@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/container-contents/container-state/share.js

@@ -0,0 +1,305 @@
+import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification.js";
+import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "../../containers/index.js";
+import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { projectionGeneration } from "../projectionGeneration.js";
+import { loadContainerWriterProjectionForState } from "./projectionCache.js";
+import { shareRemoteContainer, shareRemoteContainerWithGroup } from "./remote.js";
+import { persistDuplicateContainerShare, persistSharedContainerState, } from "./sharePersistence.js";
+function readOptionalProjectionString(projection, key) {
+    const value = Reflect.get(projection, key);
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+async function resolveCurrentGroupKeyEpoch(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const verified = await loadVerifiedGroupSharePrincipalPolicy({
+        apiClient: input.runtime.apiClient,
+        execSql: input.runtime.infra.execSql,
+        expectedGroupName: input.expectedGroupName,
+        readEncryptedName: (bundle) => createRuntimeGroupMetadataAccess(input.runtime, input.organizationId, input.stillCurrent).readName(bundle),
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Commit the verification immediately: this read stands alone (no enclosing
+    // mutation advances it later), and an unadvanced checkpoint would let a
+    // newer same-epoch policy be rolled back on the next fetch.
+    await advanceVerifiedSharePolicies(input.runtime.infra.execSql, verified, input.stillCurrent);
+    return input.stillCurrent?.() === false ? null : verified.policy.keyEpoch;
+}
+// A container's KEK is wrapped to a group's encapsulation key at a specific key
+// epoch, pinned into the manifest as a referenced principal head. When the group
+// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM
+// keypair), that wrap goes stale: members holding only the new epoch secret can
+// no longer unwrap it. A re-share to the same group at the same access level is
+// therefore NOT redundant when the pinned epoch trails the group's current head,
+// so it must not be deduped away. The current epoch comes from a network-fresh,
+// fully verified policy bundle guarded by any durable local checkpoint.
+function groupGrantIsStale(input) {
+    const pinnedHead = (input.referencedPrincipalHeads ?? []).find((head) => head.principalType === "group" && head.principalId === input.subjectId);
+    if (!pinnedHead) {
+        return true;
+    }
+    return pinnedHead.keyEpoch !== input.currentKeyEpoch;
+}
+async function loadRemoteContainerShareContext(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection || input.stillCurrent?.() === false) {
+        return null;
+    }
+    const target = getTargetContainerContext(projection);
+    const remoteState = readContainerState(target.manifest);
+    const hasMatchingGrant = remoteState.directGrants.some((grant) => grant.subjectType === input.subjectType &&
+        grant.subjectId === input.subjectId &&
+        grant.accessLevel === input.accessLevel);
+    if (!hasMatchingGrant) {
+        if (input.requireExistingGrant) {
+            // Re-wrap-only callers must never mint a brand-new grant: the container's
+            // system slot is server-supplied and could point at a container that does
+            // not already grant this subject, so minting here would leak its contents.
+            input.runtime.util.log(`Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`);
+            return null;
+        }
+        return { matchingGrant: null, projection };
+    }
+    if (input.subjectType === "group" &&
+        input.requireExistingGrant &&
+        input.forceExistingGrantRewrap) {
+        // The cheap epoch probe below reads an unverified response and cannot prove
+        // that a security-critical re-wrap is current. Force the verified policy
+        // load and a real same-level mutation; failures must reach the retry owner.
+        input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`);
+        return { matchingGrant: null, projection };
+    }
+    if (input.subjectType === "group") {
+        const pinnedHead = remoteState.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === input.subjectId);
+        const currentKeyEpoch = pinnedHead
+            ? await resolveCurrentGroupKeyEpoch({
+                expectedGroupName: input.expectedGroupName,
+                groupId: input.subjectId,
+                organizationId: remoteState.organizationId,
+                runtime: input.runtime,
+                stillCurrent: input.stillCurrent,
+            })
+            : null;
+        if (input.stillCurrent?.() === false)
+            return null;
+        if (!pinnedHead ||
+            (currentKeyEpoch !== null &&
+                groupGrantIsStale({
+                    currentKeyEpoch,
+                    referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
+                    subjectId: input.subjectId,
+                }))) {
+            input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`);
+            return { matchingGrant: null, projection };
+        }
+    }
+    return {
+        matchingGrant: {
+            accessEpoch: remoteState.epoch,
+            accessStateHash: target.manifest.manifestHash,
+            createdAt: readOptionalProjectionString(projection, "createdAt"),
+            metadataDocumentId: remoteState.metadataDocumentId,
+            referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
+            updatedAt: readOptionalProjectionString(projection, "updatedAt"),
+        },
+        projection,
+    };
+}
+async function prepareContainerStateGroupRewrapInternal(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (input.requireExistingGrant) {
+        await verifyContainerWriterProjection({
+            execSql: input.runtime.infra.execSql,
+            projection,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+        });
+        if (input.stillCurrent?.() === false)
+            return null;
+        const verifiedState = readContainerState(getTargetContainerContext(projection).manifest);
+        if (projection.containerId !== input.containerState.container.id ||
+            projection.organizationId !==
+                input.containerState.container.organizationId ||
+            verifiedState.containerId !== input.containerState.container.id ||
+            verifiedState.organizationId !==
+                input.containerState.container.organizationId ||
+            verifiedState.parentContainerId !==
+                input.containerState.container.parentId) {
+            throw new Error("Prepared container group re-wrap target is inconsistent");
+        }
+        const hasGrant = verifiedState.directGrants.some((grant) => grant.subjectType === "group" &&
+            grant.subjectId === input.groupId &&
+            grant.accessLevel === input.accessLevel);
+        if (!hasGrant) {
+            return { status: "not-granted" };
+        }
+    }
+    const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;
+    if (!targetSecretKey) {
+        return null;
+    }
+    const target = getTargetContainerContext(projection);
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.runtime.infra.execSql,
+        projection,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        secretKey: targetSecretKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);
+    return targetKek
+        ? {
+            knownContainerKeks: new Map([
+                [target.kek.containerKeyEpochId, targetKek],
+            ]),
+            status: "prepared",
+        }
+        : null;
+}
+export function prepareContainerStateGroupRewrap(input) {
+    return nullOnProjectionVerificationCancellation(() => prepareContainerStateGroupRewrapInternal(input));
+}
+export async function shareContainerState(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Before the projection load and the share request: a hint that lands during
+    // either must keep the resulting projection out of the cache.
+    const writerProjectionGeneration = projectionGeneration(input.containerState);
+    const shareContext = await loadRemoteContainerShareContext({
+        accessLevel: input.accessLevel,
+        containerState: input.containerState,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        subjectId: input.recipientUserId,
+        subjectType: "user",
+    });
+    if (!shareContext || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (shareContext.matchingGrant) {
+        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`);
+        return persistDuplicateContainerShare({
+            containerState: input.containerState,
+            grant: shareContext.matchingGrant,
+            persistence: input.persistence,
+            projection: shareContext.projection,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+            writerProjectionGeneration,
+        });
+    }
+    const shared = await shareRemoteContainer({
+        accessLevel: input.accessLevel,
+        containerId: input.containerState.container.id,
+        previousProjection: shareContext.projection,
+        recipientUserId: input.recipientUserId,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!shared)
+        return null;
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    return persistSharedContainerState({
+        containerState: input.containerState,
+        persistence: input.persistence,
+        runtime: input.runtime,
+        shared,
+        stillCurrent: input.stillCurrent,
+        writerProjectionGeneration,
+    });
+}
+export async function shareContainerStateWithGroup(input) {
+    // A share chosen by name must carry that name so it can be bound to the
+    // signed group policy. Only the grant-preserving re-wrap, which never mints
+    // a grant, may run without one. Enforced here, in the workflow facade, so
+    // every caller (not only the store) meets the invariant.
+    if (!input.requireExistingGrant && input.expectedGroupName === undefined) {
+        throw new Error("Container group share requires the chosen group name");
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Before the projection load and the share request: a hint that lands during
+    // either must keep the resulting projection out of the cache.
+    const writerProjectionGeneration = projectionGeneration(input.containerState);
+    const shareContext = await loadRemoteContainerShareContext({
+        accessLevel: input.accessLevel,
+        containerState: input.containerState,
+        expectedGroupName: input.expectedGroupName,
+        forceExistingGrantRewrap: input.requireExistingGrant && input.knownContainerKeks !== undefined,
+        requireExistingGrant: input.requireExistingGrant,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        subjectId: input.recipientGroupId,
+        subjectType: "group",
+    });
+    if (!shareContext || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (shareContext.matchingGrant) {
+        // A duplicate share mints nothing, but it must not report success for a
+        // group the user did not choose. A matching grant is only found after the
+        // key-epoch probe verified the group's policy with the chosen name bound,
+        // so the name is already checked here.
+        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`);
+        return persistDuplicateContainerShare({
+            containerState: input.containerState,
+            grant: shareContext.matchingGrant,
+            persistence: input.persistence,
+            projection: shareContext.projection,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+            writerProjectionGeneration,
+        });
+    }
+    const shared = await shareRemoteContainerWithGroup({
+        accessLevel: input.accessLevel,
+        containerId: input.containerState.container.id,
+        expectedGroupName: input.expectedGroupName,
+        knownContainerKeks: input.knownContainerKeks,
+        previousProjection: shareContext.projection,
+        recipientGroupId: input.recipientGroupId,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!shared)
+        return null;
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    return persistSharedContainerState({
+        containerState: input.containerState,
+        persistence: input.persistence,
+        runtime: input.runtime,
+        shared,
+        stillCurrent: input.stillCurrent,
+        writerProjectionGeneration,
+    });
+}
+//# sourceMappingURL=share.js.map

package/workflows/container-contents/container-state/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["share.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAEL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAc5B,SAAS,4BAA4B,CACnC,UAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAAC;QAC3D,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,4EAA4E;IAC5E,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,QAAQ,EACR,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,SAAS,iBAAiB,CAAC,KAI1B;IACC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,+CAA+C,KAAK,CAAC,WAAW,cAAc,KAAK,CAAC,SAAS,iBAAiB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kDAAkD,CAClM,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IACE,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,wBAAwB,EAC9B,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,gDAAgD,CAC5J,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAC1D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;QACF,MAAM,eAAe,GAAG,UAAU;YAChC,CAAC,CAAC,MAAM,2BAA2B,CAAC;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,CAAC,UAAU;YACX,CAAC,eAAe,KAAK,IAAI;gBACvB,iBAAiB,CAAC;oBAChB,eAAe;oBACf,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;oBAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC,EACL,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,uDAAuD,CACnK,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE;YACb,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC7C,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;YAChE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;YAClD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;SACjE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAQvD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,aAAa,GAAG,kBAAkB,CACtC,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;QACF,IACE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC5D,UAAU,CAAC,cAAc;gBACvB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC/D,aAAa,CAAC,cAAc;gBAC1B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,iBAAiB;gBAC7B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,UAAU;QACV,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,SAAS,EAAE,eAAe;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,SAAS;QACd,CAAC,CAAC;YACE,kBAAkB,EAAE,IAAI,GAAG,CAAC;gBAC1B,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC;aAC5C,CAAC;YACF,MAAM,EAAE,UAAU;SACnB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAqE;IAErE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,wCAAwC,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,cAAc,KAAK,CAAC,eAAe,EAAE,CACpI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAelD;IACC,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,wBAAwB,EACtB,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,gBAAgB;QACjC,WAAW,EAAE,OAAO;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uCAAuC;QACvC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,gBAAgB,EAAE,CACtI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n  advanceVerifiedSharePolicies,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"../../containers\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport { projectionGeneration } from \"../projectionGeneration\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"./projectionCache\";\nimport { shareRemoteContainer, shareRemoteContainerWithGroup } from \"./remote\";\nimport {\n  type MatchingRemoteContainerGrant,\n  persistDuplicateContainerShare,\n  persistSharedContainerState,\n} from \"./sharePersistence\";\nimport type {\n  ContainerWorkflowRuntime,\n  SharedContainerStateResult,\n} from \"./types\";\n\ntype ContainerShareSubjectType = \"group\" | \"user\";\ntype ContainerShareAccessLevel = \"read\" | \"write\" | \"admin\";\n\ninterface RemoteContainerShareContext {\n  matchingGrant: MatchingRemoteContainerGrant | null;\n  projection: ContainerWriterProjectionResponse;\n}\n\nfunction readOptionalProjectionString(\n  projection: ContainerWriterProjectionResponse,\n  key: string,\n): string | null {\n  const value = Reflect.get(projection, key);\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nasync function resolveCurrentGroupKeyEpoch(input: {\n  // Bound here, in the one verified load a duplicate share performs, so a\n  // duplicate never reports success for a group the user did not choose.\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<number | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const verified = await loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.runtime.apiClient,\n    execSql: input.runtime.infra.execSql,\n    expectedGroupName: input.expectedGroupName,\n    readEncryptedName: (bundle) =>\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        input.stillCurrent,\n      ).readName(bundle),\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  // Commit the verification immediately: this read stands alone (no enclosing\n  // mutation advances it later), and an unadvanced checkpoint would let a\n  // newer same-epoch policy be rolled back on the next fetch.\n  await advanceVerifiedSharePolicies(\n    input.runtime.infra.execSql,\n    verified,\n    input.stillCurrent,\n  );\n  return input.stillCurrent?.() === false ? null : verified.policy.keyEpoch;\n}\n\n// A container's KEK is wrapped to a group's encapsulation key at a specific key\n// epoch, pinned into the manifest as a referenced principal head. When the group\n// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM\n// keypair), that wrap goes stale: members holding only the new epoch secret can\n// no longer unwrap it. A re-share to the same group at the same access level is\n// therefore NOT redundant when the pinned epoch trails the group's current head,\n// so it must not be deduped away. The current epoch comes from a network-fresh,\n// fully verified policy bundle guarded by any durable local checkpoint.\nfunction groupGrantIsStale(input: {\n  currentKeyEpoch: number;\n  referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n  subjectId: string;\n}): boolean {\n  const pinnedHead = (input.referencedPrincipalHeads ?? []).find(\n    (head) =>\n      head.principalType === \"group\" && head.principalId === input.subjectId,\n  );\n  if (!pinnedHead) {\n    return true;\n  }\n  return pinnedHead.keyEpoch !== input.currentKeyEpoch;\n}\n\nasync function loadRemoteContainerShareContext(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  forceExistingGrantRewrap?: boolean | undefined;\n  requireExistingGrant?: boolean | undefined;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n  subjectId: string;\n  subjectType: ContainerShareSubjectType;\n}): Promise<RemoteContainerShareContext | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const remoteState = readContainerState(target.manifest);\n  const hasMatchingGrant = remoteState.directGrants.some(\n    (grant) =>\n      grant.subjectType === input.subjectType &&\n      grant.subjectId === input.subjectId &&\n      grant.accessLevel === input.accessLevel,\n  );\n  if (!hasMatchingGrant) {\n    if (input.requireExistingGrant) {\n      // Re-wrap-only callers must never mint a brand-new grant: the container's\n      // system slot is server-supplied and could point at a container that does\n      // not already grant this subject, so minting here would leak its contents.\n      input.runtime.util.log(\n        `Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`,\n      );\n      return null;\n    }\n    return { matchingGrant: null, projection };\n  }\n\n  if (\n    input.subjectType === \"group\" &&\n    input.requireExistingGrant &&\n    input.forceExistingGrantRewrap\n  ) {\n    // The cheap epoch probe below reads an unverified response and cannot prove\n    // that a security-critical re-wrap is current. Force the verified policy\n    // load and a real same-level mutation; failures must reach the retry owner.\n    input.runtime.util.log(\n      `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`,\n    );\n    return { matchingGrant: null, projection };\n  }\n\n  if (input.subjectType === \"group\") {\n    const pinnedHead = remoteState.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.subjectId,\n    );\n    const currentKeyEpoch = pinnedHead\n      ? await resolveCurrentGroupKeyEpoch({\n          expectedGroupName: input.expectedGroupName,\n          groupId: input.subjectId,\n          organizationId: remoteState.organizationId,\n          runtime: input.runtime,\n          stillCurrent: input.stillCurrent,\n        })\n      : null;\n    if (input.stillCurrent?.() === false) return null;\n    if (\n      !pinnedHead ||\n      (currentKeyEpoch !== null &&\n        groupGrantIsStale({\n          currentKeyEpoch,\n          referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n          subjectId: input.subjectId,\n        }))\n    ) {\n      input.runtime.util.log(\n        `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`,\n      );\n      return { matchingGrant: null, projection };\n    }\n  }\n\n  return {\n    matchingGrant: {\n      accessEpoch: remoteState.epoch,\n      accessStateHash: target.manifest.manifestHash,\n      createdAt: readOptionalProjectionString(projection, \"createdAt\"),\n      metadataDocumentId: remoteState.metadataDocumentId,\n      referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n      updatedAt: readOptionalProjectionString(projection, \"updatedAt\"),\n    },\n    projection,\n  };\n}\n\nasync function prepareContainerStateGroupRewrapInternal(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  groupId: string;\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | { status: \"not-granted\" }\n  | {\n      knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n      status: \"prepared\";\n    }\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  if (input.requireExistingGrant) {\n    await verifyContainerWriterProjection({\n      execSql: input.runtime.infra.execSql,\n      projection,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n        input.runtime,\n      ),\n    });\n    if (input.stillCurrent?.() === false) return null;\n    const verifiedState = readContainerState(\n      getTargetContainerContext(projection).manifest,\n    );\n    if (\n      projection.containerId !== input.containerState.container.id ||\n      projection.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.containerId !== input.containerState.container.id ||\n      verifiedState.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.parentContainerId !==\n        input.containerState.container.parentId\n    ) {\n      throw new Error(\n        \"Prepared container group re-wrap target is inconsistent\",\n      );\n    }\n    const hasGrant = verifiedState.directGrants.some(\n      (grant) =>\n        grant.subjectType === \"group\" &&\n        grant.subjectId === input.groupId &&\n        grant.accessLevel === input.accessLevel,\n    );\n    if (!hasGrant) {\n      return { status: \"not-granted\" };\n    }\n  }\n\n  const targetSecretKey =\n    input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;\n  if (!targetSecretKey) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.runtime.infra.execSql,\n    projection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    secretKey: targetSecretKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);\n  return targetKek\n    ? {\n        knownContainerKeks: new Map([\n          [target.kek.containerKeyEpochId, targetKek],\n        ]),\n        status: \"prepared\",\n      }\n    : null;\n}\n\nexport function prepareContainerStateGroupRewrap(\n  input: Parameters<typeof prepareContainerStateGroupRewrapInternal>[0],\n): ReturnType<typeof prepareContainerStateGroupRewrapInternal> {\n  return nullOnProjectionVerificationCancellation(() =>\n    prepareContainerStateGroupRewrapInternal(input),\n  );\n}\n\nexport async function shareContainerState(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  persistence: ContainerContentsPersistence;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientUserId,\n    subjectType: \"user\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainer({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    previousProjection: shareContext.projection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n\nexport async function shareContainerStateWithGroup(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistence: ContainerContentsPersistence;\n  recipientGroupId: string;\n  // When set, a re-share only re-wraps an already-granted group and never mints\n  // a new grant. Used by organization access repair so a server cannot redirect\n  // the operation onto a container the group is not entitled to. A prepared\n  // re-wrap also supplies captured KEKs and must submit a real mutation.\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  // A share chosen by name must carry that name so it can be bound to the\n  // signed group policy. Only the grant-preserving re-wrap, which never mints\n  // a grant, may run without one. Enforced here, in the workflow facade, so\n  // every caller (not only the store) meets the invariant.\n  if (!input.requireExistingGrant && input.expectedGroupName === undefined) {\n    throw new Error(\"Container group share requires the chosen group name\");\n  }\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    expectedGroupName: input.expectedGroupName,\n    forceExistingGrantRewrap:\n      input.requireExistingGrant && input.knownContainerKeks !== undefined,\n    requireExistingGrant: input.requireExistingGrant,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientGroupId,\n    subjectType: \"group\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    // A duplicate share mints nothing, but it must not report success for a\n    // group the user did not choose. A matching grant is only found after the\n    // key-epoch probe verified the group's policy with the chosen name bound,\n    // so the name is already checked here.\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainerWithGroup({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    expectedGroupName: input.expectedGroupName,\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: shareContext.projection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n"]}

package/workflows/container-contents/container-state/sharePersistence.js

@@ -0,0 +1,136 @@
+import { persistContainerMetadataStateFromRuntime, } from "../metadata.js";
+import { createDetachedContainerMetadataState, installDetachedContainerMetadataState, } from "../metadataStateIsolation.js";
+import { installContainerWriterProjection } from "./projectionCache.js";
+// These helpers run only after the remote grant is verified. A skipped local
+// install does not undo that acknowledgement; reconciliation installs it later.
+export async function persistSharedContainerState(input) {
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    const candidateState = await createDetachedContainerMetadataState(input.containerState, { writerProjectionGeneration: input.writerProjectionGeneration });
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    candidateState.container = {
+        ...input.containerState.container,
+        createdAt: input.shared.createdAt,
+        serverCreatedAt: input.shared.createdAt,
+        serverUpdatedAt: input.shared.updatedAt,
+        updatedAt: input.shared.updatedAt,
+    };
+    const persisted = await persistContainerMetadataStateFromRuntime({
+        metadataState: candidateState,
+        patch: {
+            accessEpoch: input.shared.accessEpoch,
+            accessStateHash: input.shared.accessManifestHash,
+            documentId: input.shared.metadataDocumentId,
+            metadataDocumentId: input.shared.metadataDocumentId,
+            contentKeyBundle: null,
+            documentKekTargets: null,
+            documentManifestBundle: null,
+        },
+        persistence: input.persistence,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        saveOptions: {
+            serverTimestamps: {
+                createdAt: input.shared.createdAt,
+                updatedAt: input.shared.updatedAt,
+            },
+        },
+    });
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    if (!persisted)
+        return { status: "missing" };
+    candidateState.container = persisted.container;
+    installDetachedContainerMetadataState(input.containerState, candidateState, {
+        candidateRecord: persisted.record,
+        preserveConcurrentMetadataEdit: true,
+    });
+    if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {
+        return {
+            container: input.containerState.container,
+            record: input.containerState.record,
+            status: "identity-superseded",
+        };
+    }
+    installContainerWriterProjection(input.containerState, input.shared.writerProjection, input.writerProjectionGeneration);
+    return {
+        container: input.containerState.container,
+        record: input.containerState.record,
+        status: "persisted",
+    };
+}
+export async function persistDuplicateContainerShare(input) {
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    const candidateState = await createDetachedContainerMetadataState(input.containerState, { writerProjectionGeneration: input.writerProjectionGeneration });
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    candidateState.container = {
+        ...input.containerState.container,
+        ...(input.grant.createdAt
+            ? {
+                createdAt: input.grant.createdAt,
+                serverCreatedAt: input.grant.createdAt,
+            }
+            : {}),
+        ...(input.grant.updatedAt
+            ? {
+                serverUpdatedAt: input.grant.updatedAt,
+                updatedAt: input.grant.updatedAt,
+            }
+            : {}),
+    };
+    const securityContextChanged = candidateState.record.documentId !== input.grant.metadataDocumentId ||
+        candidateState.record.accessEpoch !== input.grant.accessEpoch ||
+        candidateState.record.accessStateHash !== input.grant.accessStateHash;
+    const patch = {
+        accessEpoch: input.grant.accessEpoch,
+        accessStateHash: input.grant.accessStateHash,
+        documentId: input.grant.metadataDocumentId,
+        metadataDocumentId: input.grant.metadataDocumentId,
+        ...(securityContextChanged
+            ? {
+                contentKeyBundle: null,
+                documentKekTargets: null,
+                documentManifestBundle: null,
+            }
+            : {}),
+    };
+    const persisted = await persistContainerMetadataStateFromRuntime({
+        metadataState: candidateState,
+        patch,
+        persistence: input.persistence,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        saveOptions: {
+            serverTimestamps: {
+                createdAt: input.grant.createdAt,
+                updatedAt: input.grant.updatedAt,
+            },
+        },
+    });
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    if (!persisted)
+        return { status: "missing" };
+    candidateState.container = persisted.container;
+    installDetachedContainerMetadataState(input.containerState, candidateState, {
+        candidateRecord: persisted.record,
+        preserveConcurrentMetadataEdit: true,
+    });
+    if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {
+        return {
+            container: input.containerState.container,
+            record: input.containerState.record,
+            status: "identity-superseded",
+        };
+    }
+    installContainerWriterProjection(input.containerState, input.projection, input.writerProjectionGeneration);
+    return {
+        container: input.containerState.container,
+        record: input.containerState.record,
+        status: "persisted",
+    };
+}
+//# sourceMappingURL=sharePersistence.js.map

package/workflows/container-contents/container-state/sharePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePersistence.js","sourceRoot":"","sources":["sharePersistence.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,wCAAwC,GACzC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAgBrE,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,oCAAoC,CAC/D,KAAK,CAAC,cAAc,EACpB,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE,CACjE,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,cAAc,CAAC,SAAS,GAAG;QACzB,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS;QACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACvC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACvC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;KAClC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAAC;QAC/D,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE;YACL,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YAChD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YAC3C,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YACnD,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;SAC7B;QACD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE;YACX,gBAAgB,EAAE;gBAChB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;aAClC;SACF;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,cAAc,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;YACnC,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IACD,gCAAgC,CAC9B,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAC7B,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;QACnC,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,oCAAoC,CAC/D,KAAK,CAAC,cAAc,EACpB,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE,CACjE,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,cAAc,CAAC,SAAS,GAAG;QACzB,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS;QACjC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACvC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,CAAC,CAAC;gBACE,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBACtC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,sBAAsB,GAC1B,cAAc,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,kBAAkB;QACnE,cAAc,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QAC7D,cAAc,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC;IACxE,MAAM,KAAK,GAAoC;QAC7C,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAClD,GAAG,CAAC,sBAAsB;YACxB,CAAC,CAAC;gBACE,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAAC;QAC/D,aAAa,EAAE,cAAc;QAC7B,KAAK;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE;YACX,gBAAgB,EAAE;gBAChB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,cAAc,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;YACnC,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IACD,gCAAgC,CAC9B,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;QACnC,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport {\n  type ContainerMetadataPatch,\n  persistContainerMetadataStateFromRuntime,\n} from \"../metadata\";\nimport {\n  createDetachedContainerMetadataState,\n  installDetachedContainerMetadataState,\n} from \"../metadataStateIsolation\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { installContainerWriterProjection } from \"./projectionCache\";\nimport type {\n  ContainerWorkflowRuntime,\n  SharedContainerStateResult,\n  SharedRemoteContainerState,\n} from \"./types\";\n\nexport interface MatchingRemoteContainerGrant {\n  accessEpoch: number;\n  accessStateHash: string;\n  createdAt: string | null;\n  metadataDocumentId: string;\n  referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n  updatedAt: string | null;\n}\n\n// These helpers run only after the remote grant is verified. A skipped local\n// install does not undo that acknowledgement; reconciliation installs it later.\nexport async function persistSharedContainerState(input: {\n  containerState: ContainerState;\n  persistence: ContainerContentsPersistence;\n  runtime: ContainerWorkflowRuntime;\n  shared: SharedRemoteContainerState;\n  stillCurrent?: (() => boolean) | undefined;\n  /** `writerProjectionGeneration` captured before the share flow began. */\n  writerProjectionGeneration: number;\n}): Promise<SharedContainerStateResult | null> {\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  const candidateState = await createDetachedContainerMetadataState(\n    input.containerState,\n    { writerProjectionGeneration: input.writerProjectionGeneration },\n  );\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  candidateState.container = {\n    ...input.containerState.container,\n    createdAt: input.shared.createdAt,\n    serverCreatedAt: input.shared.createdAt,\n    serverUpdatedAt: input.shared.updatedAt,\n    updatedAt: input.shared.updatedAt,\n  };\n\n  const persisted = await persistContainerMetadataStateFromRuntime({\n    metadataState: candidateState,\n    patch: {\n      accessEpoch: input.shared.accessEpoch,\n      accessStateHash: input.shared.accessManifestHash,\n      documentId: input.shared.metadataDocumentId,\n      metadataDocumentId: input.shared.metadataDocumentId,\n      contentKeyBundle: null,\n      documentKekTargets: null,\n      documentManifestBundle: null,\n    },\n    persistence: input.persistence,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    saveOptions: {\n      serverTimestamps: {\n        createdAt: input.shared.createdAt,\n        updatedAt: input.shared.updatedAt,\n      },\n    },\n  });\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  if (!persisted) return { status: \"missing\" };\n  candidateState.container = persisted.container;\n  installDetachedContainerMetadataState(input.containerState, candidateState, {\n    candidateRecord: persisted.record,\n    preserveConcurrentMetadataEdit: true,\n  });\n  if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {\n    return {\n      container: input.containerState.container,\n      record: input.containerState.record,\n      status: \"identity-superseded\",\n    };\n  }\n  installContainerWriterProjection(\n    input.containerState,\n    input.shared.writerProjection,\n    input.writerProjectionGeneration,\n  );\n  return {\n    container: input.containerState.container,\n    record: input.containerState.record,\n    status: \"persisted\",\n  };\n}\n\nexport async function persistDuplicateContainerShare(input: {\n  containerState: ContainerState;\n  grant: MatchingRemoteContainerGrant;\n  persistence: ContainerContentsPersistence;\n  projection: ContainerWriterProjectionResponse;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n  /** `writerProjectionGeneration` captured before the share flow began. */\n  writerProjectionGeneration: number;\n}): Promise<SharedContainerStateResult | null> {\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  const candidateState = await createDetachedContainerMetadataState(\n    input.containerState,\n    { writerProjectionGeneration: input.writerProjectionGeneration },\n  );\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  candidateState.container = {\n    ...input.containerState.container,\n    ...(input.grant.createdAt\n      ? {\n          createdAt: input.grant.createdAt,\n          serverCreatedAt: input.grant.createdAt,\n        }\n      : {}),\n    ...(input.grant.updatedAt\n      ? {\n          serverUpdatedAt: input.grant.updatedAt,\n          updatedAt: input.grant.updatedAt,\n        }\n      : {}),\n  };\n  const securityContextChanged =\n    candidateState.record.documentId !== input.grant.metadataDocumentId ||\n    candidateState.record.accessEpoch !== input.grant.accessEpoch ||\n    candidateState.record.accessStateHash !== input.grant.accessStateHash;\n  const patch: Partial<ContainerMetadataPatch> = {\n    accessEpoch: input.grant.accessEpoch,\n    accessStateHash: input.grant.accessStateHash,\n    documentId: input.grant.metadataDocumentId,\n    metadataDocumentId: input.grant.metadataDocumentId,\n    ...(securityContextChanged\n      ? {\n          contentKeyBundle: null,\n          documentKekTargets: null,\n          documentManifestBundle: null,\n        }\n      : {}),\n  };\n  const persisted = await persistContainerMetadataStateFromRuntime({\n    metadataState: candidateState,\n    patch,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    saveOptions: {\n      serverTimestamps: {\n        createdAt: input.grant.createdAt,\n        updatedAt: input.grant.updatedAt,\n      },\n    },\n  });\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n  if (!persisted) return { status: \"missing\" };\n  candidateState.container = persisted.container;\n  installDetachedContainerMetadataState(input.containerState, candidateState, {\n    candidateRecord: persisted.record,\n    preserveConcurrentMetadataEdit: true,\n  });\n  if (persisted.mutationSuperseded || persisted.syncIdentitySuperseded) {\n    return {\n      container: input.containerState.container,\n      record: input.containerState.record,\n      status: \"identity-superseded\",\n    };\n  }\n  installContainerWriterProjection(\n    input.containerState,\n    input.projection,\n    input.writerProjectionGeneration,\n  );\n  return {\n    container: input.containerState.container,\n    record: input.containerState.record,\n    status: \"persisted\",\n  };\n}\n"]}

package/workflows/container-contents/container-state/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/workflows/container-contents/container-state/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerDeleteResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type { createInitializedContainerMetadataDocument } from \"../../../data/containers/containerMetadataDocument\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type {\n  createRemoteContainer,\n  moveRemoteContainer,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"../../containers\";\nimport type { createRemoteDocument } from \"../../documents\";\nimport type {\n  ContainerContentsPersistence,\n  ContainerCreateIntentRecord,\n  ContainerMoveIntentRecord,\n} from \"../containerPersistence\";\nimport type {\n  ContainerState,\n  RemoteContainer as HydratedRemoteContainer,\n  RemoteContainerHydrationHost,\n} from \"../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport type ContainerWorkflowApi = Parameters<\n  typeof createRemoteContainer\n>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof shareRemoteContainerWithGroup>[0][\"apiClient\"] &\n  Parameters<typeof moveRemoteContainer>[0][\"apiClient\"] &\n  Parameters<typeof createRemoteDocument>[0][\"apiClient\"] & {\n    deleteContainerResult(\n      containerId: string,\n      options?: {\n        expectedPaymentRequiredOrganizationId?: string;\n        reportErrors?: boolean;\n      },\n    ): Promise<\n      | { data: ContainerDeleteResponse; ok: true }\n      | {\n          ok: false;\n          report: () => void;\n          status: number | null;\n        }\n    >;\n    primeContainerWriterProjection(\n      containerId: string,\n      projection: ContainerWriterProjectionResponse,\n    ): void;\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n\nexport interface ContainerWorkflowRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  readonly apiClient: ContainerWorkflowApi;\n}\n\nexport interface CreatedRemoteContainerState {\n  accessManifestHash: string;\n  /** The slot this client signed into the create; never the server's echo. */\n  systemSlot: ContainerSystemSlot | null;\n  containerId: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  organizationId: string;\n  /** A created container is a child; the acknowledgement echoed this parent. */\n  parentId: string;\n  persistedMetadataState: Pick<\n    DocumentRecord,\n    | \"documentId\"\n    | \"contentKeyBundle\"\n    | \"documentKekTargets\"\n    | \"documentManifestBundle\"\n  >;\n  updatedAt: string;\n}\n\nexport interface SharedRemoteContainerState {\n  accessEpoch: number;\n  accessManifestHash: string;\n  createdAt: string;\n  metadataDocumentId: string;\n  referencedPrincipalHeads: ReferencedPrincipalStateResponse[];\n  updatedAt: string;\n  writerProjection: ContainerWriterProjectionResponse | null;\n}\n\nexport interface SharedContainerState {\n  container: ContainerState[\"container\"];\n  record: ContainerState[\"record\"];\n}\n\nexport type SharedContainerStateResult =\n  | { status: \"missing\" }\n  | { status: \"confirmed\" }\n  | (SharedContainerState & {\n      status: \"identity-superseded\" | \"persisted\";\n    });\n\nexport type RemoteContainer = HydratedRemoteContainer;\n\nexport type ContainerMetadataDocumentState = Awaited<\n  ReturnType<typeof createInitializedContainerMetadataDocument>\n>[\"doc\"];\n\nexport interface CreatedChildContainerState {\n  containerState: ContainerState;\n  initialUpdate: Uint8Array;\n  shouldRequestSync: boolean;\n}\n\nexport interface ContainerIntentSyncState {\n  containersById: ReadonlyMap<string, ContainerState>;\n  persistence: ContainerContentsPersistence;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  /**\n   * Verifies that a listed container is this device's pending create before it\n   * is adopted and returns where it sits; `assertContainerCreateAdoptable`\n   * unless a test replaces it.\n   */\n  verifyCreateAdoption?: (input: {\n    readonly containerId: string;\n    readonly expectedOrganizationId: string;\n  }) => Promise<AdoptedContainerPlacement>;\n}\n\n/** Where a verified listed create committed, and where its container is now. */\nexport interface AdoptedContainerPlacement {\n  /** The parent its signed epoch-1 `container.create` named. */\n  readonly createdParentId: string;\n  /** The verified head's parent; another writer may have moved it since. */\n  readonly currentParentId: string;\n}\n\nexport type ContainerCreateIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerCreateIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\"\n>;\n\nexport interface ContainerCreateIntentSyncInput {\n  host: ContainerCreateIntentSyncHost;\n  /** A parent whose own create has not settled takes no child create. */\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerCreateIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerCreateIntentSyncState;\n}\n\nexport type ContainerMoveIntentSyncState = ContainerIntentSyncState;\n\nexport type ContainerMoveIntentSyncHost = Pick<\n  RemoteContainerHydrationHost,\n  \"persistContainerState\" | \"updateSnapshot\"\n>;\n\nexport interface ContainerMoveIntentSyncInput {\n  host: ContainerMoveIntentSyncHost;\n  isCurrent: () => boolean;\n  /** A folder whose create has not settled takes no structural writes. */\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  intent: ContainerMoveIntentRecord;\n  requestRemoteReconciliation: (parentContainerId: string | null) => void;\n  state: ContainerMoveIntentSyncState;\n}\n"]}

package/workflows/container-contents/containerDocumentListing.js

@@ -0,0 +1,52 @@
+import { isContainerNotFoundFailure } from "../../data/containers/shared/mutationFailures.js";
+function isUnavailableContainerDocumentLane(failure) {
+    return !failure.ok && isContainerNotFoundFailure(failure);
+}
+export async function listContainerDocumentsFromApi(apiClient, containerId, options, reportErrors = true) {
+    if (apiClient.listContainerDocumentsResult) {
+        const result = await apiClient.listContainerDocumentsResult(containerId, options, { reportErrors: false });
+        if (result.ok) {
+            return result.data;
+        }
+        if (reportErrors && !isUnavailableContainerDocumentLane(result)) {
+            result.report();
+        }
+        return null;
+    }
+    return apiClient.listContainerDocuments(containerId, options);
+}
+export async function listAllContainerDocuments(input) {
+    const items = [];
+    const tombstones = [];
+    let watermark = await input.loadContainerDocumentWatermark(input.containerId);
+    const isFullListing = watermark === null;
+    while (true) {
+        const response = await input.listContainerDocuments(input.containerId, {
+            watermark,
+        });
+        if (!response) {
+            return null;
+        }
+        items.push(...response.items);
+        tombstones.push(...response.tombstones);
+        watermark = response.nextWatermark;
+        if (!response.hasMore) {
+            return { isFullListing, items, nextWatermark: watermark, tombstones };
+        }
+        if (!watermark) {
+            return null;
+        }
+    }
+}
+/** Lists the authoritative current ids by deliberately starting at no watermark. */
+export async function listAllContainerDocumentIdsFromApi(input) {
+    const listed = await listAllContainerDocuments({
+        containerId: input.containerId,
+        loadContainerDocumentWatermark: async () => null,
+        listContainerDocuments: (containerId, options) => listContainerDocumentsFromApi(input.apiClient, containerId, options, input.reportErrors),
+    });
+    return listed
+        ? Array.from(new Set(listed.items.map((document) => document.id)))
+        : null;
+}
+//# sourceMappingURL=containerDocumentListing.js.map

package/workflows/container-contents/containerDocumentListing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerDocumentListing.js","sourceRoot":"","sources":["containerDocumentListing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAc3F,SAAS,kCAAkC,CACzC,OAIC;IAED,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAmC,EACnC,WAAmB,EACnB,OAEI,EACJ,YAAY,GAAG,IAAI;IAEnB,IAAI,SAAS,CAAC,4BAA4B,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,4BAA4B,CACzD,WAAW,EACX,OAAO,EACP,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,IAAI,SAAS,GAAG,MAAM,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE9E,MAAM,aAAa,GAAG,SAAS,KAAK,IAAI,CAAC;IAEzC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE;YACrE,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAIxD;IACC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;QAC7C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,8BAA8B,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAChD,sBAAsB,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAC/C,6BAA6B,CAC3B,KAAK,CAAC,SAAS,EACf,WAAW,EACX,OAAO,EACP,KAAK,CAAC,YAAY,CACnB;KACJ,CAAC,CAAC;IACH,OAAO,MAAM;QACX,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import { isContainerNotFoundFailure } from \"../../data/containers/shared/mutationFailures\";\nimport type {\n  ContainerDocumentDiscoveryApi,\n  ContainerDocumentTombstone,\n  DiscoverContainerDocumentsOptions,\n  ListedContainerDocument,\n  ListedContainerDocuments,\n} from \"./documentDiscoveryTypes\";\n\ntype ContainerDocumentListApi = Pick<\n  ContainerDocumentDiscoveryApi,\n  \"listContainerDocuments\" | \"listContainerDocumentsResult\"\n>;\n\nfunction isUnavailableContainerDocumentLane(\n  failure: Awaited<\n    ReturnType<\n      NonNullable<ContainerDocumentDiscoveryApi[\"listContainerDocumentsResult\"]>\n    >\n  >,\n): boolean {\n  return !failure.ok && isContainerNotFoundFailure(failure);\n}\n\nexport async function listContainerDocumentsFromApi(\n  apiClient: ContainerDocumentListApi,\n  containerId: string,\n  options?: Parameters<\n    ContainerDocumentDiscoveryApi[\"listContainerDocuments\"]\n  >[1],\n  reportErrors = true,\n): ReturnType<ContainerDocumentDiscoveryApi[\"listContainerDocuments\"]> {\n  if (apiClient.listContainerDocumentsResult) {\n    const result = await apiClient.listContainerDocumentsResult(\n      containerId,\n      options,\n      { reportErrors: false },\n    );\n    if (result.ok) {\n      return result.data;\n    }\n    if (reportErrors && !isUnavailableContainerDocumentLane(result)) {\n      result.report();\n    }\n    return null;\n  }\n\n  return apiClient.listContainerDocuments(containerId, options);\n}\n\nexport async function listAllContainerDocuments(input: {\n  containerId: string;\n  loadContainerDocumentWatermark: DiscoverContainerDocumentsOptions[\"loadContainerDocumentWatermark\"];\n  listContainerDocuments: DiscoverContainerDocumentsOptions[\"listContainerDocuments\"];\n}): Promise<ListedContainerDocuments | null> {\n  const items: ListedContainerDocument[] = [];\n  const tombstones: ContainerDocumentTombstone[] = [];\n  let watermark = await input.loadContainerDocumentWatermark(input.containerId);\n\n  const isFullListing = watermark === null;\n\n  while (true) {\n    const response = await input.listContainerDocuments(input.containerId, {\n      watermark,\n    });\n    if (!response) {\n      return null;\n    }\n    items.push(...response.items);\n    tombstones.push(...response.tombstones);\n    watermark = response.nextWatermark;\n\n    if (!response.hasMore) {\n      return { isFullListing, items, nextWatermark: watermark, tombstones };\n    }\n    if (!watermark) {\n      return null;\n    }\n  }\n}\n\n/** Lists the authoritative current ids by deliberately starting at no watermark. */\nexport async function listAllContainerDocumentIdsFromApi(input: {\n  readonly apiClient: ContainerDocumentListApi;\n  readonly containerId: string;\n  readonly reportErrors?: boolean;\n}): Promise<ReadonlyArray<string> | null> {\n  const listed = await listAllContainerDocuments({\n    containerId: input.containerId,\n    loadContainerDocumentWatermark: async () => null,\n    listContainerDocuments: (containerId, options) =>\n      listContainerDocumentsFromApi(\n        input.apiClient,\n        containerId,\n        options,\n        input.reportErrors,\n      ),\n  });\n  return listed\n    ? Array.from(new Set(listed.items.map((document) => document.id)))\n    : null;\n}\n"]}