@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/container-contents/tombstones/documentPurge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentPurge.js","sourceRoot":"","sources":["documentPurge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oCAAoC,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AA6C1F,KAAK,UAAU,yBAAyB,CAAC,KASxC;IACC,OAAO,KAAK,CAAC,WAAW,CAAC,8BAA8B,CACrD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,EAAE,kBAAkB,EAAE,EAAE;QAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,oCAAoC,CAC/E;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,kBAAkB;YAC3B,OAAO,EAAE,KAAK,CAAC,MAAM;SACtB,CACF,CAAC;QACF,MAAM,KAAK,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAS1C;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,oCAAoC,CAAC;QACzC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;KACrC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACzD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,MAAM,CACb,CAAC;IACF,IAAI,cAAc,IAAI,cAAc,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,yBAAyB,EAAE,KAAK,CAAC,gBAAgB;YACjD,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4CAA4C,MAAM,mDAAmD,CACtG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM;YACN,UAAU;YACV,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,eAAe,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE;gBAC9C,OAAO,GAAG,MAAM,2BAA2B,CAAC;oBAC1C,gBAAgB;oBAChB,UAAU;oBACV,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,MAAM;oBACN,WAAW;oBACX,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4CAA4C,MAAM,cAAc,UAAU,GAAG,CAC9E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,0BAA0B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,mCAAmC,MAAM,cAAc,UAAU,GAAG,CACrE,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,8DAA8D;QAC9D,sCAAsC,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,uCAAuC,CAC3C,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,gBAAgB;SAC5B,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4CAA4C,MAAM,cAAc,UAAU,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,YAAY,CACnD,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,MAAM,CACP,CAAC;QACF,IACE,CAAC,cAAc;YACf,cAAc,CAAC,UAAU,KAAK,IAAI;YAClC,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBACtC,cAAc,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,CAAC,EAC3D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,yDAAyD,MAAM,wCAAwC,CACxG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;YAC5C,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,kBAAkB;YACpD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,cAAc;YACd,OAAO,EAAE,MAAM;YACf,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,yDAAyD,MAAM,+BAA+B,CAC/F,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,0BAA0B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,8CAA8C,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,wBAAwB,EAAE,EAAE;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { DocumentPurgeResponse } from \"@tearleads/validators/response\";\nimport type { StoredDocumentKind } from \"../../../data/documents/documentKinds\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { reportAndRethrowKeyingVerificationError } from \"../../../data/keyingProjectionVerification/error\";\nimport { rethrowProjectionVerificationCancelled } from \"../../../data/keyingProjectionVerification/types\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport {\n  type DocumentsPersistence,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  purgeRemoteDocument,\n  reclaimDocumentOrphanBlobs,\n  resolveDocumentCreateAuthor,\n} from \"../../documents\";\nimport { ensureDocumentClientProjectionTables } from \"../../documents/persistence\";\nimport type { SubtreePurgeRoot } from \"../../documents/purge/subtreePurgeScope\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\ntype ContainerDocumentPurgeApi = Pick<\n  ContainerContentsWorkflowRuntime[\"apiClient\"],\n  | \"getPrincipalPolicyPages\"\n  | \"getProjectionPolicyHistoryPages\"\n  | \"getDocumentPurgeProof\"\n  | \"getDocumentWriterProjectionResult\"\n  | \"purgeDocument\"\n>;\ntype DocumentPurgeResult =\n  | DocumentPurgeResponse\n  | {\n      readonly documentId: string;\n      readonly purgedAt: string;\n      readonly reclaimedBlobStorageKeys: readonly string[];\n    }\n  | null;\n\ninterface ContainerDocumentPurgeRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  apiClient: ContainerDocumentPurgeApi;\n}\n\ninterface PurgeRemoteContainerDocumentInput {\n  beforeSubmit?: (() => Promise<boolean>) | undefined;\n  documentId: string;\n  expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  documentKind: StoredDocumentKind;\n  noteId: string;\n  persistence?: DocumentsPersistence | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerDocumentPurgeRuntime;\n}\n\nasync function deleteAbsentDocumentState(input: {\n  readonly commitPurgeProof: (\n    transactionExecSql: ContainerDocumentPurgeRuntime[\"infra\"][\"execSql\"],\n  ) => Promise<void>;\n  readonly documentId: string;\n  readonly documentKind: StoredDocumentKind;\n  readonly noteId: string;\n  readonly persistence: DocumentsPersistence;\n  readonly runtime: ContainerDocumentPurgeRuntime;\n}): Promise<boolean> {\n  return input.persistence.deleteDocumentSideRowsIfAbsent(\n    input.runtime.infra.execSql,\n    input.noteId,\n    input.documentId,\n    async (transactionExecSql) => {\n      await input.runtime.infra.documentProjectors.deleteStoredDocumentClientProjection(\n        {\n          documentKind: input.documentKind,\n          execSql: transactionExecSql,\n          localId: input.noteId,\n        },\n      );\n      await input.commitPurgeProof(transactionExecSql);\n    },\n  );\n}\n\nasync function commitVerifiedDocumentPurge(input: {\n  readonly commitPurgeProof: (\n    transactionExecSql: ContainerDocumentPurgeRuntime[\"infra\"][\"execSql\"],\n  ) => Promise<void>;\n  readonly documentId: string;\n  readonly documentKind: StoredDocumentKind;\n  readonly noteId: string;\n  readonly persistence: DocumentsPersistence;\n  readonly runtime: ContainerDocumentPurgeRuntime;\n}): Promise<boolean> {\n  await input.persistence.ensureSchema(input.runtime.infra.execSql);\n  await ensureDocumentClientProjectionTables({\n    documentProjectors: input.runtime.infra.documentProjectors,\n    execSql: input.runtime.infra.execSql,\n  });\n  const expectedRecord = await input.persistence.loadDocument(\n    input.runtime.infra.execSql,\n    input.noteId,\n  );\n  if (expectedRecord && expectedRecord.documentId !== input.documentId) {\n    throw new Error(\n      \"Local document identity changed while its remote purge was committing\",\n    );\n  }\n  const deleted = expectedRecord\n    ? await deletePersistedDocument({\n        beforeDeleteInTransaction: input.commitPurgeProof,\n        documentProjectors: input.runtime.infra.documentProjectors,\n        execSql: input.runtime.infra.execSql,\n        expectedRecord,\n        localId: input.noteId,\n        persistence: input.persistence,\n      })\n    : await deleteAbsentDocumentState(input);\n  if (!deleted) {\n    throw new Error(\n      \"Local document state changed while its remote purge was committing\",\n    );\n  }\n  return true;\n}\n\nexport async function purgeRemoteContainerDocument(\n  input: PurgeRemoteContainerDocumentInput,\n): Promise<DocumentPurgeResult> {\n  const { documentId, noteId, runtime } = input;\n  const persistence = input.persistence ?? defaultDocumentsPersistence;\n  try {\n    const author = resolveDocumentCreateAuthor(runtime);\n    if (!author) {\n      runtime.util.log(\n        `Container contents: failed to purge note ${noteId} because the local signing context is unavailable`,\n      );\n      return null;\n    }\n    let deleted = false;\n    const response = await purgeRemoteDocument({\n      apiClient: runtime.apiClient,\n      beforeSubmit: input.beforeSubmit,\n      author,\n      documentId,\n      expectedSubtreeRoot: input.expectedSubtreeRoot,\n      stillCurrent: input.stillCurrent,\n      execSql: runtime.infra.execSql,\n      onVerifiedPurge: async ({ commitPurgeProof }) => {\n        deleted = await commitVerifiedDocumentPurge({\n          commitPurgeProof,\n          documentId,\n          documentKind: input.documentKind,\n          noteId,\n          persistence,\n          runtime,\n        });\n      },\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      warmReferencedPrincipalPolicies:\n        createRuntimePrincipalPolicyWarmer(runtime),\n    });\n    if (!response) {\n      runtime.util.log(\n        `Container contents: failed to purge note ${noteId} (document ${documentId})`,\n      );\n      return null;\n    }\n    if (deleted) {\n      void reclaimDocumentOrphanBlobs(runtime, persistence);\n    }\n    runtime.util.log(\n      `Container contents: purged note ${noteId} (document ${documentId})`,\n    );\n    return response;\n  } catch (error) {\n    // A cancelled verification is neither a failure nor a completed purge; the\n    // caller that owns the generation decides what to do with it.\n    rethrowProjectionVerificationCancelled(error);\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: documentId,\n        objectKind: \"document\",\n        operation: \"document.purge\",\n      },\n    );\n    runtime.util.log(\n      `Container contents: failed to purge note ${noteId} (document ${documentId}): ${errorMessage(error)}`,\n    );\n    return null;\n  }\n}\n\ninterface ContainerDocumentLocalPurgeRuntime\n  extends Pick<ContainerContentsWorkflowRuntime, \"infra\" | \"util\"> {}\n\nexport async function purgeLocalContainerDocument(input: {\n  beforeDeleteInTransaction?: Parameters<\n    typeof deletePersistedDocument\n  >[0][\"beforeDeleteInTransaction\"];\n  noteId: string;\n  expectedContainerId?: string | null | undefined;\n  persistence?: DocumentsPersistence | undefined;\n  runtime: ContainerDocumentLocalPurgeRuntime;\n}): Promise<DocumentPurgeResult> {\n  const { noteId, runtime } = input;\n  const persistence = input.persistence ?? defaultDocumentsPersistence;\n  try {\n    await persistence.ensureSchema(runtime.infra.execSql);\n    const expectedRecord = await persistence.loadDocument(\n      runtime.infra.execSql,\n      noteId,\n    );\n    if (\n      !expectedRecord ||\n      expectedRecord.documentId !== null ||\n      (input.expectedContainerId !== undefined &&\n        expectedRecord.containerId !== input.expectedContainerId)\n    ) {\n      runtime.util.log(\n        `Container contents: local-only purge refused for note ${noteId} because it is absent or remote-backed`,\n      );\n      return null;\n    }\n    const deleted = await deletePersistedDocument({\n      beforeDeleteInTransaction: input.beforeDeleteInTransaction,\n      documentProjectors: runtime.infra.documentProjectors,\n      execSql: runtime.infra.execSql,\n      expectedRecord,\n      localId: noteId,\n      persistence,\n    });\n    if (!deleted) {\n      runtime.util.log(\n        `Container contents: local-only purge refused for note ${noteId} because its identity changed`,\n      );\n      return null;\n    }\n    if (deleted) {\n      void reclaimDocumentOrphanBlobs(runtime, persistence);\n    }\n    runtime.util.log(`Container contents: purged local-only note ${noteId}`);\n    return {\n      documentId: noteId,\n      purgedAt: new Date().toISOString(),\n      reclaimedBlobStorageKeys: [],\n    };\n  } catch (error) {\n    runtime.util.log(\n      `Container contents: failed to purge local-only note ${noteId}: ${errorMessage(error)}`,\n    );\n    return null;\n  }\n}\n"]}

package/workflows/container-contents/tombstones/documentTombstoneEvidence.js

@@ -0,0 +1,173 @@
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../../internal/validators/response/index.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { uniqueSortedStrings } from "../../../data/documents/shared/readers.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { reportKeyingVerificationErrorInCauseChain } from "../../../data/keyingProjectionVerification/error.js";
+import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
+import { loadDocumentPurgeCheckpoint } from "../../../data/persistence/documentPurgeCheckpointPersistence.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { documentHeadMatchesOrganization } from "../documentDiscovery/documentHeadScope.js";
+export const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;
+/**
+ * Head loads per settle. Tombstones beyond it stay unverified and are held
+ * for a later, backed-off retry, so a bulk move out of a folder does not cost
+ * every device an unbounded burst of fetches before the watermark advances.
+ */
+export const HEAD_LINK_SET_LOADS_PER_RUN = 32;
+async function verifiedHeadLinkSet(runtime, deps, documentId, projection) {
+    const verified = {};
+    await deps.assertDocumentWriterProjectionConsistent(projection, {
+        // Only the link set is read; a bundle wrapped to superseded KEK targets
+        // still carries the signed head.
+        allowStaleContentKeyBundle: true,
+        execSql: runtime.infra.execSql,
+        onVerifiedAuthorization: (authorization) => {
+            const head = authorization.documentManifestByHash.get(projection.documentManifest.manifestHash);
+            if (head && head.state.documentId === documentId) {
+                verified.value = {
+                    organizationId: head.state.organizationId,
+                    accessEpoch: head.state.epoch,
+                    accessStateHash: head.manifestHash,
+                    linkedContainerIds: uniqueSortedStrings(head.state.linkedContainerIds),
+                };
+            }
+        },
+        resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+    });
+    if (!verified.value) {
+        throw new Error("Tombstone evidence lacks a verified document head");
+    }
+    return verified.value;
+}
+async function reportUnavailableHead(runtime, documentId, error) {
+    const integrityFailure = await reportKeyingVerificationErrorInCauseChain(error, runtime.util.reportSecurityIncident, {
+        objectId: documentId,
+        objectKind: "document",
+        operation: "document.tombstone-evidence",
+    });
+    try {
+        if (!integrityFailure &&
+            error instanceof ProjectionDependencyUnavailableError) {
+            // A policy can advance without changing this document's hash. Drop its
+            // cached evidence so the held head can recover on the next run.
+            runtime.apiClient.evictDocumentWriterProjection(documentId);
+            runtime.util.log(`Container contents: tombstone evidence for document ${documentId} is awaiting current policy history`);
+            return;
+        }
+        runtime.util.logError?.("Container contents: tombstone evidence is unavailable", error);
+    }
+    catch {
+        // A host logger that throws must not fail the discovery pass.
+    }
+}
+export function createDocumentHeadLinkSetLoader(runtime, deps = {
+    assertDocumentWriterProjectionConsistent,
+    loadDocumentPurgeCheckpoint,
+}) {
+    return async (documentId, expectedManifestHash) => {
+        try {
+            // A verified purge proof is terminal signed evidence that the document
+            // links nothing any more.
+            if (await deps.loadDocumentPurgeCheckpoint(runtime.infra.execSql, documentId)) {
+                return {
+                    organizationId: null,
+                    accessEpoch: Number.MAX_SAFE_INTEGER,
+                    linkedContainerIds: [],
+                };
+            }
+            // Tombstones require a fresh head. Listings can reuse a matching cached
+            // projection, whose signature and local checkpoint are still verified.
+            if (!expectedManifestHash)
+                runtime.apiClient.evictDocumentWriterProjection(documentId);
+            let result = await runtime.apiClient.getDocumentWriterProjectionResult(documentId, { reportErrors: false });
+            if (expectedManifestHash &&
+                result.ok &&
+                result.data.documentManifest.manifestHash !== expectedManifestHash) {
+                runtime.apiClient.evictDocumentWriterProjection(documentId);
+                result = await runtime.apiClient.getDocumentWriterProjectionResult(documentId, { reportErrors: false });
+            }
+            if (!result.ok) {
+                if (result.status === 404 &&
+                    result.code === DOCUMENT_NOT_FOUND_ERROR_CODE)
+                    return "not-found";
+                runtime.util.log(`Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? "offline"})`);
+                return null;
+            }
+            return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);
+        }
+        catch (error) {
+            // Any failure leaves the tombstone unverified (held and retried); a
+            // thrown error here must not fail the whole discovery pass.
+            await reportUnavailableHead(runtime, documentId, error);
+            return null;
+        }
+    };
+}
+function judgeTombstones(tombstones, head) {
+    return tombstones.map((tombstone) => {
+        if (head === null) {
+            return { kind: "unverified", tombstone };
+        }
+        if (head.linkedContainerIds.includes(tombstone.containerId)) {
+            return {
+                kind: "refuted",
+                linkedContainerIds: head.linkedContainerIds,
+                tombstone,
+            };
+        }
+        return {
+            kind: "verified",
+            tombstone: {
+                ...tombstone,
+                accessEpoch: head.accessEpoch,
+                linkedContainerIds: head.linkedContainerIds,
+            },
+        };
+    });
+}
+/**
+ * Judge listing tombstones against each document's verified head link set,
+ * fetched once per document with bounded concurrency and a per-run cap. A
+ * head whose epoch is below local document state is no evidence: it may be a
+ * lagging replica or a replay, and applying it could delete rows a newer
+ * listing or settled move wrote.
+ */
+export function createContainerDocumentTombstoneVerifier(organizationId, loadDocumentHeadLinkSet, loadLocalDocumentAccessEpoch) {
+    return async (tombstones) => {
+        const byDocumentId = new Map();
+        for (const tombstone of tombstones) {
+            const group = byDocumentId.get(tombstone.documentId) ?? [];
+            group.push(tombstone);
+            byDocumentId.set(tombstone.documentId, group);
+        }
+        const groups = [...byDocumentId.entries()];
+        const verdicts = groups.map(([, group], index) => index < HEAD_LINK_SET_LOADS_PER_RUN
+            ? judgeTombstones(group, null)
+            : group.map((tombstone) => ({ kind: "deferred", tombstone })));
+        let next = 0;
+        const worker = async () => {
+            while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {
+                const index = next++;
+                const entry = groups[index];
+                if (!entry)
+                    break;
+                const [documentId, group] = entry;
+                const head = await loadDocumentHeadLinkSet(documentId);
+                if (head === null || head === "not-found")
+                    continue;
+                if (!documentHeadMatchesOrganization(head, organizationId))
+                    continue;
+                // A local-state read that fails is treated like an unavailable head:
+                // the tombstones stay held rather than failing the discovery pass.
+                const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(() => Number.MAX_SAFE_INTEGER);
+                if (head.accessEpoch < localEpoch)
+                    continue;
+                verdicts[index] = judgeTombstones(group, head);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) }, worker));
+        return verdicts.flat();
+    };
+}
+//# sourceMappingURL=documentTombstoneEvidence.js.map

package/workflows/container-contents/tombstones/documentTombstoneEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentTombstoneEvidence.js","sourceRoot":"","sources":["documentTombstoneEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,GAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAC7G,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAM1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AA+BzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,KAAK,UAAU,mBAAmB,CAChC,OAAyC,EACzC,IAAmC,EACnC,UAAkB,EAClB,UAA4C;IAE5C,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,IAAI,CAAC,wCAAwC,CAAC,UAAU,EAAE;QAC9D,wEAAwE;QACxE,iCAAiC;QACjC,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACnD,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzC,CAAC;YACF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACjD,QAAQ,CAAC,KAAK,GAAG;oBACf,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBAC7B,eAAe,EAAE,IAAI,CAAC,YAAY;oBAClC,kBAAkB,EAAE,mBAAmB,CACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAyC,EACzC,UAAkB,EAClB,KAAc;IAEd,MAAM,gBAAgB,GAAG,MAAM,yCAAyC,CACtE,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,6BAA6B;KACzC,CACF,CAAC;IACF,IAAI,CAAC;QACH,IACE,CAAC,gBAAgB;YACjB,KAAK,YAAY,oCAAoC,EACrD,CAAC;YACD,uEAAuE;YACvE,gEAAgE;YAChE,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,qCAAqC,CACvG,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CACrB,uDAAuD,EACvD,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAyC,EACzC,OAAsC;IACpC,wCAAwC;IACxC,2BAA2B;CAC5B;IAED,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,uEAAuE;YACvE,0BAA0B;YAC1B,IACE,MAAM,IAAI,CAAC,2BAA2B,CACpC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,UAAU,CACX,EACD,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,MAAM,CAAC,gBAAgB;oBACpC,kBAAkB,EAAE,EAAE;iBACvB,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,oBAAoB;gBACvB,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CACpE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACF,IACE,oBAAoB;gBACpB,MAAM,CAAC,EAAE;gBACT,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,KAAK,oBAAoB,EAClE,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;gBAC5D,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CAChE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IACE,MAAM,CAAC,MAAM,KAAK,GAAG;oBACrB,MAAM,CAAC,IAAI,KAAK,6BAA6B;oBAE7C,OAAO,WAAW,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,oBAAoB,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CACnH,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAqD,EACrD,IAAwC;IAExC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAqC,EAAE;QACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,SAAS;aACV,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE;gBACT,GAAG,SAAS;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAkC,EAClC,uBAAkD,EAClD,4BAA4D;IAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE;QAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAA0C,MAAM,CAAC,GAAG,CAChE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAuC,EAAE,CACxD,KAAK,GAAG,2BAA2B;YACjC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAClE,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAClB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACpD,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,cAAc,CAAC;oBAAE,SAAS;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;gBACF,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU;oBAAE,SAAS;gBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACnE,MAAM,CACP,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../../data/keyingProjectionVerification/error\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport { loadDocumentPurgeCheckpoint } from \"../../../data/persistence/documentPurgeCheckpointPersistence\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type {\n  ContainerDocumentTombstone,\n  ContainerDocumentTombstoneVerdict,\n  ContainerDocumentTombstoneVerifier,\n} from \"../documentDiscovery/documentDiscoveryTypes\";\nimport { documentHeadMatchesOrganization } from \"../documentDiscovery/documentHeadScope\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\n\nexport interface VerifiedDocumentHeadLinkSet {\n  readonly organizationId: string | null;\n  readonly accessEpoch: number;\n  /** Present for a signed head; a terminal purge has no live access state. */\n  readonly accessStateHash?: string;\n  readonly linkedContainerIds: ReadonlyArray<string>;\n}\n\n/**\n * The document's verified head link set, or `null` when no verified head is\n * available: the projection could not be fetched (the requester may no\n * longer read the document, or it was purged) or failed verification.\n */\nexport type DocumentHeadLinkSetLoader = (\n  documentId: string,\n  expectedManifestHash?: string,\n) => Promise<VerifiedDocumentHeadLinkSet | \"not-found\" | null>;\n\n/** The highest access epoch local state records for the document. */\nexport type LocalDocumentAccessEpochLoader = (\n  documentId: string,\n) => Promise<number>;\n\nexport interface DocumentHeadLinkSetLoaderDeps {\n  readonly assertDocumentWriterProjectionConsistent: typeof assertDocumentWriterProjectionConsistent;\n  readonly loadDocumentPurgeCheckpoint: typeof loadDocumentPurgeCheckpoint;\n}\n\nexport const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;\n/**\n * Head loads per settle. Tombstones beyond it stay unverified and are held\n * for a later, backed-off retry, so a bulk move out of a folder does not cost\n * every device an unbounded burst of fetches before the watermark advances.\n */\nexport const HEAD_LINK_SET_LOADS_PER_RUN = 32;\n\nasync function verifiedHeadLinkSet(\n  runtime: ContainerContentsWorkflowRuntime,\n  deps: DocumentHeadLinkSetLoaderDeps,\n  documentId: string,\n  projection: DocumentWriterProjectionResponse,\n): Promise<VerifiedDocumentHeadLinkSet> {\n  const verified: { value?: VerifiedDocumentHeadLinkSet } = {};\n  await deps.assertDocumentWriterProjectionConsistent(projection, {\n    // Only the link set is read; a bundle wrapped to superseded KEK targets\n    // still carries the signed head.\n    allowStaleContentKeyBundle: true,\n    execSql: runtime.infra.execSql,\n    onVerifiedAuthorization: (authorization) => {\n      const head = authorization.documentManifestByHash.get(\n        projection.documentManifest.manifestHash,\n      );\n      if (head && head.state.documentId === documentId) {\n        verified.value = {\n          organizationId: head.state.organizationId,\n          accessEpoch: head.state.epoch,\n          accessStateHash: head.manifestHash,\n          linkedContainerIds: uniqueSortedStrings(\n            head.state.linkedContainerIds,\n          ),\n        };\n      }\n    },\n    resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  });\n  if (!verified.value) {\n    throw new Error(\"Tombstone evidence lacks a verified document head\");\n  }\n  return verified.value;\n}\n\nasync function reportUnavailableHead(\n  runtime: ContainerContentsWorkflowRuntime,\n  documentId: string,\n  error: unknown,\n): Promise<void> {\n  const integrityFailure = await reportKeyingVerificationErrorInCauseChain(\n    error,\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: documentId,\n      objectKind: \"document\",\n      operation: \"document.tombstone-evidence\",\n    },\n  );\n  try {\n    if (\n      !integrityFailure &&\n      error instanceof ProjectionDependencyUnavailableError\n    ) {\n      // A policy can advance without changing this document's hash. Drop its\n      // cached evidence so the held head can recover on the next run.\n      runtime.apiClient.evictDocumentWriterProjection(documentId);\n      runtime.util.log(\n        `Container contents: tombstone evidence for document ${documentId} is awaiting current policy history`,\n      );\n      return;\n    }\n    runtime.util.logError?.(\n      \"Container contents: tombstone evidence is unavailable\",\n      error,\n    );\n  } catch {\n    // A host logger that throws must not fail the discovery pass.\n  }\n}\n\nexport function createDocumentHeadLinkSetLoader(\n  runtime: ContainerContentsWorkflowRuntime,\n  deps: DocumentHeadLinkSetLoaderDeps = {\n    assertDocumentWriterProjectionConsistent,\n    loadDocumentPurgeCheckpoint,\n  },\n): DocumentHeadLinkSetLoader {\n  return async (documentId, expectedManifestHash) => {\n    try {\n      // A verified purge proof is terminal signed evidence that the document\n      // links nothing any more.\n      if (\n        await deps.loadDocumentPurgeCheckpoint(\n          runtime.infra.execSql,\n          documentId,\n        )\n      ) {\n        return {\n          organizationId: null,\n          accessEpoch: Number.MAX_SAFE_INTEGER,\n          linkedContainerIds: [],\n        };\n      }\n      // Tombstones require a fresh head. Listings can reuse a matching cached\n      // projection, whose signature and local checkpoint are still verified.\n      if (!expectedManifestHash)\n        runtime.apiClient.evictDocumentWriterProjection(documentId);\n      let result = await runtime.apiClient.getDocumentWriterProjectionResult(\n        documentId,\n        { reportErrors: false },\n      );\n      if (\n        expectedManifestHash &&\n        result.ok &&\n        result.data.documentManifest.manifestHash !== expectedManifestHash\n      ) {\n        runtime.apiClient.evictDocumentWriterProjection(documentId);\n        result = await runtime.apiClient.getDocumentWriterProjectionResult(\n          documentId,\n          { reportErrors: false },\n        );\n      }\n      if (!result.ok) {\n        if (\n          result.status === 404 &&\n          result.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n        )\n          return \"not-found\";\n        runtime.util.log(\n          `Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? \"offline\"})`,\n        );\n        return null;\n      }\n      return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);\n    } catch (error) {\n      // Any failure leaves the tombstone unverified (held and retried); a\n      // thrown error here must not fail the whole discovery pass.\n      await reportUnavailableHead(runtime, documentId, error);\n      return null;\n    }\n  };\n}\n\nfunction judgeTombstones(\n  tombstones: ReadonlyArray<ContainerDocumentTombstone>,\n  head: VerifiedDocumentHeadLinkSet | null,\n): ContainerDocumentTombstoneVerdict[] {\n  return tombstones.map((tombstone): ContainerDocumentTombstoneVerdict => {\n    if (head === null) {\n      return { kind: \"unverified\", tombstone };\n    }\n    if (head.linkedContainerIds.includes(tombstone.containerId)) {\n      return {\n        kind: \"refuted\",\n        linkedContainerIds: head.linkedContainerIds,\n        tombstone,\n      };\n    }\n    return {\n      kind: \"verified\",\n      tombstone: {\n        ...tombstone,\n        accessEpoch: head.accessEpoch,\n        linkedContainerIds: head.linkedContainerIds,\n      },\n    };\n  });\n}\n\n/**\n * Judge listing tombstones against each document's verified head link set,\n * fetched once per document with bounded concurrency and a per-run cap. A\n * head whose epoch is below local document state is no evidence: it may be a\n * lagging replica or a replay, and applying it could delete rows a newer\n * listing or settled move wrote.\n */\nexport function createContainerDocumentTombstoneVerifier(\n  organizationId: string | undefined,\n  loadDocumentHeadLinkSet: DocumentHeadLinkSetLoader,\n  loadLocalDocumentAccessEpoch: LocalDocumentAccessEpochLoader,\n): ContainerDocumentTombstoneVerifier {\n  return async (tombstones) => {\n    const byDocumentId = new Map<string, ContainerDocumentTombstone[]>();\n    for (const tombstone of tombstones) {\n      const group = byDocumentId.get(tombstone.documentId) ?? [];\n      group.push(tombstone);\n      byDocumentId.set(tombstone.documentId, group);\n    }\n    const groups = [...byDocumentId.entries()];\n    const verdicts: ContainerDocumentTombstoneVerdict[][] = groups.map(\n      ([, group], index): ContainerDocumentTombstoneVerdict[] =>\n        index < HEAD_LINK_SET_LOADS_PER_RUN\n          ? judgeTombstones(group, null)\n          : group.map((tombstone) => ({ kind: \"deferred\", tombstone })),\n    );\n    let next = 0;\n    const worker = async () => {\n      while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {\n        const index = next++;\n        const entry = groups[index];\n        if (!entry) break;\n        const [documentId, group] = entry;\n        const head = await loadDocumentHeadLinkSet(documentId);\n        if (head === null || head === \"not-found\") continue;\n        if (!documentHeadMatchesOrganization(head, organizationId)) continue;\n        // A local-state read that fails is treated like an unavailable head:\n        // the tombstones stay held rather than failing the discovery pass.\n        const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(\n          () => Number.MAX_SAFE_INTEGER,\n        );\n        if (head.accessEpoch < localEpoch) continue;\n        verdicts[index] = judgeTombstones(group, head);\n      }\n    };\n    await Promise.all(\n      Array.from(\n        { length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) },\n        worker,\n      ),\n    );\n    return verdicts.flat();\n  };\n}\n"]}

package/workflows/container-contents/tombstones/documentTombstoneGate.js

@@ -0,0 +1,94 @@
+import { containerDocumentPlacementKey as placementKey } from "../../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence.js";
+function dedupePlacements(placements) {
+    const seen = new Set();
+    return placements.filter((placement) => {
+        const key = placementKey(placement);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * One candidate per placement the device actually holds; the newest server
+ * timestamp wins. A tombstone for a placement this device never had has
+ * nothing to remove or hide, so its head is not fetched.
+ */
+async function mergeTombstoneCandidates(store, listed, held) {
+    const known = new Set((await store.listKnownContainerDocumentPlacements(listed)).map(placementKey));
+    const byPlacement = new Map();
+    for (const tombstone of [
+        ...held,
+        ...listed.filter((tombstone) => known.has(placementKey(tombstone))),
+    ]) {
+        const key = placementKey(tombstone);
+        const current = byPlacement.get(key);
+        if (!current ||
+            Date.parse(current.updatedAt) < Date.parse(tombstone.updatedAt)) {
+            byPlacement.set(key, tombstone);
+        }
+    }
+    return [...byPlacement.values()];
+}
+function assertVerdictsCoverCandidates(candidates, verdicts) {
+    const verdictKeys = new Set(verdicts.map((verdict) => placementKey(verdict.tombstone)));
+    if (verdictKeys.size !== verdicts.length ||
+        verdictKeys.size !== candidates.length ||
+        candidates.some((candidate) => !verdictKeys.has(placementKey(candidate)))) {
+        throw new Error("Container document tombstone verification must return one verdict per tombstone");
+    }
+}
+/**
+ * Apply a tombstone only when the signed head omits its container. Unavailable
+ * heads leave hidden placements. A head that still links a container keeps its
+ * placement visible, but retains a backed-off retry: even an uncached signed
+ * head can lag the listing, so its refutation must not discard an honest move.
+ * Listing items pass their own signed-head gate before reaching persistence.
+ */
+export async function settleContainerDocumentTombstones(input) {
+    const { store } = input;
+    const held = await store.listHeldContainerDocumentTombstones(input.containerIds);
+    const candidates = await mergeTombstoneCandidates(store, input.tombstones, held);
+    if (candidates.length === 0) {
+        return [];
+    }
+    const verdicts = await store.verifyContainerDocumentTombstones(candidates);
+    assertVerdictsCoverCandidates(candidates, verdicts);
+    const verified = verdicts.flatMap((verdict) => verdict.kind === "verified" ? [verdict.tombstone] : []);
+    const refuted = verdicts.flatMap((verdict) => verdict.kind === "refuted" ? [verdict.tombstone] : []);
+    const unverified = verdicts.flatMap((verdict) => verdict.kind === "unverified" ? [verdict.tombstone] : []);
+    const deferred = verdicts.flatMap((verdict) => verdict.kind === "deferred"
+        ? [{ ...verdict.tombstone, deferred: true }]
+        : []);
+    // A loaded head is evidence for every placement it links, including holds
+    // on this document that were not due this run: make them visible while
+    // retaining each retry, since the head may lag any of those tombstones.
+    const headLinkedPlacements = verdicts.flatMap((verdict) => {
+        if (verdict.kind !== "verified" && verdict.kind !== "refuted")
+            return [];
+        const linked = verdict.kind === "verified"
+            ? verdict.tombstone.linkedContainerIds
+            : verdict.linkedContainerIds;
+        return linked.map((containerId) => ({
+            containerId,
+            documentId: verdict.tombstone.documentId,
+        }));
+    });
+    const summaries = verified.length > 0
+        ? await store.applyContainerDocumentTombstones(verified)
+        : [];
+    const retryKeys = new Set(refuted.map(placementKey));
+    const visibleRetries = dedupePlacements(headLinkedPlacements).filter((placement) => !retryKeys.has(placementKey(placement)));
+    if (visibleRetries.length > 0) {
+        await store.refuteContainerDocumentTombstoneHolds(visibleRetries);
+    }
+    const retries = [
+        ...unverified,
+        ...deferred,
+        ...refuted.map((tombstone) => ({ ...tombstone, refuted: true })),
+    ];
+    if (retries.length > 0)
+        await store.holdContainerDocumentTombstones(retries);
+    return summaries;
+}
+//# sourceMappingURL=documentTombstoneGate.js.map

package/workflows/container-contents/tombstones/documentTombstoneGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentTombstoneGate.js","sourceRoot":"","sources":["documentTombstoneGate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,IAAI,YAAY,EAAE,MAAM,gFAAgF,CAAC;AAkB/I,SAAS,gBAAgB,CACvB,UAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAAyB,EACzB,MAAiD,EACjD,IAA+C;IAE/C,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,KAAK,CAAC,oCAAoC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC5D,YAAY,CACb,CACF,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsC,CAAC;IAClE,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAI;QACP,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;KACpE,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IACE,CAAC,OAAO;YACR,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAC/D,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAqD,EACrD,QAA0D;IAE1D,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC3D,CAAC;IACF,IACE,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACpC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;QACtC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mCAAmC,CAC1D,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,IAAI,CACL,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAC3E,6BAA6B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACvD,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,KAAK,UAAU;QACzB,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CACP,CAAC;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACzE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,UAAU;YACzB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,kBAAkB;YACtC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAClC,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;SACzC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,gCAAgC,CAAC,QAAQ,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAClE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CACvD,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,qCAAqC,CAAC,cAAc,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,UAAU;QACb,GAAG,QAAQ;QACX,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;KACjE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { containerDocumentPlacementKey as placementKey } from \"../../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence\";\nimport type {\n  ContainerDocumentPlacement,\n  ContainerDocumentTombstone,\n  ContainerDocumentTombstoneVerdict,\n  DiscoverContainerDocumentsOptions,\n} from \"../documentDiscovery/documentDiscoveryTypes\";\n\ntype TombstoneGateStore = Pick<\n  DiscoverContainerDocumentsOptions,\n  | \"applyContainerDocumentTombstones\"\n  | \"holdContainerDocumentTombstones\"\n  | \"listHeldContainerDocumentTombstones\"\n  | \"listKnownContainerDocumentPlacements\"\n  | \"refuteContainerDocumentTombstoneHolds\"\n  | \"verifyContainerDocumentTombstones\"\n>;\n\nfunction dedupePlacements<T extends ContainerDocumentPlacement>(\n  placements: ReadonlyArray<T>,\n): T[] {\n  const seen = new Set<string>();\n  return placements.filter((placement) => {\n    const key = placementKey(placement);\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\n/**\n * One candidate per placement the device actually holds; the newest server\n * timestamp wins. A tombstone for a placement this device never had has\n * nothing to remove or hide, so its head is not fetched.\n */\nasync function mergeTombstoneCandidates(\n  store: TombstoneGateStore,\n  listed: ReadonlyArray<ContainerDocumentTombstone>,\n  held: ReadonlyArray<ContainerDocumentTombstone>,\n): Promise<ContainerDocumentTombstone[]> {\n  const known = new Set(\n    (await store.listKnownContainerDocumentPlacements(listed)).map(\n      placementKey,\n    ),\n  );\n  const byPlacement = new Map<string, ContainerDocumentTombstone>();\n  for (const tombstone of [\n    ...held,\n    ...listed.filter((tombstone) => known.has(placementKey(tombstone))),\n  ]) {\n    const key = placementKey(tombstone);\n    const current = byPlacement.get(key);\n    if (\n      !current ||\n      Date.parse(current.updatedAt) < Date.parse(tombstone.updatedAt)\n    ) {\n      byPlacement.set(key, tombstone);\n    }\n  }\n  return [...byPlacement.values()];\n}\n\nfunction assertVerdictsCoverCandidates(\n  candidates: ReadonlyArray<ContainerDocumentTombstone>,\n  verdicts: ReadonlyArray<ContainerDocumentTombstoneVerdict>,\n): void {\n  const verdictKeys = new Set(\n    verdicts.map((verdict) => placementKey(verdict.tombstone)),\n  );\n  if (\n    verdictKeys.size !== verdicts.length ||\n    verdictKeys.size !== candidates.length ||\n    candidates.some((candidate) => !verdictKeys.has(placementKey(candidate)))\n  ) {\n    throw new Error(\n      \"Container document tombstone verification must return one verdict per tombstone\",\n    );\n  }\n}\n\n/**\n * Apply a tombstone only when the signed head omits its container. Unavailable\n * heads leave hidden placements. A head that still links a container keeps its\n * placement visible, but retains a backed-off retry: even an uncached signed\n * head can lag the listing, so its refutation must not discard an honest move.\n * Listing items pass their own signed-head gate before reaching persistence.\n */\nexport async function settleContainerDocumentTombstones(input: {\n  containerIds: ReadonlyArray<string>;\n  store: TombstoneGateStore;\n  tombstones: ReadonlyArray<ContainerDocumentTombstone>;\n}): Promise<ReadonlyArray<DocumentSummary>> {\n  const { store } = input;\n  const held = await store.listHeldContainerDocumentTombstones(\n    input.containerIds,\n  );\n  const candidates = await mergeTombstoneCandidates(\n    store,\n    input.tombstones,\n    held,\n  );\n  if (candidates.length === 0) {\n    return [];\n  }\n\n  const verdicts = await store.verifyContainerDocumentTombstones(candidates);\n  assertVerdictsCoverCandidates(candidates, verdicts);\n  const verified = verdicts.flatMap((verdict) =>\n    verdict.kind === \"verified\" ? [verdict.tombstone] : [],\n  );\n  const refuted = verdicts.flatMap((verdict) =>\n    verdict.kind === \"refuted\" ? [verdict.tombstone] : [],\n  );\n  const unverified = verdicts.flatMap((verdict) =>\n    verdict.kind === \"unverified\" ? [verdict.tombstone] : [],\n  );\n  const deferred = verdicts.flatMap((verdict) =>\n    verdict.kind === \"deferred\"\n      ? [{ ...verdict.tombstone, deferred: true }]\n      : [],\n  );\n  // A loaded head is evidence for every placement it links, including holds\n  // on this document that were not due this run: make them visible while\n  // retaining each retry, since the head may lag any of those tombstones.\n  const headLinkedPlacements = verdicts.flatMap((verdict) => {\n    if (verdict.kind !== \"verified\" && verdict.kind !== \"refuted\") return [];\n    const linked =\n      verdict.kind === \"verified\"\n        ? verdict.tombstone.linkedContainerIds\n        : verdict.linkedContainerIds;\n    return linked.map((containerId) => ({\n      containerId,\n      documentId: verdict.tombstone.documentId,\n    }));\n  });\n\n  const summaries =\n    verified.length > 0\n      ? await store.applyContainerDocumentTombstones(verified)\n      : [];\n  const retryKeys = new Set(refuted.map(placementKey));\n  const visibleRetries = dedupePlacements(headLinkedPlacements).filter(\n    (placement) => !retryKeys.has(placementKey(placement)),\n  );\n  if (visibleRetries.length > 0) {\n    await store.refuteContainerDocumentTombstoneHolds(visibleRetries);\n  }\n  const retries = [\n    ...unverified,\n    ...deferred,\n    ...refuted.map((tombstone) => ({ ...tombstone, refuted: true })),\n  ];\n  if (retries.length > 0) await store.holdContainerDocumentTombstones(retries);\n  return summaries;\n}\n"]}

package/workflows/containers/child/currentShareGrantMutation.js

@@ -1,9 +1,9 @@
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { commitCurrentGroupPolicyMutation } from "../../organizations/commitCurrentGroupPolicyMutation.js";
-import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
-import { buildSetGroupContainerGrantPolicyRequest } from "../../organizations/groupPolicyRequests.js";
-import { preparePrincipalContainerRematerializationBatch, } from "../../organizations/principalContainerRematerialization.js";
-import { groupPolicyNameMismatch } from "../../organizations/principalPolicyRequest.js";
+import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { commitCurrentGroupPolicyMutation } from "../../organizations/groupPolicy/commitCurrentGroupPolicyMutation.js";
+import { buildSetGroupContainerGrantPolicyRequest } from "../../organizations/groupPolicy/groupPolicyRequests.js";
+import { groupPolicyNameMismatch } from "../../organizations/principalPolicy/principalPolicyRequest.js";
+import { preparePrincipalContainerRematerializationBatch, } from "../../organizations/rematerialization/principalContainerRematerialization.js";
 import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
 /** Fresh mutation authority rechecks the chosen name before authoring a grant. */
 export async function commitCurrentShareGrant(input) {

package/workflows/containers/child/currentShareGrantMutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAEL,+CAA+C,GAChD,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAOrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../organizations/commitCurrentGroupPolicyMutation\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../organizations/groupPolicyRequests\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../organizations/principalContainerRematerialization\";\nimport { groupPolicyNameMismatch } from \"../../organizations/principalPolicyRequest\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../organizations/runtimeCurrentGroupMutation\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./share\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}
+{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AACpH,OAAO,EAAE,wCAAwC,EAAE,MAAM,qDAAqD,CAAC;AAK/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4DAA4D,CAAC;AACrG,OAAO,EAEL,+CAA+C,GAChD,MAAM,2EAA2E,CAAC;AAGnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { commitCurrentGroupPolicyMutation } from \"../../organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../organizations/groupPolicy/groupPolicyRequests\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport { groupPolicyNameMismatch } from \"../../organizations/principalPolicy/principalPolicyRequest\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../organizations/rematerialization/principalContainerRematerialization\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./share\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}

package/workflows/containers/child/currentSharePrincipalPolicy.js

@@ -2,12 +2,12 @@ import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
 import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
 import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
-import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../organizations/currentGroupMetadataAuthority.js";
 import { loadCurrentOrganizationAuthority } from "../../organizations/currentOrganizationAuthority.js";
-import { createCurrentPrincipalMutationLease } from "../../organizations/currentPrincipalMutationLease.js";
-import { assertGroupMetadataBinding } from "../../organizations/groupMetadataBinding.js";
-import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
-import { groupPolicyNameMismatch, } from "../../organizations/principalPolicyRequest.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../organizations/groupMetadata/currentGroupMetadataAuthority.js";
+import { assertGroupMetadataBinding } from "../../organizations/groupMetadata/groupMetadataBinding.js";
+import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { createCurrentPrincipalMutationLease } from "../../organizations/principalMutations/currentPrincipalMutationLease.js";
+import { groupPolicyNameMismatch, } from "../../organizations/principalPolicy/principalPolicyRequest.js";
 import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
 /** A share read need not be a group administrator; minting a grant checks that separately. */
 export function createRuntimeCurrentSharePrincipalPolicy(runtime) {

package/workflows/containers/child/currentSharePrincipalPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentSharePrincipalPolicy.js","sourceRoot":"","sources":["currentSharePrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,mDAAmD,EAAE,MAAM,mDAAmD,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EAEL,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAoCrE,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA4B;IAE5B,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAwB,EACxB,IAAyD,EAC7C,EAAE;QACd,KAAK,GAAG;YACN,GAAG,KAAK;YACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBACxC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE;gBAChC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7D,MAAM,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACvD,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,oBAAoB;gBACpB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,CAAC,iBAAiB;gBACvB,CAAC,6BAA6B,CAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAClB,KAAK,CAAC,iBAAiB,CACxB;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;YACJ,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,SAAS;gBACT,KAAK;gBACL,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,SAAS,EACT,KAAK,EACL,YAAY,GAOb;IACC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB;QACvB,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,YAAY,EACZ,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,QAAQ,KAAK,sBAAsB;YACjC,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,mEAAmE,CACxE,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../organizations/currentGroupMetadataAuthority\";\nimport { loadCurrentOrganizationAuthority } from \"../../organizations/currentOrganizationAuthority\";\nimport { createCurrentPrincipalMutationLease } from \"../../organizations/currentPrincipalMutationLease\";\nimport { assertGroupMetadataBinding } from \"../../organizations/groupMetadataBinding\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport type { PrincipalMutationRecoveryApi } from \"../../organizations/principalMutationJournalManagement\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../organizations/principalPolicyRequest\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\ntype CurrentShareRuntime = Parameters<\n  typeof createRuntimeGroupMetadataAccess\n>[0] &\n  Parameters<typeof createCurrentPrincipalMutationLease>[0] & {\n    readonly apiClient: {\n      readonly recoverPendingPrincipalMutation?:\n        | PrincipalMutationRecoveryApi[\"recoverPendingPrincipalMutation\"]\n        | undefined;\n    };\n  };\n\ninterface CurrentShareInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  readonly expectedGroupName?: string | undefined;\n  /** Trusted internal reader; it must authenticate the signed metadata container. */\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\ntype CurrentGroup = Awaited<\n  ReturnType<\n    Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>[\"readGroup\"]\n  >\n>;\n\nexport interface CurrentSharePrincipalPolicy {\n  readonly current: CurrentGroup[\"current\"];\n  readonly policy: CurrentGroup[\"policy\"];\n  readonly checkpointPolicies: readonly CurrentGroup[\"policy\"][];\n  readonly stillCurrent: () => boolean;\n}\n\n/** A share read need not be a group administrator; minting a grant checks that separately. */\nexport function createRuntimeCurrentSharePrincipalPolicy(\n  runtime: CurrentShareRuntime,\n) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: CurrentShareInput,\n    work: (policy: CurrentSharePrincipalPolicy) => Promise<T>,\n  ): Promise<T> => {\n    input = {\n      ...input,\n      expectedGroupHead: input.expectedGroupHead\n        ? { ...input.expectedGroupHead }\n        : undefined,\n    };\n    return lease(\n      input.stillCurrent,\n      async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {\n        await runtime.apiClient.recoverPendingPrincipalMutation?.(\n          input.organizationId,\n        );\n        assertProjectionVerificationCurrent(leaseCurrent);\n        const authority = await loadCurrentOrganizationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          resolveCurrentPolicy,\n          stillCurrent: leaseCurrent,\n        });\n        const group = await authority.readGroup(input.groupId);\n        const stillCurrent = () =>\n          leaseCurrent() && authority.stillCurrent() && group.stillCurrent();\n        assertProjectionVerificationCurrent(stillCurrent);\n        if (\n          input.expectedGroupHead &&\n          !principalHeadMatchesReference(\n            group.policy.state,\n            input.expectedGroupHead,\n          )\n        )\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Container share expected group head conflicts with the signed organization directory\",\n          );\n        assertGroupMetadataBinding(group.current, authority.descriptor);\n        await assertCurrentShareName({\n          runtime,\n          input,\n          authority,\n          group,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const checkpointPolicies = [...group.dependencies, group.policy];\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          policies: checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          current: group.current,\n          policy: group.policy,\n          checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function assertCurrentShareName({\n  runtime,\n  input,\n  authority,\n  group,\n  stillCurrent,\n}: {\n  runtime: CurrentShareRuntime;\n  input: CurrentShareInput;\n  authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n  group: CurrentGroup;\n  stillCurrent: () => boolean;\n}) {\n  if (input.expectedGroupName === undefined) return;\n  const readName =\n    input.readEncryptedName ??\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      input.organizationId,\n      stillCurrent,\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    ).readName;\n  const mismatch = await groupPolicyNameMismatch(\n    group.current,\n    input.expectedGroupName,\n    readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      mismatch === \"forbidden_characters\"\n        ? \"Container share group name contains control or format characters\"\n        : \"Container share group name does not match the signed group policy\",\n    );\n}\n"]}
+{"version":3,"file":"currentSharePrincipalPolicy.js","sourceRoot":"","sources":["currentSharePrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,mDAAmD,EAAE,MAAM,iEAAiE,CAAC;AACtI,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,mCAAmC,EAAE,MAAM,sEAAsE,CAAC;AAE3H,OAAO,EAEL,uBAAuB,GACxB,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAoCrE,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA4B;IAE5B,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAwB,EACxB,IAAyD,EAC7C,EAAE;QACd,KAAK,GAAG;YACN,GAAG,KAAK;YACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBACxC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE;gBAChC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7D,MAAM,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACvD,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,oBAAoB;gBACpB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,CAAC,iBAAiB;gBACvB,CAAC,6BAA6B,CAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAClB,KAAK,CAAC,iBAAiB,CACxB;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;YACJ,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,SAAS;gBACT,KAAK;gBACL,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,SAAS,EACT,KAAK,EACL,YAAY,GAOb;IACC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB;QACvB,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,YAAY,EACZ,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,QAAQ,KAAK,sBAAsB;YACjC,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,mEAAmE,CACxE,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"../../organizations/currentOrganizationAuthority\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../organizations/groupMetadata/currentGroupMetadataAuthority\";\nimport { assertGroupMetadataBinding } from \"../../organizations/groupMetadata/groupMetadataBinding\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createCurrentPrincipalMutationLease } from \"../../organizations/principalMutations/currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"../../organizations/principalMutations/principalMutationJournalManagement\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../organizations/principalPolicy/principalPolicyRequest\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\ntype CurrentShareRuntime = Parameters<\n  typeof createRuntimeGroupMetadataAccess\n>[0] &\n  Parameters<typeof createCurrentPrincipalMutationLease>[0] & {\n    readonly apiClient: {\n      readonly recoverPendingPrincipalMutation?:\n        | PrincipalMutationRecoveryApi[\"recoverPendingPrincipalMutation\"]\n        | undefined;\n    };\n  };\n\ninterface CurrentShareInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  readonly expectedGroupName?: string | undefined;\n  /** Trusted internal reader; it must authenticate the signed metadata container. */\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\ntype CurrentGroup = Awaited<\n  ReturnType<\n    Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>[\"readGroup\"]\n  >\n>;\n\nexport interface CurrentSharePrincipalPolicy {\n  readonly current: CurrentGroup[\"current\"];\n  readonly policy: CurrentGroup[\"policy\"];\n  readonly checkpointPolicies: readonly CurrentGroup[\"policy\"][];\n  readonly stillCurrent: () => boolean;\n}\n\n/** A share read need not be a group administrator; minting a grant checks that separately. */\nexport function createRuntimeCurrentSharePrincipalPolicy(\n  runtime: CurrentShareRuntime,\n) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: CurrentShareInput,\n    work: (policy: CurrentSharePrincipalPolicy) => Promise<T>,\n  ): Promise<T> => {\n    input = {\n      ...input,\n      expectedGroupHead: input.expectedGroupHead\n        ? { ...input.expectedGroupHead }\n        : undefined,\n    };\n    return lease(\n      input.stillCurrent,\n      async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {\n        await runtime.apiClient.recoverPendingPrincipalMutation?.(\n          input.organizationId,\n        );\n        assertProjectionVerificationCurrent(leaseCurrent);\n        const authority = await loadCurrentOrganizationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          resolveCurrentPolicy,\n          stillCurrent: leaseCurrent,\n        });\n        const group = await authority.readGroup(input.groupId);\n        const stillCurrent = () =>\n          leaseCurrent() && authority.stillCurrent() && group.stillCurrent();\n        assertProjectionVerificationCurrent(stillCurrent);\n        if (\n          input.expectedGroupHead &&\n          !principalHeadMatchesReference(\n            group.policy.state,\n            input.expectedGroupHead,\n          )\n        )\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Container share expected group head conflicts with the signed organization directory\",\n          );\n        assertGroupMetadataBinding(group.current, authority.descriptor);\n        await assertCurrentShareName({\n          runtime,\n          input,\n          authority,\n          group,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const checkpointPolicies = [...group.dependencies, group.policy];\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          policies: checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          current: group.current,\n          policy: group.policy,\n          checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function assertCurrentShareName({\n  runtime,\n  input,\n  authority,\n  group,\n  stillCurrent,\n}: {\n  runtime: CurrentShareRuntime;\n  input: CurrentShareInput;\n  authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n  group: CurrentGroup;\n  stillCurrent: () => boolean;\n}) {\n  if (input.expectedGroupName === undefined) return;\n  const readName =\n    input.readEncryptedName ??\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      input.organizationId,\n      stillCurrent,\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    ).readName;\n  const mismatch = await groupPolicyNameMismatch(\n    group.current,\n    input.expectedGroupName,\n    readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      mismatch === \"forbidden_characters\"\n        ? \"Container share group name contains control or format characters\"\n        : \"Container share group name does not match the signed group policy\",\n    );\n}\n"]}

package/workflows/containers/child/runtimeCurrentGroupShare.js

@@ -1,7 +1,7 @@
 import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
 import { inheritPrincipalHistoryProtection } from "../../../data/principals/principalHistoryRuntime.js";
-import { createRuntimeCurrentGroupMutation } from "../../organizations/runtimeCurrentGroupMutation.js";
+import { createRuntimeCurrentGroupMutation } from "../../organizations/principalMutations/runtimeCurrentGroupMutation.js";
 import { apiPrincipalPolicyPageReader, apiProjectionPolicyHistoryReader, } from "../../principals/principalPolicyHistoryReader.js";
 import { commitCurrentShareGrant } from "./currentShareGrantMutation.js";
 import { createRuntimeCurrentSharePrincipalPolicy } from "./currentSharePrincipalPolicy.js";

package/workflows/containers/child/runtimeCurrentGroupShare.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeCurrentGroupShare.js","sourceRoot":"","sources":["runtimeCurrentGroupShare.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uCAAuC,EAAE,MAAM,iEAAiE,CAAC;AAC1H,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iDAAiD,CAAC;AACpG,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,UAAU,8BAA8B,CAC5C,OAAuE;IAEvE,MAAM,WAAW,GAAG,wCAAwC,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,iCAAiC,CAC9C,iCAAiC,CAAC,OAAO,EAAE;QACzC,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,aAAa;YAChB,GAAG,gCAAgC,CAAC,GAAG,CAAC;YACxC,+BAA+B,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;gBAChE,oEAAoE;gBACpE,2DAA2D;gBAC3D,MAAM,GAAG,CAAC,+BAA+B,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;SACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,sBAAsB,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,WAAW,CACT;YACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;YACvD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3D,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACnD,OAAO,uBAAuB,CAAC;oBAC7B,OAAO;oBACP,KAAK;oBACL,MAAM;oBACN,sBAAsB;iBACvB,CAAC,CAAC;YACL,MAAM,YAAY,GAAG,MAAM,mCAAmC,CAAC;gBAC7D,GAAG,KAAK;gBACR,kBAAkB;gBAClB,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;gBAC7D,SAAS,EAAE;oBACT,eAAe,EAAE,MAAM;oBACvB,SAAS,EAAE,KAAK,CAAC,gBAAgB;oBACjC,WAAW,EAAE,OAAO;iBACrB;gBACD,wBAAwB;aACzB,CAAC,CAAC;YACH,OAAO,mCAAmC,CAAC;gBACzC,GAAG,KAAK;gBACR,kBAAkB,EAAE,kBAAkB;gBACtC,sBAAsB;gBACtB,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,YAAY,CAAC,IAAI,CAAC,OAAO,EACzB;oBACE,qCAAqC,EACnC,KAAK,CAAC,MAAM,CAAC,cAAc;iBAC9B,CACF,CACF;aACJ,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { inheritPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryRuntime\";\nimport { createRuntimeCurrentGroupMutation } from \"../../organizations/runtimeCurrentGroupMutation\";\nimport {\n  apiPrincipalPolicyPageReader,\n  apiProjectionPolicyHistoryReader,\n} from \"../../principals/principalPolicyHistoryReader\";\nimport { commitCurrentShareGrant } from \"./currentShareGrantMutation\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"./mutationSubmit\";\nimport type { shareRemoteContainerWithGroup } from \"./share\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\n/** Current evidence covers planning, any compound grant mint, and acknowledgement. */\nexport function createRuntimeCurrentGroupShare(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n): typeof shareRemoteContainerWithGroup | undefined {\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(runtime);\n  const api = runtime.apiClient;\n  const historyReader = apiPrincipalPolicyPageReader(api);\n  if (!readCurrent || !historyReader) return undefined;\n  const mutate = createRuntimeCurrentGroupMutation(\n    inheritPrincipalHistoryProtection(runtime, {\n      ...runtime,\n      apiClient: {\n        ...historyReader,\n        ...apiProjectionPolicyHistoryReader(api),\n        recoverPendingPrincipalMutation: async (organizationId: string) => {\n          // Built-in clients supply journal recovery; standalone hosts retain\n          // responsibility for transport and exact-outcome recovery.\n          await api.recoverPendingPrincipalMutation?.(organizationId);\n        },\n      },\n    }),\n  );\n  if (!mutate) throw new Error(\"Current group mutation custody is unavailable\");\n  return async (input) => {\n    if (input.stillCurrent?.() === false) return null;\n    const recitationStillCurrent = input.stillCurrent ?? (() => true);\n    return nullOnProjectionVerificationCancellation(() =>\n      readCurrent(\n        {\n          expectedGroupName: input.expectedGroupName ?? undefined,\n          groupId: input.recipientGroupId,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        },\n        async ({ policy, checkpointPolicies, stillCurrent }) => {\n          const share = { ...input, stillCurrent };\n          const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n            input.resolveProjectionUserKey,\n            \"Remote container share\",\n          );\n          const previousProjection = await resolveShareProjection(\n            share,\n            resolveProjectionUserKey,\n          );\n          if (!previousProjection) return null;\n          const grant = policy.grants.find(\n            (candidate) => candidate.containerId === input.containerId,\n          );\n          if (!grant || grant.accessLevel !== input.accessLevel)\n            return commitCurrentShareGrant({\n              runtime,\n              share,\n              mutate,\n              recitationStillCurrent,\n            });\n          const materialized = await buildMaterializedContainerSharePlan({\n            ...share,\n            previousProjection,\n            principalPolicyCache:\n              principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n            recipient: {\n              principalPolicy: policy,\n              subjectId: input.recipientGroupId,\n              subjectType: \"group\",\n            },\n            resolveProjectionUserKey,\n          });\n          return submitAcknowledgedContainerMutation({\n            ...share,\n            recitationPolicies: checkpointPolicies,\n            recitationStillCurrent,\n            containerKey: materialized.containerKey,\n            plan: materialized.plan,\n            submit: () =>\n              submitPlainContainerMutation(() =>\n                input.apiClient.shareContainer(\n                  input.containerId,\n                  materialized.plan.request,\n                  {\n                    expectedPaymentRequiredOrganizationId:\n                      input.author.organizationId,\n                  },\n                ),\n              ),\n          });\n        },\n      ),\n    );\n  };\n}\n"]}
+{"version":3,"file":"runtimeCurrentGroupShare.js","sourceRoot":"","sources":["runtimeCurrentGroupShare.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uCAAuC,EAAE,MAAM,iEAAiE,CAAC;AAC1H,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,oEAAoE,CAAC;AACvH,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,UAAU,8BAA8B,CAC5C,OAAuE;IAEvE,MAAM,WAAW,GAAG,wCAAwC,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,iCAAiC,CAC9C,iCAAiC,CAAC,OAAO,EAAE;QACzC,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,aAAa;YAChB,GAAG,gCAAgC,CAAC,GAAG,CAAC;YACxC,+BAA+B,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;gBAChE,oEAAoE;gBACpE,2DAA2D;gBAC3D,MAAM,GAAG,CAAC,+BAA+B,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;SACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,sBAAsB,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,WAAW,CACT;YACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;YACvD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3D,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACnD,OAAO,uBAAuB,CAAC;oBAC7B,OAAO;oBACP,KAAK;oBACL,MAAM;oBACN,sBAAsB;iBACvB,CAAC,CAAC;YACL,MAAM,YAAY,GAAG,MAAM,mCAAmC,CAAC;gBAC7D,GAAG,KAAK;gBACR,kBAAkB;gBAClB,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;gBAC7D,SAAS,EAAE;oBACT,eAAe,EAAE,MAAM;oBACvB,SAAS,EAAE,KAAK,CAAC,gBAAgB;oBACjC,WAAW,EAAE,OAAO;iBACrB;gBACD,wBAAwB;aACzB,CAAC,CAAC;YACH,OAAO,mCAAmC,CAAC;gBACzC,GAAG,KAAK;gBACR,kBAAkB,EAAE,kBAAkB;gBACtC,sBAAsB;gBACtB,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,YAAY,CAAC,IAAI,CAAC,OAAO,EACzB;oBACE,qCAAqC,EACnC,KAAK,CAAC,MAAM,CAAC,cAAc;iBAC9B,CACF,CACF;aACJ,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { inheritPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryRuntime\";\nimport { createRuntimeCurrentGroupMutation } from \"../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport {\n  apiPrincipalPolicyPageReader,\n  apiProjectionPolicyHistoryReader,\n} from \"../../principals/principalPolicyHistoryReader\";\nimport { commitCurrentShareGrant } from \"./currentShareGrantMutation\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"./mutationSubmit\";\nimport type { shareRemoteContainerWithGroup } from \"./share\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\n/** Current evidence covers planning, any compound grant mint, and acknowledgement. */\nexport function createRuntimeCurrentGroupShare(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n): typeof shareRemoteContainerWithGroup | undefined {\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(runtime);\n  const api = runtime.apiClient;\n  const historyReader = apiPrincipalPolicyPageReader(api);\n  if (!readCurrent || !historyReader) return undefined;\n  const mutate = createRuntimeCurrentGroupMutation(\n    inheritPrincipalHistoryProtection(runtime, {\n      ...runtime,\n      apiClient: {\n        ...historyReader,\n        ...apiProjectionPolicyHistoryReader(api),\n        recoverPendingPrincipalMutation: async (organizationId: string) => {\n          // Built-in clients supply journal recovery; standalone hosts retain\n          // responsibility for transport and exact-outcome recovery.\n          await api.recoverPendingPrincipalMutation?.(organizationId);\n        },\n      },\n    }),\n  );\n  if (!mutate) throw new Error(\"Current group mutation custody is unavailable\");\n  return async (input) => {\n    if (input.stillCurrent?.() === false) return null;\n    const recitationStillCurrent = input.stillCurrent ?? (() => true);\n    return nullOnProjectionVerificationCancellation(() =>\n      readCurrent(\n        {\n          expectedGroupName: input.expectedGroupName ?? undefined,\n          groupId: input.recipientGroupId,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        },\n        async ({ policy, checkpointPolicies, stillCurrent }) => {\n          const share = { ...input, stillCurrent };\n          const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n            input.resolveProjectionUserKey,\n            \"Remote container share\",\n          );\n          const previousProjection = await resolveShareProjection(\n            share,\n            resolveProjectionUserKey,\n          );\n          if (!previousProjection) return null;\n          const grant = policy.grants.find(\n            (candidate) => candidate.containerId === input.containerId,\n          );\n          if (!grant || grant.accessLevel !== input.accessLevel)\n            return commitCurrentShareGrant({\n              runtime,\n              share,\n              mutate,\n              recitationStillCurrent,\n            });\n          const materialized = await buildMaterializedContainerSharePlan({\n            ...share,\n            previousProjection,\n            principalPolicyCache:\n              principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n            recipient: {\n              principalPolicy: policy,\n              subjectId: input.recipientGroupId,\n              subjectType: \"group\",\n            },\n            resolveProjectionUserKey,\n          });\n          return submitAcknowledgedContainerMutation({\n            ...share,\n            recitationPolicies: checkpointPolicies,\n            recitationStillCurrent,\n            containerKey: materialized.containerKey,\n            plan: materialized.plan,\n            submit: () =>\n              submitPlainContainerMutation(() =>\n                input.apiClient.shareContainer(\n                  input.containerId,\n                  materialized.plan.request,\n                  {\n                    expectedPaymentRequiredOrganizationId:\n                      input.author.organizationId,\n                  },\n                ),\n              ),\n          });\n        },\n      ),\n    );\n  };\n}\n"]}

package/workflows/containers/child/share.d.ts

@@ -5,7 +5,7 @@ import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer }
 import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import { type TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
-import type { GroupPolicyNameReader } from "../../organizations/principalPolicyRequest.js";
+import type { GroupPolicyNameReader } from "../../organizations/principalPolicy/principalPolicyRequest.js";
 import { type ContainerManagedPrincipalShareApi } from "./sharePrincipalPolicy.js";
 export declare function shareRemoteContainer(input: {
     reportSecurityIncident: SecurityIncidentReporter;

package/workflows/containers/child/share.js

@@ -2,10 +2,10 @@ import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCan
 import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
 import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
 import { requireTrustedUserIdentityResolver, } from "../../../data/trustedUserIdentity/index.js";
-import { createGroupMetadataAccess } from "../../organizations/groupMetadataAccess.js";
-import { createGroupMetadataContainerVerifier } from "../../organizations/groupMetadataContainerAuthority.js";
-import { preparePrincipalContainerRematerializationBatch } from "../../organizations/principalContainerRematerialization.js";
-import { setOrganizationGroupContainerGrant } from "../../organizations/principalPolicy.js";
+import { createGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataAccess.js";
+import { createGroupMetadataContainerVerifier } from "../../organizations/groupMetadata/groupMetadataContainerAuthority.js";
+import { setOrganizationGroupContainerGrant } from "../../organizations/principalPolicy/index.js";
+import { preparePrincipalContainerRematerializationBatch } from "../../organizations/rematerialization/principalContainerRematerialization.js";
 import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "./mutationSubmit.js";
 import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
 import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "./sharePrincipalPolicy.js";