpoint,\n })\n : null,\n );\n if (!remoteState) {\n return null;\n }\n await reconcileLocalOnlySystemContainers({\n childIdsByParentId: input.childIdsByParentId,\n isCurrent: input.isCurrent,\n requestDocumentPriming: input.host.requestDocumentPriming,\n remoteSystemState: remoteState,\n state: input.state,\n });\n return remoteState;\n}\n\n/*\n Upsert one listed folder, isolating a rejected proof or binding. The refusal\n * was already reported; returning no state leaves the item unapplied without\n * blocking independent folders.\n */\nexport async function upsertIsolatedRemoteContainerState(\n input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState \| null> {\n try {\n return await upsertRemoteContainerState(input);\n } catch (error) {\n if (\n !isKeyingVerificationError(error) &&\n !isProjectionVerificationCancelledError(error)\n )\n throw error;\n return null;\n }\n}\n\nfunction persistVerifiedRemoteContainer(\n input: UpsertRemoteContainerStateInput & {\n existingState: ContainerState \| undefined;\n expectedPlacementCheckpoint: AccessManifestCheckpoint \| undefined;\n },\n): Promise<ContainerState \| null> {\n const { existingState, expectedPlacementCheckpoint } = input;\n return existingState\n ? updateExistingRemoteContainerState({\n childIdsByParentId: input.childIdsByParentId,\n containerIdsWithPendingMetadataUpdates:\n input.containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents:\n input.containerIdsWithPendingStructuralIntents,\n existingState,\n host: input.host,\n isCurrent: input.isCurrent,\n remoteContainer: input.remoteContainer,\n state: input.state,\n })\n : insertRemoteContainerState({\n childIdsByParentId: input.childIdsByParentId,\n host: input.host,\n expectedHydrationTombstone: input.expectedHydrationTombstone ?? null,\n expectedPlacementCheckpoint,\n isCurrent: input.isCurrent,\n remoteContainer: input.remoteContainer,\n state: input.state,\n });\n}\n"]}
1	+ {"version":3,"file":"remoteContainerState.js","sourceRoot":"","sources":["remoteContainerState.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,sCAAsC,EAAE,MAAM,qDAAqD,CAAC;AAC7G,OAAO,EACL,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,kEAAkE,CAAC;AAE1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,6CAA6C,GAC9C,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,8CAA8C;AAC9C,qFAAqF;AACrF,4EAA4E;AAC5E,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,KAGxE;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACzD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,wCAAwC,GAAG,IAAI,GAAG,EAAU,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,wCAAwC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,wCAAwC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAGtE;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;QACtE,MAAM,sBAAsB,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAC3D,eAAe,CAAC,EAAE,CACnB,EAAE,SAAS,CAAC,cAAc,CAAC;QAE5B,OAAO,sBAAsB;YAC3B,sBAAsB,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC;YACnE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,OAAO,IAAI,GAAG,CACZ,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAC9D,OAAO,EACP,YAAY,CACb,CACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAOvC;IACC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;QACnE,OAAO;IACT,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,2BAA2B,CACzB,KAAK,CAAC,kBAAkB,EACxB,eAAe,CAAC,EAAE,EAClB,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,aAA6B,EAC7B,eAAgC;IAEhC,OAAO;QACL,GAAG,aAAa;QAChB,SAAS,EAAE,8BAA8B,CACvC,aAAa,CAAC,SAAS,EACvB,eAAe,CAChB;QACD,yBAAyB,EAAE,IAAI;QAC/B,4BAA4B,EAAE,eAAe,CAAC,4BAA4B;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,aAA6B,EAC7B,SAAyB,EACzB,IAAkC;IAElC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC;IACrE,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC9C,aAAa,CAAC,yBAAyB,GAAG,SAAS,CAAC,yBAAyB,CAAC;IAC9E,aAAa,CAAC,4BAA4B;QACxC,SAAS,CAAC,4BAA4B,CAAC;IACzC,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,oBAAoB,CAAC,aAAa,CAAC,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACzE,aAAa,CAAC,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;IAC9E,8BAA8B,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,IAAI,aAAa,CAAC,SAAS,CAAC,eAAe,IAAI,IAAI;QACjE,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KASjD;IACC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GACvE,KAAK,CAAC;IACR,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC1D,MAAM,sBAAsB,GAAG,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC;IACtE,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,0BAA0B,GAC9B,KAAK,CAAC,wCAAwC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,0BAA0B;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;IAC7B,MAAM,cAAc,GAAG,6CAA6C,CAAC;QACnE,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;QAC9C,0BAA0B;QAC1B,sBAAsB;QACtB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,iCAAiC,CACjD,aAAa,EACb,eAAe,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACxD,SAAS,EACT;QACE,WAAW,EAAE,eAAe,CAAC,mBAAmB;QAChD,eAAe,EAAE,eAAe,CAAC,uBAAuB;QACxD,UAAU,EAAE,eAAe,CAAC,kBAAkB;QAC9C,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,UAAU,EAAE,eAAe,CAAC,UAAU,IAAI,IAAI;QAC9C,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,EACD,KAAK,EACL,mCAAmC,CAAC;QAClC,cAAc;QACd,eAAe;KAChB,CAAC,EACF;QACE,mCAAmC,EAAE,IAAI;KAC1C,CACF,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,8BAA8B,CAAC;YAC7B,kBAAkB;YAClB,aAAa;YACb,IAAI;YACJ,gBAAgB;YAChB,eAAe;YACf,KAAK;SACN,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;IACjD,8BAA8B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,SAAS,CAAC,SAAS,GAAG;QACpB,GAAG,SAAS,CAAC,SAAS;QACtB,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;QACtD,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;KACvC,CAAC;IAEF,kCAAkC,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,yBAAyB,CACvB,kBAAkB,EAClB,eAAe,CAAC,EAAE,EAClB,gBAAgB,EAChB,aAAa,CAAC,SAAS,CAAC,QAAQ,CACjC,CAAC;IACF,MAAM,gCAAgC,CAAC;QACrC,kBAAkB;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,aAAa;QAC9B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,KAAK;KACN,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAsC;IAEtC,IAAI,2BAAiE,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACpD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACN,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC;IACrC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,iBAAiB,GACrB,CAAC,iCAAiC,CAAC,WAAW,EAAE,MAAM,CAAC;QACvD,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,4BAA4B,CACzD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAClE,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;QACtD,GAAG,KAAK;QACR,WAAW;QACX,iBAAiB;QACjB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B;QAC3C,oBAAoB,EAAE,CAAC,UAAU,EAAE,EAAE;YACnC,2BAA2B,GAAG,UAAU,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAClD,KAAK,CAAC,eAAe,CAAC,EAAE,CACzB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,gCAAgC,CACxD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAC/C;QACE,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,2BAA2B;QACtC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,EACD,KAAK,IAAI,EAAE,CACT,CAAC,MAAM,sBAAsB,CAAC;QAC5B,aAAa;QACb,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;KACT,CAAC,CAAC;QACD,CAAC,CAAC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,aAAa;YACb,2BAA2B;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CACX,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAsC;IAEtC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,yBAAyB,CAAC,KAAK,CAAC;YACjC,CAAC,sCAAsC,CAAC,KAAK,CAAC;YAE9C,MAAM,KAAK,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAGC;IAED,MAAM,EAAE,aAAa,EAAE,2BAA2B,EAAE,GAAG,KAAK,CAAC;IAC7D,OAAO,aAAa;QAClB,CAAC,CAAC,kCAAkC,CAAC;YACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,sCAAsC,EACpC,KAAK,CAAC,sCAAsC;YAC9C,wCAAwC,EACtC,KAAK,CAAC,wCAAwC;YAChD,aAAa;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACJ,CAAC,CAAC,0BAA0B,CAAC;YACzB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,IAAI,IAAI;YACpE,2BAA2B;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type { AccessManifestCheckpoint } from \"@tearleads/crypto\";\nimport {\n isKeyingVerificationError,\n runWithSecurityIncidentReporting,\n} from \"../../../../data/keyingProjectionVerification/error\";\nimport { isProjectionVerificationCancelledError } from \"../../../../data/keyingProjectionVerification/types\";\nimport {\n heldContainerBinding,\n listingRepeatsHeldOrdinaryBinding,\n} from \"../../../../data/persistence/container-contents/containerBinding\";\nimport type { ContainerHydrationTombstone } from \"../../containerPersistence\";\nimport { installContainerMetadataRecord } from \"../../metadata/metadataPersistence\";\nimport { projectionGeneration } from \"../../projectionGeneration\";\nimport type { PrefetchedDestinationProjection } from \"../destination/destinationPrefetch\";\nimport { verifyRemoteContainerDestination } from \"../destination/verifiedDestination\";\nimport { rebindReHomedContainer } from \"../heldContainerRebind\";\nimport {\n moveIndexedContainerChild,\n removeIndexedContainerChild,\n} from \"../lanes/childIndex\";\nimport {\n reconcileLocalOnlyRootContainers,\n reconcileLocalOnlySystemContainers,\n} from \"../reconciliation\";\nimport type {\n ContainerChildIndex,\n ContainerState,\n RemoteContainer,\n RemoteContainerHydrationHost,\n RemoteContainerHydrationState,\n} from \"../types\";\nimport { insertRemoteContainerState } from \"./insertRemoteContainer\";\nimport {\n applyRemoteContainerTimestamps,\n remoteContainerHydrationSaveOptions,\n resolveRemoteContainerHydrationLocalUpdatedAt,\n} from \"./remoteContainerTimestamps\";\n\n// Container ids (restricted to the inbound page) that carry an unsynced local\n// create or move intent. Such a container's parent and local-edit timestamp are\n// owned by its structural-intent lane until that lane reconciles, so inbound\n// hydration must not revert parentId to the server value nor collapse\n// localUpdatedAt — doing so silently undoes a queued move and falsely reads\n// \"synced\". Move intents are read via listUnsyncedMoveIntents so a blocked\n// move — one whose destination parent has not synced yet, the common boot-time\n// case — is protected too. Pending metadata\n// updates are handled separately (listRemoteContainerIdsWithPendingMetadataUpdates);\n// structural intents live in the local outbox's container lanes, which that\n// query does not cover.\nexport async function listRemoteContainerIdsWithPendingStructuralIntents(input: {\n remoteContainers: ReadonlyArray<RemoteContainer>;\n state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n if (input.remoteContainers.length === 0) {\n return new Set();\n }\n const remoteContainerIds = new Set(\n input.remoteContainers.map((remoteContainer) => remoteContainer.id),\n );\n\n const execSql = input.state.runtime.infra.execSql;\n const [pendingCreateIntents, unsyncedMoveIntents] = await Promise.all([\n input.state.persistence.listPendingCreateIntents(execSql),\n input.state.persistence.listUnsyncedMoveIntents(execSql),\n ]);\n const containerIdsWithPendingStructuralIntents = new Set<string>();\n for (const intent of pendingCreateIntents) {\n if (remoteContainerIds.has(intent.containerId)) {\n containerIdsWithPendingStructuralIntents.add(intent.containerId);\n }\n }\n for (const intent of unsyncedMoveIntents) {\n if (remoteContainerIds.has(intent.containerId)) {\n containerIdsWithPendingStructuralIntents.add(intent.containerId);\n }\n }\n return containerIdsWithPendingStructuralIntents;\n}\n\nexport async function listRemoteContainerIdsWithPendingMetadataUpdates(input: {\n remoteContainers: ReadonlyArray<RemoteContainer>;\n state: RemoteContainerHydrationState;\n}): Promise<Set<string>> {\n const containerIds = input.remoteContainers.flatMap((remoteContainer) => {\n const previousLocalUpdatedAt = input.state.containersById.get(\n remoteContainer.id,\n )?.container.localUpdatedAt;\n\n return previousLocalUpdatedAt &&\n previousLocalUpdatedAt.localeCompare(remoteContainer.updatedAt) > 0\n ? [remoteContainer.id]\n : [];\n });\n if (containerIds.length === 0) {\n return new Set();\n }\n\n const execSql = input.state.runtime.infra.execSql;\n return new Set(\n await input.state.persistence.listContainerIdsWithPendingUpdates(\n execSql,\n containerIds,\n ),\n );\n}\n\nfunction removeMissingHydratedContainer(input: {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n existingState: ContainerState;\n host: RemoteContainerHydrationHost;\n previousParentId: string \| null;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): void {\n const { existingState, remoteContainer, state } = input;\n if (state.containersById.get(remoteContainer.id) !== existingState) {\n return;\n }\n\n state.containersById.delete(remoteContainer.id);\n if (input.childIdsByParentId) {\n removeIndexedContainerChild(\n input.childIdsByParentId,\n remoteContainer.id,\n input.previousParentId,\n );\n input.childIdsByParentId.delete(remoteContainer.id);\n }\n input.host.updateSnapshot();\n}\n\nfunction createUpdatedRemoteContainerState(\n existingState: ContainerState,\n remoteContainer: RemoteContainer,\n): ContainerState {\n return {\n ...existingState,\n container: applyRemoteContainerTimestamps(\n existingState.container,\n remoteContainer,\n ),\n containerWriterProjection: null,\n metadataReferencedPrincipals: remoteContainer.metadataReferencedPrincipals,\n };\n}\n\nfunction installUpdatedRemoteContainerState(\n existingState: ContainerState,\n nextState: ContainerState,\n host: RemoteContainerHydrationHost,\n): void {\n const wasLocalOnly = existingState.container.serverCreatedAt == null;\n existingState.container = nextState.container;\n existingState.containerWriterProjection = nextState.containerWriterProjection;\n existingState.metadataReferencedPrincipals =\n nextState.metadataReferencedPrincipals;\n // The snapshot copied the live generation when it was taken; a hint that\n // landed during the persist leaves the live metadata projection dropped.\n if (projectionGeneration(existingState) === projectionGeneration(nextState))\n existingState.metadataWriterProjection = nextState.metadataWriterProjection;\n installContainerMetadataRecord(existingState, nextState.record);\n // A document pass may have deferred while this root was awaiting proof.\n // The first durable remote acknowledgement makes its pending creates runnable.\n if (wasLocalOnly && existingState.container.serverCreatedAt != null)\n host.requestDocumentPriming?.();\n}\n\nasync function updateExistingRemoteContainerState(input: {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n host: RemoteContainerHydrationHost;\n isCurrent?: (() => boolean) \| undefined;\n existingState: ContainerState;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}): Promise<ContainerState \| null> {\n const { childIdsByParentId, existingState, host, remoteContainer, state } =\n input;\n const previousParentId = existingState.container.parentId;\n const previousLocalUpdatedAt = existingState.container.localUpdatedAt;\n // A queued, not-yet-synced local move/create owns this container's parent\n // until its intent lane reconciles. Omit the remote parent when the page scan\n // saw one; persistence also rechecks the intent transactionally so a move\n // created after that scan wins. Both paths preserve the durable local clock.\n const hasPendingStructuralIntent =\n input.containerIdsWithPendingStructuralIntents.has(remoteContainer.id);\n const nextParentId = hasPendingStructuralIntent\n ? undefined\n : remoteContainer.parentId;\n const localUpdatedAt = resolveRemoteContainerHydrationLocalUpdatedAt({\n containerIdsWithPendingMetadataUpdates:\n input.containerIdsWithPendingMetadataUpdates,\n hasPendingStructuralIntent,\n previousLocalUpdatedAt,\n remoteContainer,\n });\n const nextState = createUpdatedRemoteContainerState(\n existingState,\n remoteContainer,\n );\n const persistenceResult = await host.persistContainerState(\n nextState,\n {\n accessEpoch: remoteContainer.metadataAccessEpoch,\n accessStateHash: remoteContainer.metadataAccessStateHash,\n documentId: remoteContainer.metadataDocumentId,\n effectiveAccessLevel: remoteContainer.effectiveAccessLevel,\n metadataDocumentId: remoteContainer.metadataDocumentId,\n systemSlot: remoteContainer.systemSlot ?? null,\n organizationId: remoteContainer.organizationId,\n ...(nextParentId !== undefined ? { parentId: nextParentId } : {}),\n },\n false,\n remoteContainerHydrationSaveOptions({\n localUpdatedAt,\n remoteContainer,\n }),\n {\n preserveDurableStructureWhenPending: true,\n },\n );\n if (persistenceResult.status === \"missing\") {\n // Hydration persists a detached candidate so an in-flight response cannot\n // mutate mapped state before its guards settle. Retire the exact state this\n // hydration read because store-level reference cleanup cannot see the clone.\n removeMissingHydratedContainer({\n childIdsByParentId,\n existingState,\n host,\n previousParentId,\n remoteContainer,\n state,\n });\n return null;\n }\n if (persistenceResult.status !== \"persisted\") return null;\n const { record: nextRecord } = persistenceResult;\n installContainerMetadataRecord(nextState, nextRecord);\n if (input.isCurrent?.() === false) {\n return existingState;\n }\n nextState.container = {\n ...nextState.container,\n metadataDocumentId: remoteContainer.metadataDocumentId,\n organizationId: remoteContainer.organizationId,\n parentId: nextState.container.parentId,\n };\n\n installUpdatedRemoteContainerState(existingState, nextState, host);\n moveIndexedContainerChild(\n childIdsByParentId,\n remoteContainer.id,\n previousParentId,\n existingState.container.parentId,\n );\n await reconcileLocalOnlyRootContainers({\n childIdsByParentId,\n isCurrent: input.isCurrent,\n remoteRootState: existingState,\n requestDocumentPriming: host.requestDocumentPriming,\n state,\n });\n return existingState;\n}\n\ninterface UpsertRemoteContainerStateInput {\n childIdsByParentId?: ContainerChildIndex \| undefined;\n containerIdsWithPendingMetadataUpdates: ReadonlySet<string>;\n containerIdsWithPendingStructuralIntents: ReadonlySet<string>;\n host: RemoteContainerHydrationHost;\n expectedHydrationTombstone?: ContainerHydrationTombstone \| null \| undefined;\n isCurrent?: (() => boolean) \| undefined;\n prefetchedProjection?: PrefetchedDestinationProjection \| undefined;\n remoteContainer: RemoteContainer;\n state: RemoteContainerHydrationState;\n}\n\nexport async function upsertRemoteContainerState(\n input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState \| null> {\n let expectedPlacementCheckpoint: AccessManifestCheckpoint \| undefined;\n const heldState = input.state.containersById.get(input.remoteContainer.id);\n const heldBinding = heldState\n ? heldContainerBinding(heldState)\n : await input.state.persistence.loadHeldContainerBinding(\n input.state.runtime.infra.execSql,\n input.remoteContainer.id,\n );\n const listed = input.remoteContainer;\n // A folder re-homed away from the listed organization never returns there,\n // whatever binding (possibly none, after a reset) the device holds now.\n const supersededListing =\n !listingRepeatsHeldOrdinaryBinding(heldBinding, listed) &&\n (await input.state.persistence.isSupersededContainerBinding(\n input.state.runtime.infra.execSql,\n { containerId: listed.id, organizationId: listed.organizationId },\n ));\n if (input.isCurrent?.() === false) return null;\n const verified = await verifyRemoteContainerDestination({\n ...input,\n heldBinding,\n supersededListing,\n refresh: !!input.expectedHydrationTombstone,\n onVerifiedCheckpoint: (checkpoint) => {\n expectedPlacementCheckpoint = checkpoint;\n },\n });\n if (!verified \|\| input.isCurrent?.() === false) return null;\n input = { ...input, remoteContainer: verified };\n const existingState = input.state.containersById.get(\n input.remoteContainer.id,\n );\n const remoteState = await runWithSecurityIncidentReporting(\n input.state.runtime.util.reportSecurityIncident,\n {\n objectId: verified.id,\n objectKind: \"container\",\n operation: \"container.binding.persist\",\n organizationId: verified.organizationId,\n },\n async () =>\n (await rebindReHomedContainer({\n existingState,\n heldBinding,\n isCurrent: input.isCurrent,\n state: input.state,\n verified,\n }))\n ? persistVerifiedRemoteContainer({\n ...input,\n existingState,\n expectedPlacementCheckpoint,\n })\n : null,\n );\n if (!remoteState) {\n return null;\n }\n await reconcileLocalOnlySystemContainers({\n childIdsByParentId: input.childIdsByParentId,\n isCurrent: input.isCurrent,\n requestDocumentPriming: input.host.requestDocumentPriming,\n remoteSystemState: remoteState,\n state: input.state,\n });\n return remoteState;\n}\n\n/*\n Upsert one listed folder, isolating a rejected proof or binding. The refusal\n * was already reported; returning no state leaves the item unapplied without\n * blocking independent folders.\n */\nexport async function upsertIsolatedRemoteContainerState(\n input: UpsertRemoteContainerStateInput,\n): Promise<ContainerState \| null> {\n try {\n return await upsertRemoteContainerState(input);\n } catch (error) {\n if (\n !isKeyingVerificationError(error) &&\n !isProjectionVerificationCancelledError(error)\n )\n throw error;\n return null;\n }\n}\n\nfunction persistVerifiedRemoteContainer(\n input: UpsertRemoteContainerStateInput & {\n existingState: ContainerState \| undefined;\n expectedPlacementCheckpoint: AccessManifestCheckpoint \| undefined;\n },\n): Promise<ContainerState \| null> {\n const { existingState, expectedPlacementCheckpoint } = input;\n return existingState\n ? updateExistingRemoteContainerState({\n childIdsByParentId: input.childIdsByParentId,\n containerIdsWithPendingMetadataUpdates:\n input.containerIdsWithPendingMetadataUpdates,\n containerIdsWithPendingStructuralIntents:\n input.containerIdsWithPendingStructuralIntents,\n existingState,\n host: input.host,\n isCurrent: input.isCurrent,\n remoteContainer: input.remoteContainer,\n state: input.state,\n })\n : insertRemoteContainerState({\n childIdsByParentId: input.childIdsByParentId,\n host: input.host,\n expectedHydrationTombstone: input.expectedHydrationTombstone ?? null,\n expectedPlacementCheckpoint,\n isCurrent: input.isCurrent,\n remoteContainer: input.remoteContainer,\n state: input.state,\n });\n}\n"]}

package/workflows/container-contents/remoteHydration/types.d.ts CHANGED Viewed

@@ -2,11 +2,11 @@ import type { RequestResult } from "../../../internal/api-client/index.js";
 import type { ContainerReplacementAuthorizationsResponse } from "../../../internal/validators/operation/index.js";
 import type { ListContainerParentLanesRequest } from "../../../internal/validators/request/index.js";
 import type { ContainerSummary, ContainerWriterProjectionResponse, DocumentWriterProjectionResponse, ListContainerParentLanesResponse, ListContainersResponse, ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
-import type { createContainerMetadataDocument } from "../../../data/containers/containerMetadataDocument.js";
 import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
 import type { PrincipalPolicyHistoryReader } from "../../principals/principalPolicyHistoryReader.js";
 import type { ContainerContentsPersistence, ContainerDocumentRecord, ContainerHydrationTombstone, ContainerRecord, createContainerParentSyncLane } from "../containerPersistence.js";
 import type { ContainerMetadataPatch } from "../metadata/index.js";
+import type { createContainerMetadataDocument } from "../metadata/containerMetadataDocument.js";
 import type { ContainerContentsWorkflowRuntime } from "../runtime.js";
 export type ListedRemoteContainerPageItem = ListContainersResponse["items"][number];
 export type ContainerChildIndex = Map<string, Set<string>>;

package/workflows/container-contents/remoteHydration/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { ContainerReplacementAuthorizationsResponse } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerSummary,\n ContainerWriterProjectionResponse,\n DocumentWriterProjectionResponse,\n ListContainerParentLanesResponse,\n ListContainersResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { ~~createContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type {~~ CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n ContainerContentsPersistence,\n ContainerDocumentRecord,\n ContainerHydrationTombstone,\n ContainerRecord,\n createContainerParentSyncLane,\n} from \"../containerPersistence\";\nimport type { ContainerMetadataPatch } from \"../metadata\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ListedRemoteContainerPageItem =\n ListContainersResponse[\"items\"][number];\nexport type ContainerChildIndex = Map<string, Set<string>>;\nexport type QueueContainerParentLane = (parentId: string \| null) => void;\nexport type RemoteContainerIngestQueue = Map<string, RemoteContainer>;\nexport type SaveContainerOptions = Parameters<\n ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nexport type ContainerMetadataDocumentState = Awaited<\n ReturnType<typeof createContainerMetadataDocument>\n>;\nexport type RemoteContainer = Pick<\n ContainerSummary,\n \| \"createdAt\"\n \| \"effectiveAccessLevel\"\n \| \"systemSlot\"\n \| \"id\"\n \| \"metadataAccessEpoch\"\n \| \"metadataAccessStateHash\"\n \| \"metadataDocumentId\"\n \| \"metadataReferencedPrincipals\"\n \| \"organizationId\"\n \| \"parentId\"\n \| \"updatedAt\"\n>;\n\nexport interface ContainerState {\n containerWriterProjection?:\n \| ContainerWriterProjectionResponse\n \| null\n \| undefined;\n /*\n Bumped whenever a realtime hint drops this container's cached writer\n * projections (container and metadata document alike); an operation that\n * fetched or carried a projection installs it only if this is unchanged\n * since it started, so a pre-hint answer never lands after the hint.\n /\n writerProjectionGeneration?: number \| undefined;\n metadataReferencedPrincipals?:\n \| readonly ReferencedPrincipalStateResponse[]\n \| undefined;\n container: ContainerRecord;\n doc: ContainerMetadataDocumentState;\n metadataWriterProjection?:\n \| DocumentWriterProjectionResponse\n \| null\n \| undefined;\n /* Durable pull progress mirrored from the metadata document record. /\n pullContinuation?: ContainerDocumentRecord[\"pullContinuation\"] \| undefined;\n record: ContainerDocumentRecord;\n}\n\ninterface RemoteContainerHydrationApi\n extends Partial<PrincipalPolicyHistoryReader>,\n CurrentPrincipalPolicyReader {\n getContainerReplacementAuthorizationsResult(\n containerId: string,\n replacesOrganizationId: string,\n ): Promise<RequestResult<ContainerReplacementAuthorizationsResponse>>;\n evictContainerWriterProjection(containerId: string): void;\n getContainerWriterProjection(\n containerId: string,\n ): Promise<ContainerWriterProjectionResponse \| null>;\n listContainerParentLanes(\n input: ListContainerParentLanesRequest,\n ): Promise<ListContainerParentLanesResponse \| null>;\n}\n\ninterface RemoteContainerHydrationRuntime\n extends Pick<\n ContainerContentsWorkflowRuntime,\n \| \"auth\"\n \| \"adoptRootContainer\"\n \| \"crypto\"\n \| \"infra\"\n \| \"resolveTrustedUserIdentity\"\n \| \"state\"\n \| \"util\"\n > {\n apiClient: RemoteContainerHydrationApi;\n}\n\nexport interface RemoteContainerHydrationState {\n containersById: Map<string, ContainerState>;\n lifecycleGeneration?: number \| undefined;\n persistence: ContainerContentsPersistence;\n rootLaneHydrated?: boolean \| undefined;\n runtime: RemoteContainerHydrationRuntime;\n structuralGeneration?: number \| undefined;\n}\n\nexport type PersistContainerStateResult =\n \| { status: \"identity-superseded\"; record: ContainerDocumentRecord }\n \| { status: \"missing\" }\n \| {\n status: \"persisted\";\n record: ContainerDocumentRecord;\n createIntentSettled?: true \| undefined;\n moveIntentSettled?: true \| undefined;\n }\n \| { status: \"stale-generation\" };\n\nexport interface RemoteContainerHydrationHost {\n persistContainerState: (\n containerState: ContainerState,\n patch?: Partial<ContainerMetadataPatch>,\n updateView?: boolean,\n saveOptions?: SaveContainerOptions,\n mutationOptions?: {\n /* Queued metadata rows the server committed, settled in this write. */\n acceptedPendingUpdateIds?: readonly string[] \| undefined;\n clearSyncFailure?: boolean \| undefined;\n expectedStateWhenMissing?: ContainerState \| undefined;\n isCurrent?: (() => boolean) \| undefined;\n createIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"createIntentSettlement\"];\n moveIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"moveIntentSettlement\"];\n preserveDurableStructureWhenPending?: boolean \| undefined;\n },\n ) => Promise<PersistContainerStateResult>;\n requestDocumentPriming?: (() => void) \| undefined;\n updateSnapshot: () => void;\n}\n\nexport interface ContainerParentHydrationLane {\n parentId: string \| null;\n watermark?: ListContainersResponse[\"nextWatermark\"];\n}\n\nexport interface ExpectedContainerState {\n container: ContainerRecord;\n fingerprint: string;\n}\n\nexport interface FetchedContainerParentLanePage {\n expectedContainerStates: ReadonlyMap<string, ExpectedContainerState>;\n expectedHydrationTombstones: ReadonlyMap<string, ContainerHydrationTombstone>;\n lane: ContainerParentHydrationLane;\n response: ListContainersResponse;\n syncLane: ReturnType<typeof createContainerParentSyncLane>;\n}\n"]}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { ContainerReplacementAuthorizationsResponse } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerSummary,\n ContainerWriterProjectionResponse,\n DocumentWriterProjectionResponse,\n ListContainerParentLanesResponse,\n ListContainersResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport type { PrincipalPolicyHistoryReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type {\n ContainerContentsPersistence,\n ContainerDocumentRecord,\n ContainerHydrationTombstone,\n ContainerRecord,\n createContainerParentSyncLane,\n} from \"../containerPersistence\";\nimport type { ContainerMetadataPatch } from \"../metadata\";\nimport type { createContainerMetadataDocument } from \"../metadata/containerMetadataDocument\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ListedRemoteContainerPageItem =\n ListContainersResponse[\"items\"][number];\nexport type ContainerChildIndex = Map<string, Set<string>>;\nexport type QueueContainerParentLane = (parentId: string \| null) => void;\nexport type RemoteContainerIngestQueue = Map<string, RemoteContainer>;\nexport type SaveContainerOptions = Parameters<\n ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nexport type ContainerMetadataDocumentState = Awaited<\n ReturnType<typeof createContainerMetadataDocument>\n>;\nexport type RemoteContainer = Pick<\n ContainerSummary,\n \| \"createdAt\"\n \| \"effectiveAccessLevel\"\n \| \"systemSlot\"\n \| \"id\"\n \| \"metadataAccessEpoch\"\n \| \"metadataAccessStateHash\"\n \| \"metadataDocumentId\"\n \| \"metadataReferencedPrincipals\"\n \| \"organizationId\"\n \| \"parentId\"\n \| \"updatedAt\"\n>;\n\nexport interface ContainerState {\n containerWriterProjection?:\n \| ContainerWriterProjectionResponse\n \| null\n \| undefined;\n /*\n Bumped whenever a realtime hint drops this container's cached writer\n * projections (container and metadata document alike); an operation that\n * fetched or carried a projection installs it only if this is unchanged\n * since it started, so a pre-hint answer never lands after the hint.\n /\n writerProjectionGeneration?: number \| undefined;\n metadataReferencedPrincipals?:\n \| readonly ReferencedPrincipalStateResponse[]\n \| undefined;\n container: ContainerRecord;\n doc: ContainerMetadataDocumentState;\n metadataWriterProjection?:\n \| DocumentWriterProjectionResponse\n \| null\n \| undefined;\n /* Durable pull progress mirrored from the metadata document record. /\n pullContinuation?: ContainerDocumentRecord[\"pullContinuation\"] \| undefined;\n record: ContainerDocumentRecord;\n}\n\ninterface RemoteContainerHydrationApi\n extends Partial<PrincipalPolicyHistoryReader>,\n CurrentPrincipalPolicyReader {\n getContainerReplacementAuthorizationsResult(\n containerId: string,\n replacesOrganizationId: string,\n ): Promise<RequestResult<ContainerReplacementAuthorizationsResponse>>;\n evictContainerWriterProjection(containerId: string): void;\n getContainerWriterProjection(\n containerId: string,\n ): Promise<ContainerWriterProjectionResponse \| null>;\n listContainerParentLanes(\n input: ListContainerParentLanesRequest,\n ): Promise<ListContainerParentLanesResponse \| null>;\n}\n\ninterface RemoteContainerHydrationRuntime\n extends Pick<\n ContainerContentsWorkflowRuntime,\n \| \"auth\"\n \| \"adoptRootContainer\"\n \| \"crypto\"\n \| \"infra\"\n \| \"resolveTrustedUserIdentity\"\n \| \"state\"\n \| \"util\"\n > {\n apiClient: RemoteContainerHydrationApi;\n}\n\nexport interface RemoteContainerHydrationState {\n containersById: Map<string, ContainerState>;\n lifecycleGeneration?: number \| undefined;\n persistence: ContainerContentsPersistence;\n rootLaneHydrated?: boolean \| undefined;\n runtime: RemoteContainerHydrationRuntime;\n structuralGeneration?: number \| undefined;\n}\n\nexport type PersistContainerStateResult =\n \| { status: \"identity-superseded\"; record: ContainerDocumentRecord }\n \| { status: \"missing\" }\n \| {\n status: \"persisted\";\n record: ContainerDocumentRecord;\n createIntentSettled?: true \| undefined;\n moveIntentSettled?: true \| undefined;\n }\n \| { status: \"stale-generation\" };\n\nexport interface RemoteContainerHydrationHost {\n persistContainerState: (\n containerState: ContainerState,\n patch?: Partial<ContainerMetadataPatch>,\n updateView?: boolean,\n saveOptions?: SaveContainerOptions,\n mutationOptions?: {\n /* Queued metadata rows the server committed, settled in this write. */\n acceptedPendingUpdateIds?: readonly string[] \| undefined;\n clearSyncFailure?: boolean \| undefined;\n expectedStateWhenMissing?: ContainerState \| undefined;\n isCurrent?: (() => boolean) \| undefined;\n createIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"createIntentSettlement\"];\n moveIntentSettlement?: Parameters<\n ContainerContentsPersistence[\"commitMetadataMutation\"]\n >[1][\"moveIntentSettlement\"];\n preserveDurableStructureWhenPending?: boolean \| undefined;\n },\n ) => Promise<PersistContainerStateResult>;\n requestDocumentPriming?: (() => void) \| undefined;\n updateSnapshot: () => void;\n}\n\nexport interface ContainerParentHydrationLane {\n parentId: string \| null;\n watermark?: ListContainersResponse[\"nextWatermark\"];\n}\n\nexport interface ExpectedContainerState {\n container: ContainerRecord;\n fingerprint: string;\n}\n\nexport interface FetchedContainerParentLanePage {\n expectedContainerStates: ReadonlyMap<string, ExpectedContainerState>;\n expectedHydrationTombstones: ReadonlyMap<string, ContainerHydrationTombstone>;\n lane: ContainerParentHydrationLane;\n response: ListContainersResponse;\n syncLane: ReturnType<typeof createContainerParentSyncLane>;\n}\n"]}

package/workflows/container-contents/storedContainerState.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
 import { exportAllUpdates, importUpdates } from "../../internal/loro/index.js";
-import { createContainerMetadataDocument, getDefaultContainerName, readContainerMetadataValue, writeContainerMetadataValue, } from "../../data/containers/containerMetadataDocument.js";
 import { enqueuePendingContainerUpdate, } from "./containerPersistence.js";
+import { createContainerMetadataDocument, getDefaultContainerName, readContainerMetadataValue, writeContainerMetadataValue, } from "./metadata/containerMetadataDocument.js";
 function createInitialContainerRecord(input) {
     return {
         accessEpoch: 1,

package/workflows/container-contents/storedContainerState.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"storedContainerState.js","sourceRoot":"","sources":["storedContainerState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;~~AAClE~~,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,~~iDAAiD~~,CAAC;~~AAEzD~~,~~OAAO,EAGL,6BAA6B,GAE9B,MAAM,wBAAwB,CAAC;AAOhC,~~SAAS,4BAA4B,CAAC,KAGrC;IACC,OAAO;QACL,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;QACtB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAuC,EACvC,KAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA4C;IAE5C,MAAM,cAAc,GAClB,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1D,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC;IAExC,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;QAChC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG;YACd,GAAG,SAAS;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,yBAAyB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,CAAC,aAAa,CAC7B,OAAO,EACP,aAAa,EACb,UAAU,EACV,iBAAiB,CAAC,SAAS,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC5C,UAAU,GAAG,4BAA4B,CAAC;YACxC,SAAS;YACT,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAEpE,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,6BAA6B,CAAC,OAAO,EAAE,WAAW,EAAE;gBACxD,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAE7D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport ~~{\n createContainerMetadataDocument,\n getDefaultContainerName,\n readContainerMetadataValue,\n writeContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport~~ type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n type ContainerContentsPersistence,\n type ContainerMetadataRecord,\n enqueuePendingContainerUpdate,\n type StoredContainerState,\n} from \"./containerPersistence\";\nimport type { ContainerState } from \"./remoteHydration/types\";\n\ntype SaveContainerOptions = Parameters<\n ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nfunction createInitialContainerRecord(input: {\n container: StoredContainerState[\"container\"];\n metadataUpdates: string;\n}): ContainerMetadataRecord {\n return {\n accessEpoch: 1,\n accessStateHash: null,\n contentKeyBundle: null,\n documentId: input.container.metadataDocumentId,\n documentKekTargets: null,\n documentManifestBundle: null,\n id: input.container.id,\n lastCommitLsn: null,\n metadataUpdates: input.metadataUpdates,\n snapshotEndVersion: \"\",\n };\n}\n\nfunction metadataProjectionChanged(\n left: StoredContainerState[\"container\"],\n right: StoredContainerState[\"container\"],\n): boolean {\n return left.icon !== right.icon \|\| left.name !== right.name;\n}\n\nfunction replaySaveOptions(\n container: StoredContainerState[\"container\"],\n): SaveContainerOptions {\n const localUpdatedAt =\n container.localUpdatedAt ?? container.updatedAt ?? null;\n return localUpdatedAt ? { localUpdatedAt } : undefined;\n}\n\nexport async function hydrateStoredContainerState(input: {\n execSql: ExecSql;\n persistence: ContainerContentsPersistence;\n storedContainer: StoredContainerState;\n}): Promise<ContainerState> {\n const { execSql, persistence, storedContainer } = input;\n const { container } = storedContainer;\n const doc = await createContainerMetadataDocument(container.id);\n let nextContainer = container;\n let nextRecord = storedContainer.record;\n\n if (nextRecord?.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(nextRecord.metadataUpdates)]);\n const metadata = readContainerMetadataValue(\n doc,\n getDefaultContainerName(container.parentId),\n );\n nextContainer = {\n ...container,\n icon: metadata.icon,\n name: metadata.name,\n };\n if (metadataProjectionChanged(container, nextContainer)) {\n await persistence.saveContainer(\n execSql,\n nextContainer,\n nextRecord,\n replaySaveOptions(container),\n );\n }\n } else {\n writeContainerMetadataValue(doc, {\n icon: container.icon,\n name: container.name,\n });\n const initialUpdate = exportAllUpdates(doc);\n nextRecord = createInitialContainerRecord({\n container,\n metadataUpdates: bytesToBase64(initialUpdate),\n });\n await persistence.saveContainer(execSql, nextContainer, nextRecord);\n\n // A device-first child's first metadata waits for its create. A root's\n // never does: only registration creates a root remotely, and provisioning\n // commits the root's metadata itself, so a queued copy would only be\n // replayed after login as duplicate ops.\n if (!container.metadataDocumentId && container.parentId !== null) {\n await enqueuePendingContainerUpdate(execSql, persistence, {\n containerId: container.id,\n update: initialUpdate,\n });\n }\n }\n\n return { container: nextContainer, doc, record: nextRecord };\n}\n\n/** Materialize a CAS winner without writing repair rows from a stale caller. */\nexport async function materializeStoredContainerStateReadOnly(input: {\n storedContainer: StoredContainerState;\n}): Promise<ContainerState \| null> {\n const { container, record } = input.storedContainer;\n if (!record) return null;\n const doc = await createContainerMetadataDocument(container.id);\n let nextContainer = container;\n if (record.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(record.metadataUpdates)]);\n const metadata = readContainerMetadataValue(\n doc,\n getDefaultContainerName(container.parentId),\n );\n nextContainer = { ...container, icon: metadata.icon, name: metadata.name };\n } else {\n writeContainerMetadataValue(doc, {\n icon: container.icon,\n name: container.name,\n });\n }\n return { container: nextContainer, doc, record };\n}\n"]}
1	+ {"version":3,"file":"storedContainerState.js","sourceRoot":"","sources":["storedContainerState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAGL,6BAA6B,GAE9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAO9C,SAAS,4BAA4B,CAAC,KAGrC;IACC,OAAO;QACL,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;QACtB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAuC,EACvC,KAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA4C;IAE5C,MAAM,cAAc,GAClB,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1D,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC;IAExC,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;QAChC,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG;YACd,GAAG,SAAS;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,yBAAyB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,CAAC,aAAa,CAC7B,OAAO,EACP,aAAa,EACb,UAAU,EACV,iBAAiB,CAAC,SAAS,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC5C,UAAU,GAAG,4BAA4B,CAAC;YACxC,SAAS;YACT,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAEpE,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,6BAA6B,CAAC,OAAO,EAAE,WAAW,EAAE;gBACxD,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAE7D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,0BAA0B,CACzC,GAAG,EACH,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC5C,CAAC;QACF,aAAa,GAAG,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,GAAG,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { exportAllUpdates, importUpdates } from \"@tearleads/loro\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n type ContainerContentsPersistence,\n type ContainerMetadataRecord,\n enqueuePendingContainerUpdate,\n type StoredContainerState,\n} from \"./containerPersistence\";\nimport {\n createContainerMetadataDocument,\n getDefaultContainerName,\n readContainerMetadataValue,\n writeContainerMetadataValue,\n} from \"./metadata/containerMetadataDocument\";\nimport type { ContainerState } from \"./remoteHydration/types\";\n\ntype SaveContainerOptions = Parameters<\n ContainerContentsPersistence[\"saveContainer\"]\n>[3];\n\nfunction createInitialContainerRecord(input: {\n container: StoredContainerState[\"container\"];\n metadataUpdates: string;\n}): ContainerMetadataRecord {\n return {\n accessEpoch: 1,\n accessStateHash: null,\n contentKeyBundle: null,\n documentId: input.container.metadataDocumentId,\n documentKekTargets: null,\n documentManifestBundle: null,\n id: input.container.id,\n lastCommitLsn: null,\n metadataUpdates: input.metadataUpdates,\n snapshotEndVersion: \"\",\n };\n}\n\nfunction metadataProjectionChanged(\n left: StoredContainerState[\"container\"],\n right: StoredContainerState[\"container\"],\n): boolean {\n return left.icon !== right.icon \|\| left.name !== right.name;\n}\n\nfunction replaySaveOptions(\n container: StoredContainerState[\"container\"],\n): SaveContainerOptions {\n const localUpdatedAt =\n container.localUpdatedAt ?? container.updatedAt ?? null;\n return localUpdatedAt ? { localUpdatedAt } : undefined;\n}\n\nexport async function hydrateStoredContainerState(input: {\n execSql: ExecSql;\n persistence: ContainerContentsPersistence;\n storedContainer: StoredContainerState;\n}): Promise<ContainerState> {\n const { execSql, persistence, storedContainer } = input;\n const { container } = storedContainer;\n const doc = await createContainerMetadataDocument(container.id);\n let nextContainer = container;\n let nextRecord = storedContainer.record;\n\n if (nextRecord?.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(nextRecord.metadataUpdates)]);\n const metadata = readContainerMetadataValue(\n doc,\n getDefaultContainerName(container.parentId),\n );\n nextContainer = {\n ...container,\n icon: metadata.icon,\n name: metadata.name,\n };\n if (metadataProjectionChanged(container, nextContainer)) {\n await persistence.saveContainer(\n execSql,\n nextContainer,\n nextRecord,\n replaySaveOptions(container),\n );\n }\n } else {\n writeContainerMetadataValue(doc, {\n icon: container.icon,\n name: container.name,\n });\n const initialUpdate = exportAllUpdates(doc);\n nextRecord = createInitialContainerRecord({\n container,\n metadataUpdates: bytesToBase64(initialUpdate),\n });\n await persistence.saveContainer(execSql, nextContainer, nextRecord);\n\n // A device-first child's first metadata waits for its create. A root's\n // never does: only registration creates a root remotely, and provisioning\n // commits the root's metadata itself, so a queued copy would only be\n // replayed after login as duplicate ops.\n if (!container.metadataDocumentId && container.parentId !== null) {\n await enqueuePendingContainerUpdate(execSql, persistence, {\n containerId: container.id,\n update: initialUpdate,\n });\n }\n }\n\n return { container: nextContainer, doc, record: nextRecord };\n}\n\n/** Materialize a CAS winner without writing repair rows from a stale caller. */\nexport async function materializeStoredContainerStateReadOnly(input: {\n storedContainer: StoredContainerState;\n}): Promise<ContainerState \| null> {\n const { container, record } = input.storedContainer;\n if (!record) return null;\n const doc = await createContainerMetadataDocument(container.id);\n let nextContainer = container;\n if (record.metadataUpdates) {\n importUpdates(doc, [base64ToBytes(record.metadataUpdates)]);\n const metadata = readContainerMetadataValue(\n doc,\n getDefaultContainerName(container.parentId),\n );\n nextContainer = { ...container, icon: metadata.icon, name: metadata.name };\n } else {\n writeContainerMetadataValue(doc, {\n icon: container.icon,\n name: container.name,\n });\n }\n return { container: nextContainer, doc, record };\n}\n"]}

package/workflows/organizations/groupMetadata/groupMetadataAccess.js CHANGED Viewed

@@ -3,7 +3,7 @@ import { deriveOrganizationMetadataContainerSystemSlot } from "../../../internal
 import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
 import { unwrapContainerKekPath } from "../../../data/documents/shared/containerKek/containerKekPath.js";
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { loadContainers } from "../../../data/persistence/containers/containerPersistence.js";
+import { loadContainers } from "../../../data/persistence/container-contents/containerPersistence.js";
 import { withMetadataRootReload } from "./groupMetadataErrors.js";
 /**
  * A group's signed name does not open under the metadata key it cites, or opens

package/workflows/organizations/groupMetadata/groupMetadataAccess.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAKtG,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAG3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAuB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CACjC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAC7C,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n type ContainerAccessManifestState,\n decryptGroupMetadata,\n type GroupMetadataKey,\n type ReferencedPrincipalHead,\n readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n getTargetContainerContext,\n readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/containerKek/containerKekPath\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../../data/persistence/containers/containerPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { GroupPolicyNameReader } from \"../principalPolicy/principalPolicyRequest\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\n\nexport interface GroupMetadataAccessInput {\n readonly apiClient: {\n evictContainerWriterProjection(containerId: string): void;\n getContainerWriterProjection(\n containerId: string,\n ): Promise<ContainerWriterProjectionResponse \| null>;\n };\n readonly verifyMetadataContainer: (\n state: ContainerAccessManifestState,\n organizationReference?: ReferencedPrincipalHead \| undefined,\n ) => Promise<void>;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly targetSecretKey: Uint8Array;\n readonly stillCurrent?: (() => boolean) \| undefined;\n readonly warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n}\n\n/*\n A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n /\nexport class GroupMetadataUnreadableError extends Error {\n constructor(groupId: string, cause: unknown) {\n super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n this.name = \"GroupMetadataUnreadableError\";\n }\n}\n\nfunction loadMetadataKeyring(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n return withMetadataRootReload(\n () => loadMetadataKeyringOnce(input, containerId),\n () => input.apiClient.evictContainerWriterProjection(containerId),\n );\n}\n\nasync function loadMetadataKeyringOnce(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n const projection =\n await input.apiClient.getContainerWriterProjection(containerId);\n if (!projection) return null;\n if (\n projection.containerId !== containerId \|\|\n projection.organizationId !== input.organizationId\n )\n throw new Error(\"Group metadata container is unavailable\");\n const target = getTargetContainerContext(projection);\n const state = readContainerState(target.manifest);\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n if (\n state.organizationId !== input.organizationId \|\|\n state.systemSlot !== slot \|\|\n state.parentContainerId !== null\n )\n throw new Error(\n \"Group metadata requires the signed organization metadata container\",\n );\n await input.verifyMetadataContainer(\n state,\n projection.policyEvidence.organization?.head,\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keys = await unwrapContainerKekPath({\n ...input,\n projection,\n secretKey: input.targetSecretKey,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata container key is unavailable\");\n return {\n current: {\n organizationId: input.organizationId,\n containerId,\n containerKeyEpochId: target.kek.containerKeyEpochId,\n keyMaterial,\n },\n keys,\n };\n}\n\n/* Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n const loads = new Map<\n string,\n Promise<{\n current: GroupMetadataKey;\n keys: ReadonlyMap<string, Uint8Array>;\n } \| null>\n >();\n function loaded(containerId: string) {\n let pending = loads.get(containerId);\n if (!pending) {\n pending = loadMetadataKeyring(input, containerId);\n loads.set(containerId, pending);\n }\n return pending;\n }\n const readName: GroupPolicyNameReader = async (bundle) => {\n assertProjectionVerificationCurrent(input.stillCurrent);\n const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n if (\"role\" in metadata)\n return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n if (\n metadata.organizationId !== input.organizationId \|\|\n metadata.groupId !== bundle.currentState.principalId \|\|\n bundle.currentState.principalType !== \"group\"\n )\n throw new Error(\"Group metadata scope does not match its signed group\");\n const keyring = await loaded(metadata.containerId);\n const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata historical key is unavailable\");\n try {\n return await decryptGroupMetadata({\n key: { ...metadata, keyMaterial },\n groupId: bundle.currentState.principalId,\n payload: bundle.currentPayload.ciphertext,\n });\n } catch (cause) {\n throw new GroupMetadataUnreadableError(\n bundle.currentState.principalId,\n cause,\n );\n }\n };\n return {\n readName,\n async loadEncryptionKey(): Promise<GroupMetadataKey> {\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n const containers = await loadContainers(input.execSql);\n const container = containers.find(\n (row) =>\n row.organizationId === input.organizationId &&\n row.systemSlot === slot,\n );\n if (!container)\n throw new Error(\n \"Organization metadata container has not been discovered\",\n );\n const keyring = await loaded(container.id);\n if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n return keyring.current;\n },\n };\n}\n"]}
1	+ {"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAKtG,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,mEAAmE,CAAC;AAGnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAuB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CACjC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAC7C,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n type ContainerAccessManifestState,\n decryptGroupMetadata,\n type GroupMetadataKey,\n type ReferencedPrincipalHead,\n readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n getTargetContainerContext,\n readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/containerKek/containerKekPath\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../../data/persistence/container-contents/containerPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { GroupPolicyNameReader } from \"../principalPolicy/principalPolicyRequest\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\n\nexport interface GroupMetadataAccessInput {\n readonly apiClient: {\n evictContainerWriterProjection(containerId: string): void;\n getContainerWriterProjection(\n containerId: string,\n ): Promise<ContainerWriterProjectionResponse \| null>;\n };\n readonly verifyMetadataContainer: (\n state: ContainerAccessManifestState,\n organizationReference?: ReferencedPrincipalHead \| undefined,\n ) => Promise<void>;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly targetSecretKey: Uint8Array;\n readonly stillCurrent?: (() => boolean) \| undefined;\n readonly warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n}\n\n/*\n A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n /\nexport class GroupMetadataUnreadableError extends Error {\n constructor(groupId: string, cause: unknown) {\n super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n this.name = \"GroupMetadataUnreadableError\";\n }\n}\n\nfunction loadMetadataKeyring(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n return withMetadataRootReload(\n () => loadMetadataKeyringOnce(input, containerId),\n () => input.apiClient.evictContainerWriterProjection(containerId),\n );\n}\n\nasync function loadMetadataKeyringOnce(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n const projection =\n await input.apiClient.getContainerWriterProjection(containerId);\n if (!projection) return null;\n if (\n projection.containerId !== containerId \|\|\n projection.organizationId !== input.organizationId\n )\n throw new Error(\"Group metadata container is unavailable\");\n const target = getTargetContainerContext(projection);\n const state = readContainerState(target.manifest);\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n if (\n state.organizationId !== input.organizationId \|\|\n state.systemSlot !== slot \|\|\n state.parentContainerId !== null\n )\n throw new Error(\n \"Group metadata requires the signed organization metadata container\",\n );\n await input.verifyMetadataContainer(\n state,\n projection.policyEvidence.organization?.head,\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keys = await unwrapContainerKekPath({\n ...input,\n projection,\n secretKey: input.targetSecretKey,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata container key is unavailable\");\n return {\n current: {\n organizationId: input.organizationId,\n containerId,\n containerKeyEpochId: target.kek.containerKeyEpochId,\n keyMaterial,\n },\n keys,\n };\n}\n\n/* Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n const loads = new Map<\n string,\n Promise<{\n current: GroupMetadataKey;\n keys: ReadonlyMap<string, Uint8Array>;\n } \| null>\n >();\n function loaded(containerId: string) {\n let pending = loads.get(containerId);\n if (!pending) {\n pending = loadMetadataKeyring(input, containerId);\n loads.set(containerId, pending);\n }\n return pending;\n }\n const readName: GroupPolicyNameReader = async (bundle) => {\n assertProjectionVerificationCurrent(input.stillCurrent);\n const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n if (\"role\" in metadata)\n return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n if (\n metadata.organizationId !== input.organizationId \|\|\n metadata.groupId !== bundle.currentState.principalId \|\|\n bundle.currentState.principalType !== \"group\"\n )\n throw new Error(\"Group metadata scope does not match its signed group\");\n const keyring = await loaded(metadata.containerId);\n const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata historical key is unavailable\");\n try {\n return await decryptGroupMetadata({\n key: { ...metadata, keyMaterial },\n groupId: bundle.currentState.principalId,\n payload: bundle.currentPayload.ciphertext,\n });\n } catch (cause) {\n throw new GroupMetadataUnreadableError(\n bundle.currentState.principalId,\n cause,\n );\n }\n };\n return {\n readName,\n async loadEncryptionKey(): Promise<GroupMetadataKey> {\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n const containers = await loadContainers(input.execSql);\n const container = containers.find(\n (row) =>\n row.organizationId === input.organizationId &&\n row.systemSlot === slot,\n );\n if (!container)\n throw new Error(\n \"Organization metadata container has not been discovered\",\n );\n const keyring = await loaded(container.id);\n if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n return keyring.current;\n },\n };\n}\n"]}

package/workflows/organizations/readModel/localReadModelDetails.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { loadContainerDisplayNamesByIds } from "../../../data/persistence/containers/containerPersistence.js";
+import { loadContainerDisplayNamesByIds } from "../../../data/persistence/container-contents/containerPersistence.js";
 import { loadOrganizationGroupDisplayNames } from "../../../data/persistence/organizations/organizationGroupNamePersistence.js";
 import { loadOrganizationReadModelProjection } from "../../../data/persistence/organizations/organizationReadModelPersistence.js";
 import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicy/principalPolicyPersistence.js";

package/workflows/organizations/readModel/localReadModelDetails.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,EAAE,iCAAiC,EAAE,MAAM,0EAA0E,CAAC;AAC7H,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAC;AACjH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAErG,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAUxF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n OrganizationContainerGrantResponse,\n PrincipalPolicyBundleResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../../data/persistence/containers/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n buildOrganizationGroupPolicyHistory,\n buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\nimport type {\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupPolicyHistory,\n OrganizationPolicyHistory,\n OrganizationUserDetail,\n} from \"./index\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\n\ninterface LocalReadModelInput {\n readonly currentUserId: string;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n execSql: ExecSql,\n grants: readonly OrganizationContainerGrantResponse[],\n organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n const containerIds = uniqueContainerIds(grants);\n const groupNames = await loadOrganizationGroupDisplayNames(\n execSql,\n organizationId,\n );\n const groupRoles = await loadVerifiedOrganizationGroupRoles(\n execSql,\n organizationId,\n );\n const displayNames = new Map<string, string>();\n for (\n let index = 0;\n index < containerIds.length;\n index += DISPLAY_NAME_BATCH_SIZE\n ) {\n const batch = await loadContainerDisplayNamesByIds(\n execSql,\n containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n );\n for (const [containerId, displayName] of batch) {\n displayNames.set(containerId, displayName);\n }\n }\n return grants.map((grant) => ({\n ...grant,\n containerDisplayName: displayNames.get(grant.containerId) ?? null,\n groupName:\n grant.subjectType === \"group\"\n ? (groupRoles.get(grant.subjectId) ??\n groupNames.get(grant.subjectId) ??\n null)\n : null,\n }));\n}\n\nfunction toGroupContainer(\n grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n return {\n accessLevel: grant.accessLevel,\n containerId: grant.containerId,\n containerDisplayName: grant.containerDisplayName,\n createdAt: grant.createdAt,\n depth: grant.depth,\n isBuiltin: grant.isBuiltin,\n metadataAccessEpoch: grant.metadataAccessEpoch,\n metadataAccessStateHash: grant.metadataAccessStateHash,\n metadataDocumentId: grant.metadataDocumentId,\n parentId: grant.parentId,\n updatedAt: grant.updatedAt,\n };\n}\n\n/*\n The groups a user belongs to is exactly the set naming them as a member.\n \n This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n readonly edges: ReadonlyArray<{\n readonly groupId: string;\n readonly userId: string;\n }>;\n readonly userId: string;\n}): Set<string> {\n return new Set(\n input.edges\n .filter((edge) => edge.userId === input.userId)\n .map((edge) => edge.groupId),\n );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n return {\n organizationId: input.organizationId,\n grants: await enrichGrants(\n input.execSql,\n projection.grants.grants,\n input.organizationId,\n ),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const groupIsInOrganization =\n input.groupId === projection.groups.memberGroupId \|\|\n projection.groups.groups.some(\n (group) => group.groupId === input.groupId,\n );\n if (!groupIsInOrganization) {\n return null;\n }\n const grants = projection.grants.grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n );\n return {\n organizationId: input.organizationId,\n groupId: input.groupId,\n containers: (\n await enrichGrants(input.execSql, grants, input.organizationId)\n ).map(toGroupContainer),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"group\" && head.principalId === input.groupId,\n );\n if (!projectedHead) {\n return null;\n }\n\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"group\",\n input.groupId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n : null;\n },\n );\n}\n\nfunction policyBundleMatchesProjectedHead(\n bundle: PrincipalPolicyBundleResponse \| null,\n projectedHead: {\n readonly keyEpoch: number;\n readonly keyFingerprint: string;\n readonly memberCount: number;\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n readonly stateHash: string;\n readonly version: number;\n },\n): bundle is PrincipalPolicyBundleResponse {\n const storedHead = bundle?.currentState;\n return Boolean(\n storedHead &&\n storedHead.principalType === projectedHead.principalType &&\n storedHead.principalId === projectedHead.principalId &&\n storedHead.stateHash === projectedHead.stateHash &&\n storedHead.version === projectedHead.version &&\n storedHead.keyEpoch === projectedHead.keyEpoch &&\n storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n storedHead.memberCount === projectedHead.memberCount,\n );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"organization\" &&\n head.principalId === input.organizationId,\n );\n if (!projectedHead) {\n return null;\n }\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"organization\",\n input.organizationId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationPolicyHistory(bundle)\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n input: LocalReadModelInput & {\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n },\n): Promise<ReferencedPrincipalStateResponse \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const head = projection.policyHeads.find(\n (candidate) =>\n candidate.principalType === input.principalType &&\n candidate.principalId === input.principalId,\n );\n return head\n ? {\n principalType: head.principalType,\n principalId: head.principalId,\n stateHash: head.stateHash,\n version: head.version,\n keyEpoch: head.keyEpoch,\n keyFingerprint: head.keyFingerprint,\n }\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n const user = projection?.directory.users.find(\n (candidate) => candidate.userId === input.userId,\n );\n if (!projection?.requester \|\| !user) {\n return null;\n }\n\n const reachable = reachableGroupIds({\n edges: projection.membershipEdges,\n userId: input.userId,\n });\n const groups = projection.groups.groups\n .filter((group) => reachable.has(group.groupId))\n .map((group) => ({ ...group, nameUnreadable: false }));\n const relevantGrants = projection.grants.grants.filter(\n (grant) =>\n (grant.subjectType === \"user\" && grant.subjectId === input.userId) \|\|\n (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n );\n const grants = await enrichGrants(\n input.execSql,\n relevantGrants,\n input.organizationId,\n );\n return {\n organizationId: input.organizationId,\n user,\n groups,\n grants: {\n directGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"user\" && grant.subjectId === input.userId,\n ),\n groupGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n ),\n },\n };\n },\n );\n}\n"]}
1	+ {"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,mEAAmE,CAAC;AACnH,OAAO,EAAE,iCAAiC,EAAE,MAAM,0EAA0E,CAAC;AAC7H,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAC;AACjH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAErG,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAUxF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n OrganizationContainerGrantResponse,\n PrincipalPolicyBundleResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../../data/persistence/container-contents/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n buildOrganizationGroupPolicyHistory,\n buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\nimport type {\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupPolicyHistory,\n OrganizationPolicyHistory,\n OrganizationUserDetail,\n} from \"./index\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\n\ninterface LocalReadModelInput {\n readonly currentUserId: string;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n execSql: ExecSql,\n grants: readonly OrganizationContainerGrantResponse[],\n organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n const containerIds = uniqueContainerIds(grants);\n const groupNames = await loadOrganizationGroupDisplayNames(\n execSql,\n organizationId,\n );\n const groupRoles = await loadVerifiedOrganizationGroupRoles(\n execSql,\n organizationId,\n );\n const displayNames = new Map<string, string>();\n for (\n let index = 0;\n index < containerIds.length;\n index += DISPLAY_NAME_BATCH_SIZE\n ) {\n const batch = await loadContainerDisplayNamesByIds(\n execSql,\n containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n );\n for (const [containerId, displayName] of batch) {\n displayNames.set(containerId, displayName);\n }\n }\n return grants.map((grant) => ({\n ...grant,\n containerDisplayName: displayNames.get(grant.containerId) ?? null,\n groupName:\n grant.subjectType === \"group\"\n ? (groupRoles.get(grant.subjectId) ??\n groupNames.get(grant.subjectId) ??\n null)\n : null,\n }));\n}\n\nfunction toGroupContainer(\n grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n return {\n accessLevel: grant.accessLevel,\n containerId: grant.containerId,\n containerDisplayName: grant.containerDisplayName,\n createdAt: grant.createdAt,\n depth: grant.depth,\n isBuiltin: grant.isBuiltin,\n metadataAccessEpoch: grant.metadataAccessEpoch,\n metadataAccessStateHash: grant.metadataAccessStateHash,\n metadataDocumentId: grant.metadataDocumentId,\n parentId: grant.parentId,\n updatedAt: grant.updatedAt,\n };\n}\n\n/*\n The groups a user belongs to is exactly the set naming them as a member.\n \n This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n readonly edges: ReadonlyArray<{\n readonly groupId: string;\n readonly userId: string;\n }>;\n readonly userId: string;\n}): Set<string> {\n return new Set(\n input.edges\n .filter((edge) => edge.userId === input.userId)\n .map((edge) => edge.groupId),\n );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n return {\n organizationId: input.organizationId,\n grants: await enrichGrants(\n input.execSql,\n projection.grants.grants,\n input.organizationId,\n ),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const groupIsInOrganization =\n input.groupId === projection.groups.memberGroupId \|\|\n projection.groups.groups.some(\n (group) => group.groupId === input.groupId,\n );\n if (!groupIsInOrganization) {\n return null;\n }\n const grants = projection.grants.grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n );\n return {\n organizationId: input.organizationId,\n groupId: input.groupId,\n containers: (\n await enrichGrants(input.execSql, grants, input.organizationId)\n ).map(toGroupContainer),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"group\" && head.principalId === input.groupId,\n );\n if (!projectedHead) {\n return null;\n }\n\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"group\",\n input.groupId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n : null;\n },\n );\n}\n\nfunction policyBundleMatchesProjectedHead(\n bundle: PrincipalPolicyBundleResponse \| null,\n projectedHead: {\n readonly keyEpoch: number;\n readonly keyFingerprint: string;\n readonly memberCount: number;\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n readonly stateHash: string;\n readonly version: number;\n },\n): bundle is PrincipalPolicyBundleResponse {\n const storedHead = bundle?.currentState;\n return Boolean(\n storedHead &&\n storedHead.principalType === projectedHead.principalType &&\n storedHead.principalId === projectedHead.principalId &&\n storedHead.stateHash === projectedHead.stateHash &&\n storedHead.version === projectedHead.version &&\n storedHead.keyEpoch === projectedHead.keyEpoch &&\n storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n storedHead.memberCount === projectedHead.memberCount,\n );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"organization\" &&\n head.principalId === input.organizationId,\n );\n if (!projectedHead) {\n return null;\n }\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"organization\",\n input.organizationId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationPolicyHistory(bundle)\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n input: LocalReadModelInput & {\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n },\n): Promise<ReferencedPrincipalStateResponse \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const head = projection.policyHeads.find(\n (candidate) =>\n candidate.principalType === input.principalType &&\n candidate.principalId === input.principalId,\n );\n return head\n ? {\n principalType: head.principalType,\n principalId: head.principalId,\n stateHash: head.stateHash,\n version: head.version,\n keyEpoch: head.keyEpoch,\n keyFingerprint: head.keyFingerprint,\n }\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail \| null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n const user = projection?.directory.users.find(\n (candidate) => candidate.userId === input.userId,\n );\n if (!projection?.requester \|\| !user) {\n return null;\n }\n\n const reachable = reachableGroupIds({\n edges: projection.membershipEdges,\n userId: input.userId,\n });\n const groups = projection.groups.groups\n .filter((group) => reachable.has(group.groupId))\n .map((group) => ({ ...group, nameUnreadable: false }));\n const relevantGrants = projection.grants.grants.filter(\n (grant) =>\n (grant.subjectType === \"user\" && grant.subjectId === input.userId) \|\|\n (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n );\n const grants = await enrichGrants(\n input.execSql,\n relevantGrants,\n input.organizationId,\n );\n return {\n organizationId: input.organizationId,\n user,\n groups,\n grants: {\n directGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"user\" && grant.subjectId === input.userId,\n ),\n groupGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n ),\n },\n };\n },\n );\n}\n"]}

package/workflows/registration/bootstrapRootContainer.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { ensureContainerTables, loadContainers, saveContainer, } from "../../data/persistence/containers/containerPersistence.js";
+import { ensureContainerTables, loadContainers, saveContainer, } from "../../data/persistence/container-contents/containerPersistence.js";
 import { createExecSql, runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
 async function bootstrapRootContainerFromExecSql(execSql) {
     return runSerializedSqlMutation(execSql, async (lockedExecSql) => {

package/workflows/registration/bootstrapRootContainer.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bootstrapRootContainer.js","sourceRoot":"","sources":["bootstrapRootContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,aAAa,GACd,MAAM,~~wDAAwD~~,CAAC;~~AAChE~~,OAAO,EACL,aAAa,EAGb,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAOrC,KAAK,UAAU,iCAAiC,CAC9C,OAAgB;IAEhB,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QAC/D,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAC1B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CACpE,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,aAAa,EAAE;YACjC,EAAE,EAAE,WAAW;YACf,oBAAoB,EAAE,OAAO;YAC7B,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,IAAI;YACd,kBAAkB,EAAE,IAAI;YACxB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,OAAO,iCAAiC,CACtC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3D,CAAC;AACJ,CAAC","sourcesContent":["import {\n ensureContainerTables,\n loadContainers,\n saveContainer,\n} from \"../../data/persistence/~~containers~~/containerPersistence\";\nimport {\n createExecSql,\n type ExecSql,\n type ExecSqlClientLike,\n runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\n\ninterface RootContainerBootstrapResult {\n containerId: string;\n created: boolean;\n}\n\nasync function bootstrapRootContainerFromExecSql(\n execSql: ExecSql,\n): Promise<RootContainerBootstrapResult> {\n return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n await ensureContainerTables(lockedExecSql);\n const containers = await loadContainers(lockedExecSql);\n const root = containers.find(\n (container) => container.parentId === null && !container.systemSlot,\n );\n\n if (root) {\n return {\n containerId: root.id,\n created: false,\n };\n }\n\n const containerId = crypto.randomUUID();\n await saveContainer(lockedExecSql, {\n id: containerId,\n effectiveAccessLevel: \"admin\",\n organizationId: \"\",\n parentId: null,\n metadataDocumentId: null,\n name: \"/\",\n icon: null,\n });\n\n return {\n containerId,\n created: true,\n };\n });\n}\n\nexport async function bootstrapRootContainer(\n input: ExecSql \| ExecSqlClientLike,\n): Promise<RootContainerBootstrapResult> {\n return bootstrapRootContainerFromExecSql(\n typeof input === \"function\" ? input : createExecSql(input),\n );\n}\n"]}
1	+ {"version":3,"file":"bootstrapRootContainer.js","sourceRoot":"","sources":["bootstrapRootContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,aAAa,GACd,MAAM,gEAAgE,CAAC;AACxE,OAAO,EACL,aAAa,EAGb,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAOrC,KAAK,UAAU,iCAAiC,CAC9C,OAAgB;IAEhB,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QAC/D,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAC1B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CACpE,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,aAAa,EAAE;YACjC,EAAE,EAAE,WAAW;YACf,oBAAoB,EAAE,OAAO;YAC7B,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,IAAI;YACd,kBAAkB,EAAE,IAAI;YACxB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,OAAO,iCAAiC,CACtC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3D,CAAC;AACJ,CAAC","sourcesContent":["import {\n ensureContainerTables,\n loadContainers,\n saveContainer,\n} from \"../../data/persistence/container-contents/containerPersistence\";\nimport {\n createExecSql,\n type ExecSql,\n type ExecSqlClientLike,\n runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\n\ninterface RootContainerBootstrapResult {\n containerId: string;\n created: boolean;\n}\n\nasync function bootstrapRootContainerFromExecSql(\n execSql: ExecSql,\n): Promise<RootContainerBootstrapResult> {\n return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n await ensureContainerTables(lockedExecSql);\n const containers = await loadContainers(lockedExecSql);\n const root = containers.find(\n (container) => container.parentId === null && !container.systemSlot,\n );\n\n if (root) {\n return {\n containerId: root.id,\n created: false,\n };\n }\n\n const containerId = crypto.randomUUID();\n await saveContainer(lockedExecSql, {\n id: containerId,\n effectiveAccessLevel: \"admin\",\n organizationId: \"\",\n parentId: null,\n metadataDocumentId: null,\n name: \"/\",\n icon: null,\n });\n\n return {\n containerId,\n created: true,\n };\n });\n}\n\nexport async function bootstrapRootContainer(\n input: ExecSql \| ExecSqlClientLike,\n): Promise<RootContainerBootstrapResult> {\n return bootstrapRootContainerFromExecSql(\n typeof input === \"function\" ? input : createExecSql(input),\n );\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { base64ToBytes } from "../../internal/encoding/index.js";
-import { createInitializedContainerMetadataDocument } from "../../data/containers/containerMetadataDocument.js";
 import { deriveStableDocumentId } from "../../data/documents/shared/stableDocumentId.js";
+import { createInitializedContainerMetadataDocument } from "../container-contents/metadata/containerMetadataDocument.js";
 import { deriveContainerSystemSlot, } from "../container-contents/systemSlot.js";
 import { buildContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../containers/child/create/index.js";
 import { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "../containers/root/create.js";

package/workflows/registration/provisioningBootstrapBuilders.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { createInitializedContainerMetadataDocument } from \"../../data/containers/containerMetadataDocument\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport {\n type ContainerSystemSlotDefinition,\n deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n buildContainerCreatePlan,\n childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n buildRootContainerCreatePlan,\n rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n InitialOrganizationMetadataBootstrap,\n InitialRootContainerCreatePlan,\n InitialRosterProfileBootstrap,\n InitialSystemContainerBootstrap,\n InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n buildProvisionedOrganizationProfile,\n buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/*\n An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n /\nexport interface ProvisionedSystemContainerSpec {\n readonly slotDefinition: ContainerSystemSlotDefinition;\n readonly name: string;\n readonly icon: string \| null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n containerId: string;\n initialAdminGroup: CreateOrganizationGroupRequest;\n initialMemberGroup: CreateOrganizationGroupRequest;\n organizationProfileName?: string \| undefined;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n encapsulationPublicKey: Uint8Array;\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n rosterProfileNickname?: string \| undefined;\n targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n containerId: string;\n containerMetadataDocument: Awaited<\n ReturnType<typeof buildMaterializedDocumentCreatePlan>\n >;\n containerMetadataInitialUpdate: Uint8Array;\n containerPlan: InitialSystemContainerCreatePlan;\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n containerRequest: {\n systemSlot: ContainerSystemSlot;\n container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n initialMetadataSync: Awaited<\n ReturnType<typeof buildInitialDocumentSyncRequest>\n >;\n metadataDocument: Awaited<\n ReturnType<typeof buildMaterializedDocumentCreatePlan>\n >[\"plan\"][\"request\"];\n };\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n systemSlot: ContainerSystemSlot;\n}\n\n/\n The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n /\nasync function buildProvisionedChildContainerCore(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n containerId?: string \| undefined;\n icon: string \| null;\n managedPrincipalGrant?: Parameters<\n typeof buildContainerCreatePlan\n >[0][\"managedPrincipalGrant\"];\n name: string;\n principalPolicies: Parameters<\n typeof buildContainerCreatePlan\n >[0][\"principalPolicies\"];\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n systemSlot: ContainerSystemSlot;\n targetSecretKey: Uint8Array;\n independentMetadataGroups?: {\n adminGroup: CreateOrganizationGroupRequest;\n memberGroup: CreateOrganizationGroupRequest;\n };\n}): Promise<ProvisionedChildContainerCore> {\n const containerId = input.containerId ?? crypto.randomUUID();\n const { initialUpdate } = await createInitializedContainerMetadataDocument(\n containerId,\n {\n icon: input.icon,\n name: input.name,\n },\n );\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const containerPlan: InitialSystemContainerCreatePlan = {\n containerKey,\n plan: input.independentMetadataGroups\n ? (\n await buildRootContainerCreatePlan({\n ...input.independentMetadataGroups,\n author: input.author,\n containerId,\n containerKey,\n metadataDocumentId: containerId,\n systemSlot: input.systemSlot,\n recipientEncapsulationPublicKey: base64ToBytes(\n input.independentMetadataGroups.adminGroup.initialGroupPolicy\n .state.encapsulationPublicKey,\n ),\n })\n ).plan\n : await buildContainerCreatePlan({\n author: input.author,\n containerId,\n containerKey,\n ...(input.managedPrincipalGrant\n ? { managedPrincipalGrant: input.managedPrincipalGrant }\n : {}),\n metadataDocumentId: containerId,\n systemSlot: input.systemSlot,\n parentProjection: input.rootContainerProjection,\n principalPolicies: input.principalPolicies,\n }),\n };\n const containerProjection = input.independentMetadataGroups\n ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n : childContainerWriterProjectionFromCreatePlan({\n materializedPlan: containerPlan,\n parentProjection: input.rootContainerProjection,\n });\n const knownContainerKeks = new Map([\n [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n ]);\n const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection,\n documentId: containerPlan.plan.metadataDocumentId,\n knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n const initialMetadataSync = await buildInitialDocumentSyncRequest({\n author: input.author,\n containerProjection,\n initialUpdate,\n materializedDocument: containerMetadataDocument,\n });\n return {\n containerId,\n containerMetadataDocument,\n containerMetadataInitialUpdate: initialUpdate,\n containerPlan,\n containerProjection,\n containerRequest: {\n systemSlot: input.systemSlot,\n container: containerPlan.plan.request,\n initialMetadataSync,\n metadataDocument: containerMetadataDocument.plan.request,\n },\n knownContainerKeks,\n systemSlot: input.systemSlot,\n };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n encapsulationPublicKey: Uint8Array;\n initialAdminGroup: CreateOrganizationGroupRequest;\n rosterProfileNickname?: string \| undefined;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n icon: null,\n name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n principalPolicies: [\n await verifiedPrincipalPolicyFromInitialGroupRequest(\n input.initialAdminGroup,\n ),\n ],\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n organizationId: input.author.organizationId,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n author: input.author,\n containerProjection: core.containerProjection,\n encapsulationPublicKey: input.encapsulationPublicKey,\n knownContainerKeks: core.knownContainerKeks,\n rosterProfileNickname: input.rosterProfileNickname,\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n profileDocument: rosterProfileDocument,\n profileDocumentInitialUpdate: profile.initialUpdate,\n profileDocumentRequest: profile.request,\n systemSlot: core.systemSlot,\n };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection: input.containerProjection,\n documentId: await deriveStableDocumentId(\n getRosterProfileDocumentLocalId({\n organizationId: input.author.organizationId,\n userId: input.author.signerUserId,\n }),\n ),\n knownContainerKeks: input.knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n const profile = await buildProvisionedRosterProfile({\n author: input.author,\n containerProjection: input.containerProjection,\n encapsulationPublicKey: input.encapsulationPublicKey,\n materializedDocument: rosterProfileDocument,\n nickname: input.rosterProfileNickname,\n });\n return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n initialAdminGroup: CreateOrganizationGroupRequest;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n signingPrivateKey: Uint8Array;\n spec: ProvisionedSystemContainerSpec;\n targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n icon: input.spec.icon,\n name: input.spec.name,\n principalPolicies: [\n await verifiedPrincipalPolicyFromInitialGroupRequest(\n input.initialAdminGroup,\n ),\n ],\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveContainerSystemSlot({\n definition: input.spec.slotDefinition,\n secretKey: input.signingPrivateKey,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n icon: input.spec.icon,\n name: input.spec.name,\n systemSlot: core.systemSlot,\n };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n return deriveStableDocumentId(\n getOrganizationProfileDocumentLocalId({ organizationId }),\n );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n organizationProfileName?: string \| undefined;\n targetSecretKey: Uint8Array;\n}) {\n const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n {\n author: input.author,\n containerProjection: input.containerProjection,\n documentId: await stableOrganizationProfileId(\n input.author.organizationId,\n ),\n knownContainerKeks: input.knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n },\n );\n const profile = await buildProvisionedOrganizationProfile({\n author: input.author,\n containerProjection: input.containerProjection,\n materializedDocument: organizationProfileDocument,\n name: input.organizationProfileName,\n });\n return { organizationProfileDocument, profile };\n}\n\n/\n Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n containerId: input.containerId,\n icon: null,\n independentMetadataGroups: {\n adminGroup: input.initialAdminGroup,\n memberGroup: input.initialMemberGroup,\n },\n name: ORGANIZATION_METADATA_CONTAINER_NAME,\n // Both reserved groups receive explicit grants on the independent root.\n principalPolicies: await Promise.all([\n verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n ]),\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.author.organizationId,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n const { organizationProfileDocument, profile } =\n await buildInitialOrganizationProfile({\n author: input.author,\n containerProjection: core.containerProjection,\n knownContainerKeks: core.knownContainerKeks,\n organizationProfileName: input.organizationProfileName,\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n organizationProfileDocument,\n organizationProfileDocumentRequest: profile.request,\n organizationProfileSnapshot: profile.snapshot,\n systemSlot: core.systemSlot,\n };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n adminGroup: CreateOrganizationGroupRequest;\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n recipientEncapsulationPublicKey: Uint8Array;\n rootContainerId: string;\n targetSecretKey: Uint8Array;\n}) {\n const rootContainer = await buildRootContainerCreatePlan({\n adminGroup: input.adminGroup,\n author: input.author,\n containerId: input.rootContainerId,\n metadataDocumentId: input.bootstrap.metadataDocumentId,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n });\n const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n rootContainer.plan,\n );\n const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection: rootContainerProjection,\n documentId: input.bootstrap.metadataDocumentId,\n knownContainerKeks: new Map([\n [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n ]),\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n return {\n rootContainer,\n rootContainerProjection,\n rootMetadataDocument,\n rootMetadataDocumentRequest: {\n ...rootMetadataDocument.plan.request,\n initialSync: await buildInitialDocumentSyncRequest({\n author: input.author,\n containerProjection: rootContainerProjection,\n initialUpdate: input.bootstrap.initialUpdate,\n materializedDocument: rootMetadataDocument,\n }),\n },\n };\n}\n"]}
1	+ {"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,0CAA0C,EAAE,MAAM,0DAA0D,CAAC;AACtH,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport { createInitializedContainerMetadataDocument } from \"../container-contents/metadata/containerMetadataDocument\";\nimport {\n type ContainerSystemSlotDefinition,\n deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n buildContainerCreatePlan,\n childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n buildRootContainerCreatePlan,\n rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n InitialOrganizationMetadataBootstrap,\n InitialRootContainerCreatePlan,\n InitialRosterProfileBootstrap,\n InitialSystemContainerBootstrap,\n InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n buildProvisionedOrganizationProfile,\n buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/*\n An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n /\nexport interface ProvisionedSystemContainerSpec {\n readonly slotDefinition: ContainerSystemSlotDefinition;\n readonly name: string;\n readonly icon: string \| null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n containerId: string;\n initialAdminGroup: CreateOrganizationGroupRequest;\n initialMemberGroup: CreateOrganizationGroupRequest;\n organizationProfileName?: string \| undefined;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n encapsulationPublicKey: Uint8Array;\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n rosterProfileNickname?: string \| undefined;\n targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n containerId: string;\n containerMetadataDocument: Awaited<\n ReturnType<typeof buildMaterializedDocumentCreatePlan>\n >;\n containerMetadataInitialUpdate: Uint8Array;\n containerPlan: InitialSystemContainerCreatePlan;\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n containerRequest: {\n systemSlot: ContainerSystemSlot;\n container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n initialMetadataSync: Awaited<\n ReturnType<typeof buildInitialDocumentSyncRequest>\n >;\n metadataDocument: Awaited<\n ReturnType<typeof buildMaterializedDocumentCreatePlan>\n >[\"plan\"][\"request\"];\n };\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n systemSlot: ContainerSystemSlot;\n}\n\n/\n The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n /\nasync function buildProvisionedChildContainerCore(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n containerId?: string \| undefined;\n icon: string \| null;\n managedPrincipalGrant?: Parameters<\n typeof buildContainerCreatePlan\n >[0][\"managedPrincipalGrant\"];\n name: string;\n principalPolicies: Parameters<\n typeof buildContainerCreatePlan\n >[0][\"principalPolicies\"];\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n systemSlot: ContainerSystemSlot;\n targetSecretKey: Uint8Array;\n independentMetadataGroups?: {\n adminGroup: CreateOrganizationGroupRequest;\n memberGroup: CreateOrganizationGroupRequest;\n };\n}): Promise<ProvisionedChildContainerCore> {\n const containerId = input.containerId ?? crypto.randomUUID();\n const { initialUpdate } = await createInitializedContainerMetadataDocument(\n containerId,\n {\n icon: input.icon,\n name: input.name,\n },\n );\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const containerPlan: InitialSystemContainerCreatePlan = {\n containerKey,\n plan: input.independentMetadataGroups\n ? (\n await buildRootContainerCreatePlan({\n ...input.independentMetadataGroups,\n author: input.author,\n containerId,\n containerKey,\n metadataDocumentId: containerId,\n systemSlot: input.systemSlot,\n recipientEncapsulationPublicKey: base64ToBytes(\n input.independentMetadataGroups.adminGroup.initialGroupPolicy\n .state.encapsulationPublicKey,\n ),\n })\n ).plan\n : await buildContainerCreatePlan({\n author: input.author,\n containerId,\n containerKey,\n ...(input.managedPrincipalGrant\n ? { managedPrincipalGrant: input.managedPrincipalGrant }\n : {}),\n metadataDocumentId: containerId,\n systemSlot: input.systemSlot,\n parentProjection: input.rootContainerProjection,\n principalPolicies: input.principalPolicies,\n }),\n };\n const containerProjection = input.independentMetadataGroups\n ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n : childContainerWriterProjectionFromCreatePlan({\n materializedPlan: containerPlan,\n parentProjection: input.rootContainerProjection,\n });\n const knownContainerKeks = new Map([\n [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n ]);\n const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection,\n documentId: containerPlan.plan.metadataDocumentId,\n knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n const initialMetadataSync = await buildInitialDocumentSyncRequest({\n author: input.author,\n containerProjection,\n initialUpdate,\n materializedDocument: containerMetadataDocument,\n });\n return {\n containerId,\n containerMetadataDocument,\n containerMetadataInitialUpdate: initialUpdate,\n containerPlan,\n containerProjection,\n containerRequest: {\n systemSlot: input.systemSlot,\n container: containerPlan.plan.request,\n initialMetadataSync,\n metadataDocument: containerMetadataDocument.plan.request,\n },\n knownContainerKeks,\n systemSlot: input.systemSlot,\n };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n encapsulationPublicKey: Uint8Array;\n initialAdminGroup: CreateOrganizationGroupRequest;\n rosterProfileNickname?: string \| undefined;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n icon: null,\n name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n principalPolicies: [\n await verifiedPrincipalPolicyFromInitialGroupRequest(\n input.initialAdminGroup,\n ),\n ],\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n organizationId: input.author.organizationId,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n author: input.author,\n containerProjection: core.containerProjection,\n encapsulationPublicKey: input.encapsulationPublicKey,\n knownContainerKeks: core.knownContainerKeks,\n rosterProfileNickname: input.rosterProfileNickname,\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n profileDocument: rosterProfileDocument,\n profileDocumentInitialUpdate: profile.initialUpdate,\n profileDocumentRequest: profile.request,\n systemSlot: core.systemSlot,\n };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection: input.containerProjection,\n documentId: await deriveStableDocumentId(\n getRosterProfileDocumentLocalId({\n organizationId: input.author.organizationId,\n userId: input.author.signerUserId,\n }),\n ),\n knownContainerKeks: input.knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n const profile = await buildProvisionedRosterProfile({\n author: input.author,\n containerProjection: input.containerProjection,\n encapsulationPublicKey: input.encapsulationPublicKey,\n materializedDocument: rosterProfileDocument,\n nickname: input.rosterProfileNickname,\n });\n return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n initialAdminGroup: CreateOrganizationGroupRequest;\n rootContainer: InitialRootContainerCreatePlan;\n rootContainerProjection: InitialRootContainerProjection;\n signingPrivateKey: Uint8Array;\n spec: ProvisionedSystemContainerSpec;\n targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n icon: input.spec.icon,\n name: input.spec.name,\n principalPolicies: [\n await verifiedPrincipalPolicyFromInitialGroupRequest(\n input.initialAdminGroup,\n ),\n ],\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveContainerSystemSlot({\n definition: input.spec.slotDefinition,\n secretKey: input.signingPrivateKey,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n icon: input.spec.icon,\n name: input.spec.name,\n systemSlot: core.systemSlot,\n };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n return deriveStableDocumentId(\n getOrganizationProfileDocumentLocalId({ organizationId }),\n );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n containerProjection: ReturnType<\n typeof childContainerWriterProjectionFromCreatePlan\n >;\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n organizationProfileName?: string \| undefined;\n targetSecretKey: Uint8Array;\n}) {\n const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n {\n author: input.author,\n containerProjection: input.containerProjection,\n documentId: await stableOrganizationProfileId(\n input.author.organizationId,\n ),\n knownContainerKeks: input.knownContainerKeks,\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n },\n );\n const profile = await buildProvisionedOrganizationProfile({\n author: input.author,\n containerProjection: input.containerProjection,\n materializedDocument: organizationProfileDocument,\n name: input.organizationProfileName,\n });\n return { organizationProfileDocument, profile };\n}\n\n/\n Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n const core = await buildProvisionedChildContainerCore({\n author: input.author,\n containerId: input.containerId,\n icon: null,\n independentMetadataGroups: {\n adminGroup: input.initialAdminGroup,\n memberGroup: input.initialMemberGroup,\n },\n name: ORGANIZATION_METADATA_CONTAINER_NAME,\n // Both reserved groups receive explicit grants on the independent root.\n principalPolicies: await Promise.all([\n verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n ]),\n rootContainer: input.rootContainer,\n rootContainerProjection: input.rootContainerProjection,\n systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.author.organizationId,\n }),\n targetSecretKey: input.targetSecretKey,\n });\n const { organizationProfileDocument, profile } =\n await buildInitialOrganizationProfile({\n author: input.author,\n containerProjection: core.containerProjection,\n knownContainerKeks: core.knownContainerKeks,\n organizationProfileName: input.organizationProfileName,\n targetSecretKey: input.targetSecretKey,\n });\n return {\n containerId: core.containerId,\n containerMetadataDocument: core.containerMetadataDocument,\n containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n containerPlan: core.containerPlan,\n containerRequest: core.containerRequest,\n organizationProfileDocument,\n organizationProfileDocumentRequest: profile.request,\n organizationProfileSnapshot: profile.snapshot,\n systemSlot: core.systemSlot,\n };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n adminGroup: CreateOrganizationGroupRequest;\n author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n recipientEncapsulationPublicKey: Uint8Array;\n rootContainerId: string;\n targetSecretKey: Uint8Array;\n}) {\n const rootContainer = await buildRootContainerCreatePlan({\n adminGroup: input.adminGroup,\n author: input.author,\n containerId: input.rootContainerId,\n metadataDocumentId: input.bootstrap.metadataDocumentId,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n });\n const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n rootContainer.plan,\n );\n const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n author: input.author,\n containerProjection: rootContainerProjection,\n documentId: input.bootstrap.metadataDocumentId,\n knownContainerKeks: new Map([\n [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n ]),\n targetSecretKey: input.targetSecretKey,\n trustedLocalProjection: true,\n });\n return {\n rootContainer,\n rootContainerProjection,\n rootMetadataDocument,\n rootMetadataDocumentRequest: {\n ...rootMetadataDocument.plan.request,\n initialSync: await buildInitialDocumentSyncRequest({\n author: input.author,\n containerProjection: rootContainerProjection,\n initialUpdate: input.bootstrap.initialUpdate,\n materializedDocument: rootMetadataDocument,\n }),\n },\n };\n}\n"]}

package/workflows/registration/rootMetadataBootstrap.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { createInitializedContainerMetadataDocument } from "../../data/containers/containerMetadataDocument.js";
+import { createInitializedContainerMetadataDocument } from "../container-contents/metadata/containerMetadataDocument.js";
 export async function createInitialRootMetadataBootstrap(containerId) {
     const metadataDocumentId = crypto.randomUUID();
     const { initialUpdate } = await createInitializedContainerMetadataDocument(containerId, {

package/workflows/registration/rootMetadataBootstrap.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rootMetadataBootstrap.js","sourceRoot":"","sources":["rootMetadataBootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,~~iDAAiD~~,CAAC;~~AAO7G~~,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,WAAmB;IAEnB,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,GAAG;KACV,CACF,CAAC;IAEF,OAAO;QACL,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import { createInitializedContainerMetadataDocument } from \"~~../../data~~/~~containers~~/containerMetadataDocument\";\n\nexport interface InitialRootMetadataBootstrap {\n initialUpdate: Uint8Array;\n metadataDocumentId: string;\n}\n\nexport async function createInitialRootMetadataBootstrap(\n containerId: string,\n): Promise<InitialRootMetadataBootstrap> {\n const metadataDocumentId = crypto.randomUUID();\n const { initialUpdate } = await createInitializedContainerMetadataDocument(\n containerId,\n {\n icon: null,\n name: \"/\",\n },\n );\n\n return {\n initialUpdate,\n metadataDocumentId,\n };\n}\n"]}
1	+ {"version":3,"file":"rootMetadataBootstrap.js","sourceRoot":"","sources":["rootMetadataBootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,0DAA0D,CAAC;AAOtH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,WAAmB;IAEnB,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,GAAG;KACV,CACF,CAAC;IAEF,OAAO;QACL,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import { createInitializedContainerMetadataDocument } from \"../container-contents/metadata/containerMetadataDocument\";\n\nexport interface InitialRootMetadataBootstrap {\n initialUpdate: Uint8Array;\n metadataDocumentId: string;\n}\n\nexport async function createInitialRootMetadataBootstrap(\n containerId: string,\n): Promise<InitialRootMetadataBootstrap> {\n const metadataDocumentId = crypto.randomUUID();\n const { initialUpdate } = await createInitializedContainerMetadataDocument(\n containerId,\n {\n icon: null,\n name: \"/\",\n },\n );\n\n return {\n initialUpdate,\n metadataDocumentId,\n };\n}\n"]}

package/workflows/sync/remoteReset.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { and, eq, inArray, or } from "drizzle-orm";
+import { deleteDocumentPlacementRowsByContainerIds, deleteDocumentPlacementRowsByDocumentIds, } from "../../data/persistence/container-contents/documentContainerProjectionPersistence.js";
 import { recordSupersededContainerBindingsInTransaction } from "../../data/persistence/container-contents/supersededContainerBindings.js";
-import { deleteDocumentPlacementRowsByContainerIds, deleteDocumentPlacementRowsByDocumentIds, } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
 import { clearDocumentDiscoveryEvidenceOnRemoteReset } from "../../data/persistence/documents/documentDiscoveryReset.js";
 import { queuedUpdateRow, unqueueDocumentScopesInTransaction, } from "../../data/sqlite/documentPersistence/documentPendingUpdatePersistence.js";
 import { CLEARED_DOCUMENT_SYNC_FAILURE } from "../../data/sqlite/documentPersistence/documentSyncFailurePersistence.js";