npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1588) hide show

package/workflows/container-contents/container-state/purge/purgeTreeScope.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"purgeTreeScope.js","sourceRoot":"","sources":["purgeTreeScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,yFAAyF,CAAC;AAC1I,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,sCAAsC,EAAE,MAAM,qDAAqD,CAAC;AAC7G,OAAO,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAI7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAW5D,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,OAAqD,EACrD,qBAAqD;IAErD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACtC,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,uBAAuB;KACnC,EACD,KAAK,IAAI,EAAE;QACT,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,UAAU,GACd,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IACE,UAAU,CAAC,WAAW,KAAK,QAAQ;YACnC,UAAU,CAAC,cAAc,KAAK,OAAO,CAAC,SAAS,CAAC,cAAc,EAC9D,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC;YACjD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,eAAe,CACrD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,QAAQ,CACT,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,SAAS,IAAI,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,iBAAiB;gBACtC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ;YAC/D,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ;YACzD,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU;YACvD,CAAC,IAAI;iBACF,KAAK,CAAC,SAAS,CAAC;iBAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3D,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACnC,IAAI,OAAO;YACT,qBAAqB,CAAC,GAAG,CACvB,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5D,CAAC;QACJ,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAA6B,EAC7B,qBAAqD;IAErD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1E,OAAO,IAAI,CAAC;IACd,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA6B,EAC7B,WAAmB,EACnB,qBAAqD,EACrD,aAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,GAAkB,WAAW,CAAC;IAC3C,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,OAAO,SAAS,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,0BAA0B,CAC1D,OAAO,EACP,SAAS,CACV,CAAC;QACF,IACE,CAAC,QAAQ;YACT,CAAC,OAAO,EAAE,MAAM;YAChB,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;YAC1D,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,cAAc;YACtE,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;YAExD,OAAO,KAAK,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC9B,IACE,CAAC,CAAC,MAAM,mBAAmB,CACzB,KAAK,EACL;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,EACD,qBAAqB,CACtB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzC,CAAC;IACD,IACE,aAAa;QACb,CAAC,sBAAsB;QACvB,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAE7D,OAAO,KAAK,CAAC;IACf,OAAO,mBAAmB,CAAC;QACzB,GAAG,KAAK;QACR,WAAW;QACX,OAAO;QACP,qBAAqB;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAA6B;IAC3D,OAAO,IAAI,GAAG,CACZ,CACE,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CACF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA6B,EAC7B,QAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,IAAI,MAAM,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChE,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnE,OAAO;QACL,6BAA6B,EAAE,CAAC,OAAgB,EAAE,WAAmB,EAAE,EAAE,CACvE,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,qBAAqB,CAAC;gBAC1B,GAAG,KAAK;gBACR,OAAO;gBACP,WAAW;gBACX,qBAAqB;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACJ,6BAA6B,EAAE,CAC7B,OAAgB,EAChB,WAAsC,EACtC,OAAe,EACf,EAAE,CACF,qBAAqB,CAAC;YACpB,GAAG,KAAK;YACR,OAAO;YACP,WAAW;YACX,OAAO;YACP,qBAAqB;SACtB,CAAC;QACJ,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC9B,eAAe,CACb,KAAK,EACL,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAC1D,CACF;QACH,cAAc,EAAE,CAAC,QAAyB,EAAE,EAAE,CAC5C,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,IACE,CAAC,QAAQ,CAAC,WAAW;gBACrB,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAEpD,OAAO,KAAK,CAAC;YACf,IACE,CAAC,CAAC,MAAM,eAAe,CACrB,KAAK,EACL,QAAQ,CAAC,WAAW,EACpB,qBAAqB,EACrB,CAAC,QAAQ,CAAC,UAAU,CACrB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,wEAAwE;YACxE,OAAO,mBAAmB,CACxB;gBACE,GAAG,KAAK;gBACR,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACpB,qBAAqB;aACtB,EACD,QAAQ,CACT,CAAC;QACJ,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,gDAAgD,YAAY,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { verifyContainerWriterProjection } from \"../../../../data/keyingProjectionVerification/container/containerProjectionVerification\";\nimport { runWithSecurityIncidentReporting } from \"../../../../data/keyingProjectionVerification/error\";\nimport { rethrowProjectionVerificationCancelled } from \"../../../../data/keyingProjectionVerification/types\";\nimport { hasUnsettledDocumentPlacement } from \"../../../../data/persistence/container-contents/documentPurgePlacement\";\nimport { sqlDocumentsPersistence } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport { errorMessage } from \"../../../../data/shared/errorMessage\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\nimport { snapshotContainerStates } from \"./purgeTreeCollection\";\nimport { readLocalPurgeScope } from \"./readLocalPurgeScope\";\n\ninterface SubtreePurgeScopeInput {\n containersById: ReadonlyMap<string, ContainerState>;\n persistence: ContainerContentsPersistence;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n rootContainerId: string;\n runtime: ContainerContentsWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function verifiedRemoteScope(\n input: SubtreePurgeScopeInput,\n current: Pick<ContainerState, \"container\" | \"record\">,\n verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n const { runtime, rootContainerId } = input;\n const targetId = current.container.id;\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: targetId,\n objectKind: \"container\",\n operation: \"container.purge.scope\",\n },\n async () => {\n runtime.apiClient.evictContainerWriterProjection(targetId);\n const projection =\n await runtime.apiClient.getContainerWriterProjection(targetId);\n if (!projection || input.stillCurrent?.() === false) return false;\n if (\n projection.containerId !== targetId ||\n projection.organizationId !== current.container.organizationId\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Subtree purge container identity mismatch\",\n );\n }\n const path = await verifyContainerWriterProjection({\n execSql: runtime.infra.execSql,\n projection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n });\n const rootIndex = path.findIndex(\n (head) => head.state.containerId === rootContainerId,\n );\n const latest = await input.persistence.loadContainerMetadataState(\n runtime.infra.execSql,\n targetId,\n );\n const pendingMoves = await readPendingMoves(input);\n const allowed =\n rootIndex >= 0 &&\n path[rootIndex]?.state.parentContainerId ===\n input.containersById.get(rootContainerId)?.container.parentId &&\n latest?.container.parentId === current.container.parentId &&\n latest.record?.documentId === current.record.documentId &&\n !path\n .slice(rootIndex)\n .some((head) => pendingMoves.has(head.state.containerId)) &&\n input.stillCurrent?.() !== false;\n if (allowed)\n verifiedAncestorsById.set(\n targetId,\n path.slice(rootIndex).map((head) => head.state.containerId),\n );\n return allowed;\n },\n );\n}\n\n/**\n * A local-only unit cites no signed request, so a remote ordinary root must\n * prove that it still sits under the parent it was selected from. A system\n * root's signed topology is fixed by its destination role.\n */\nasync function rootPlacementIsCurrent(\n input: SubtreePurgeScopeInput,\n verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n const root = input.containersById.get(input.rootContainerId);\n if (!root?.record.documentId || (root.container.systemSlot ?? null) !== null)\n return true;\n return verifiedRemoteScope(input, root, verifiedAncestorsById);\n}\n\nasync function allowsContainer(\n input: SubtreePurgeScopeInput,\n containerId: string,\n verifiedAncestorsById: Map<string, readonly string[]>,\n localOnlyUnit: boolean,\n): Promise<boolean> {\n const { runtime, persistence, rootContainerId } = input;\n if (input.stillCurrent?.() === false) return false;\n const execSql = runtime.infra.execSql;\n const pendingMoves = await readPendingMoves(input);\n if (pendingMoves.has(rootContainerId)) return false;\n const seen = new Set<string>([rootContainerId]);\n let currentId: string | null = containerId;\n let verifiedRemoteAncestry = false;\n while (currentId !== rootContainerId) {\n if (!currentId || seen.has(currentId) || pendingMoves.has(currentId))\n return false;\n seen.add(currentId);\n const expected = input.containersById.get(currentId);\n const current = await persistence.loadContainerMetadataState(\n execSql,\n currentId,\n );\n if (\n !expected ||\n !current?.record ||\n current.container.parentId !== expected.container.parentId ||\n current.container.organizationId !== expected.container.organizationId ||\n current.record.documentId !== expected.record.documentId\n )\n return false;\n if (current.record.documentId) {\n if (\n !(await verifiedRemoteScope(\n input,\n {\n container: current.container,\n record: current.record,\n },\n verifiedAncestorsById,\n ))\n )\n return false;\n verifiedRemoteAncestry = true;\n break;\n }\n currentId = current.container.parentId;\n }\n if (\n localOnlyUnit &&\n !verifiedRemoteAncestry &&\n !(await rootPlacementIsCurrent(input, verifiedAncestorsById))\n )\n return false;\n return readLocalPurgeScope({\n ...input,\n containerId,\n execSql,\n verifiedAncestorsById,\n });\n}\n\nasync function readPendingMoves(input: SubtreePurgeScopeInput) {\n return new Set(\n (\n await input.persistence.listUnsyncedMoveIntents(\n input.runtime.infra.execSql,\n )\n ).map((intent) => intent.containerId),\n );\n}\n\nasync function documentPlacementIsCurrent(\n input: SubtreePurgeScopeInput,\n document: DocumentSummary,\n): Promise<boolean> {\n const execSql = input.runtime.infra.execSql;\n if (await hasUnsettledDocumentPlacement(execSql, document.id)) return false;\n const current = await sqlDocumentsPersistence.loadDocument(\n execSql,\n document.id,\n );\n return (\n current !== null &&\n current.documentId === document.documentId &&\n current.containerId === document.containerId &&\n input.stillCurrent?.() !== false\n );\n}\n\n/** Listing edges only select candidates; each destructive unit proves its scope. */\nexport function createSubtreePurgeScope(request: SubtreePurgeScopeInput) {\n const input = {\n ...request,\n containersById: snapshotContainerStates(request.containersById),\n };\n const verifiedAncestorsById = new Map<string, readonly string[]>();\n return {\n allowsLocalScopeInTransaction: (execSql: ExecSql, containerId: string) =>\n checkAvailableScope(input, async () => {\n await assertLocalPurgeScope({\n ...input,\n execSql,\n containerId,\n verifiedAncestorsById,\n });\n return true;\n }),\n assertLocalScopeInTransaction: (\n execSql: ExecSql,\n containerId: string | null | undefined,\n localId: string,\n ) =>\n assertLocalPurgeScope({\n ...input,\n execSql,\n containerId,\n localId,\n verifiedAncestorsById,\n }),\n allowsContainer: (containerId: string) =>\n checkAvailableScope(input, () =>\n allowsContainer(\n input,\n containerId,\n verifiedAncestorsById,\n !input.containersById.get(containerId)?.record.documentId,\n ),\n ),\n allowsDocument: (document: DocumentSummary) =>\n checkAvailableScope(input, async () => {\n if (\n !document.containerId ||\n !(await documentPlacementIsCurrent(input, document))\n )\n return false;\n if (\n !(await allowsContainer(\n input,\n document.containerId,\n verifiedAncestorsById,\n !document.documentId,\n ))\n )\n return false;\n // Freeze local placement checks together after all remote verification.\n return readLocalPurgeScope(\n {\n ...input,\n containerId: document.containerId,\n execSql: input.runtime.infra.execSql,\n localId: document.id,\n verifiedAncestorsById,\n },\n document,\n );\n }),\n };\n}\n\nasync function checkAvailableScope(\n input: SubtreePurgeScopeInput,\n check: () => Promise<boolean>,\n): Promise<boolean> {\n try {\n return await check();\n } catch (error) {\n rethrowProjectionVerificationCancelled(error);\n if (error instanceof KeyingVerificationError) throw error;\n input.runtime.util.log(\n `Container contents: purge scope unavailable: ${errorMessage(error)}`,\n );\n return false;\n }\n}\n"]}

package/workflows/container-contents/container-state/purge/readLocalPurgeScope.js ADDED Viewed

@@ -0,0 +1,18 @@
+import { sqlDocumentsPersistence } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { getClientSQLitePersistenceRuntime } from "../../../../data/sqlite/sqlitePersistenceRuntime.js";
+import { runSerializedSqlMutation } from "../../../../data/sqlite/sqlSchema.js";
+import { assertLocalPurgeScope } from "./localPurgeScope.js";
+/** Final local scope check before HTTP dispatch, with no remote I/O under lock. */
+export function readLocalPurgeScope(input, document) {
+    return runSerializedSqlMutation(input.execSql, async (lockedExecSql) => getClientSQLitePersistenceRuntime(lockedExecSql).transaction(async () => {
+        await assertLocalPurgeScope({ ...input, execSql: lockedExecSql });
+        if (!document)
+            return true;
+        const current = await sqlDocumentsPersistence.loadDocument(lockedExecSql, document.id);
+        return (current !== null &&
+            current.documentId === document.documentId &&
+            current.containerId === document.containerId &&
+            input.stillCurrent?.() !== false);
+    }, { behavior: "immediate" }));
+}
+//# sourceMappingURL=readLocalPurgeScope.js.map

package/workflows/container-contents/container-state/purge/readLocalPurgeScope.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"readLocalPurgeScope.js","sourceRoot":"","sources":["readLocalPurgeScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,KAAkD,EAClD,QAA0B;IAE1B,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CACrE,iCAAiC,CAAC,aAAa,CAAC,CAAC,WAAW,CAC1D,KAAK,IAAI,EAAE;QACT,MAAM,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,aAAa,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,CACL,OAAO,KAAK,IAAI;YAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;IACJ,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport { sqlDocumentsPersistence } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../../../data/sqlite/sqlitePersistenceRuntime\";\nimport { runSerializedSqlMutation } from \"../../../../data/sqlite/sqlSchema\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\n\n/** Final local scope check before HTTP dispatch, with no remote I/O under lock. */\nexport function readLocalPurgeScope(\n input: Parameters<typeof assertLocalPurgeScope>[0],\n document?: DocumentSummary,\n): Promise<boolean> {\n return runSerializedSqlMutation(input.execSql, async (lockedExecSql) =>\n getClientSQLitePersistenceRuntime(lockedExecSql).transaction(\n async () => {\n await assertLocalPurgeScope({ ...input, execSql: lockedExecSql });\n if (!document) return true;\n const current = await sqlDocumentsPersistence.loadDocument(\n lockedExecSql,\n document.id,\n );\n return (\n current !== null &&\n current.documentId === document.documentId &&\n current.containerId === document.containerId &&\n input.stillCurrent?.() !== false\n );\n },\n { behavior: \"immediate\" },\n ),\n );\n}\n"]}

package/workflows/container-contents/container-state/remote.js CHANGED Viewed

@@ -1,11 +1,11 @@
 import { isContainerNotFoundFailure } from "../../../data/containers/shared/mutationFailures.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { moveRemoteContainer as moveRemoteContainerMutation, readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, shareRemoteContainer as shareRemoteContainerMutation, } from "../../containers/index.js";
-import { createRuntimeCurrentGroupShare } from "../../containers/child/runtimeCurrentGroupShare.js";
+import { createRuntimeCurrentGroupShare } from "../../containers/child/share/runtimeCurrentGroupShare.js";
 import { resolveDocumentCreateAuthor } from "../../documents/index.js";
-import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadataRuntime.js";
+import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataRuntime.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { createRemoteContainerWithMetadataDocument, } from "./createWithMetadata.js";
+import { createRemoteContainerWithMetadataDocument, } from "./create/createWithMetadata.js";
 /**
  * Resolve the author, api client, executor, and encapsulation secret a remote
  * container mutation needs, logging a skip for the given operation when the

package/workflows/container-contents/container-state/remote.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,uCAAuC,EACvC,qDAAqD,EACrD,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sBAAsB,CAAC;AAQ9B;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC9C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,oBAAoB,EAAE,OAAO;QAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,kBAAkB,EAAE,uCAAuC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;QACtD,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY;QACjE,4BAA4B,EAC1B,qDAAqD,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACJ,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n ContainerMutationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n moveRemoteContainer as moveRemoteContainerMutation,\n readContainerMutationMetadataDocumentId,\n referencedPrincipalHeadsFromContainerMutationResponse,\n shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n type ContainerAlreadyCommitted,\n createRemoteContainerWithMetadataDocument,\n} from \"./createWithMetadata\";\nimport type {\n ContainerWorkflowRuntime,\n CreatedRemoteContainerState,\n RemoteContainer,\n SharedRemoteContainerState,\n} from \"./types\";\n\n/*\n Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n runtime: ContainerWorkflowRuntime,\n operation:\n \| \"container create\"\n \| \"container group share\"\n \| \"container move\"\n \| \"container share\",\n) {\n const author = resolveDocumentCreateAuthor(runtime);\n const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !secretKey) {\n runtime.util.log(\n `Container contents: skipped ${operation} because the writer context is unavailable.`,\n );\n return null;\n }\n\n return {\n apiClient: runtime.apiClient,\n author,\n execSql: runtime.infra.execSql,\n secretKey,\n };\n}\n\nexport async function createRemoteContainer(input: {\n systemSlot?: ContainerSystemSlot \| null \| undefined;\n containerId: string;\n parentContainerId: string;\n parentProjection?: ContainerWriterProjectionResponse \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<CreatedRemoteContainerState \| ContainerAlreadyCommitted \| null> {\n return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n previousProjection: ContainerWriterProjectionResponse,\n response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n if (\n response.containerId !== previousProjection.containerId \|\|\n response.organizationId !== previousProjection.organizationId\n )\n throw new Error(\"Container mutation response projection mismatch\");\n return {\n accessManifestHash: response.manifestHead.manifestHash,\n accessEpoch: response.manifestHead.epoch,\n createdAt: response.createdAt,\n metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n referencedPrincipalHeads:\n referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n updatedAt: response.updatedAt,\n // The next read obtains the post-commit proof. A failed read cannot undo\n // acknowledgement of this successful mutation.\n writerProjection: null,\n };\n}\n\nexport async function shareRemoteContainer(input: {\n accessLevel: \"read\" \| \"write\" \| \"admin\";\n containerId: string;\n previousProjection: ContainerWriterProjectionResponse;\n recipientUserId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<SharedRemoteContainerState \| null> {\n const writer = resolveContainerWriterContext(\n input.runtime,\n \"container share\",\n );\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const shared = await shareRemoteContainerMutation({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n accessLevel: input.accessLevel,\n apiClient,\n author,\n containerId: input.containerId,\n execSql,\n previousProjection: input.previousProjection,\n recipientUserId: input.recipientUserId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!shared) {\n return null;\n }\n\n return sharedRemoteContainerStateFromMutation(\n input.previousProjection,\n shared.response,\n );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n accessLevel: \"read\" \| \"write\" \| \"admin\";\n containerId: string;\n expectedGroupName?: string \| undefined;\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n recipientGroupId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<SharedRemoteContainerState \| null> {\n const writer = resolveContainerWriterContext(\n input.runtime,\n \"container group share\",\n );\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n if (!shareWithGroup)\n throw new ProjectionDependencyUnavailableError(\n \"Group sharing requires private paged recovery\",\n );\n const shared = await shareWithGroup({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n accessLevel: input.accessLevel,\n apiClient,\n author,\n containerId: input.containerId,\n execSql,\n expectedGroupName: input.expectedGroupName ?? null,\n readEncryptedName: (bundle) =>\n createRuntimeGroupMetadataAccess(\n input.runtime,\n author.organizationId,\n input.stillCurrent,\n ).readName(bundle),\n knownContainerKeks: input.knownContainerKeks,\n previousProjection: input.previousProjection,\n recipientGroupId: input.recipientGroupId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n signingKeyPair: input.runtime.crypto.signingKeyPair,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!shared) {\n return null;\n }\n\n return sharedRemoteContainerStateFromMutation(\n input.previousProjection,\n shared.response,\n );\n}\n\nexport async function moveRemoteContainer(input: {\n containerId: string;\n parentContainerId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<RemoteContainer \| null> {\n const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const moved = await moveRemoteContainerMutation({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient,\n author,\n containerId: input.containerId,\n destinationParentContainerId: input.parentContainerId,\n execSql,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!moved) {\n return null;\n }\n\n return {\n createdAt: moved.response.createdAt,\n effectiveAccessLevel: \"admin\",\n id: moved.response.containerId,\n organizationId: moved.response.organizationId,\n parentId: moved.response.parentId,\n metadataDocumentId: readContainerMutationMetadataDocumentId({\n response: moved.response,\n }),\n metadataAccessEpoch: moved.response.manifestHead.epoch,\n metadataAccessStateHash: moved.response.manifestHead.manifestHash,\n metadataReferencedPrincipals:\n referencedPrincipalHeadsFromContainerMutationResponse({\n response: moved.response,\n }),\n updatedAt: moved.response.updatedAt,\n };\n}\n\nexport async function deleteRemoteContainer(input: {\n containerId: string;\n organizationId: string;\n requiredAncestorId?: string \| undefined;\n runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } \| null> {\n const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n input.containerId,\n {\n expectedPaymentRequiredOrganizationId: input.organizationId,\n reportErrors: false,\n requiredAncestorId: input.requiredAncestorId,\n },\n );\n if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n deleteResult.report();\n return null;\n }\n\n if (!deleteResult.ok) {\n // A 404 proves this immutable id is permanently absent, but it does not\n // carry the server deletion time. A maximal fence prevents an older\n // in-flight listing page from resurrecting it.\n return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n }\n\n return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}
1	+ {"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,uCAAuC,EACvC,qDAAqD,EACrD,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,6BAA6B,CAAC;AAQrC;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC9C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,oBAAoB,EAAE,OAAO;QAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,kBAAkB,EAAE,uCAAuC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;QACtD,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY;QACjE,4BAA4B,EAC1B,qDAAqD,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACJ,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n ContainerMutationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n moveRemoteContainer as moveRemoteContainerMutation,\n readContainerMutationMetadataDocumentId,\n referencedPrincipalHeadsFromContainerMutationResponse,\n shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/share/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n type ContainerAlreadyCommitted,\n createRemoteContainerWithMetadataDocument,\n} from \"./create/createWithMetadata\";\nimport type {\n ContainerWorkflowRuntime,\n CreatedRemoteContainerState,\n RemoteContainer,\n SharedRemoteContainerState,\n} from \"./types\";\n\n/*\n Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n runtime: ContainerWorkflowRuntime,\n operation:\n \| \"container create\"\n \| \"container group share\"\n \| \"container move\"\n \| \"container share\",\n) {\n const author = resolveDocumentCreateAuthor(runtime);\n const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !secretKey) {\n runtime.util.log(\n `Container contents: skipped ${operation} because the writer context is unavailable.`,\n );\n return null;\n }\n\n return {\n apiClient: runtime.apiClient,\n author,\n execSql: runtime.infra.execSql,\n secretKey,\n };\n}\n\nexport async function createRemoteContainer(input: {\n systemSlot?: ContainerSystemSlot \| null \| undefined;\n containerId: string;\n parentContainerId: string;\n parentProjection?: ContainerWriterProjectionResponse \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<CreatedRemoteContainerState \| ContainerAlreadyCommitted \| null> {\n return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n previousProjection: ContainerWriterProjectionResponse,\n response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n if (\n response.containerId !== previousProjection.containerId \|\|\n response.organizationId !== previousProjection.organizationId\n )\n throw new Error(\"Container mutation response projection mismatch\");\n return {\n accessManifestHash: response.manifestHead.manifestHash,\n accessEpoch: response.manifestHead.epoch,\n createdAt: response.createdAt,\n metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n referencedPrincipalHeads:\n referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n updatedAt: response.updatedAt,\n // The next read obtains the post-commit proof. A failed read cannot undo\n // acknowledgement of this successful mutation.\n writerProjection: null,\n };\n}\n\nexport async function shareRemoteContainer(input: {\n accessLevel: \"read\" \| \"write\" \| \"admin\";\n containerId: string;\n previousProjection: ContainerWriterProjectionResponse;\n recipientUserId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<SharedRemoteContainerState \| null> {\n const writer = resolveContainerWriterContext(\n input.runtime,\n \"container share\",\n );\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const shared = await shareRemoteContainerMutation({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n accessLevel: input.accessLevel,\n apiClient,\n author,\n containerId: input.containerId,\n execSql,\n previousProjection: input.previousProjection,\n recipientUserId: input.recipientUserId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!shared) {\n return null;\n }\n\n return sharedRemoteContainerStateFromMutation(\n input.previousProjection,\n shared.response,\n );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n accessLevel: \"read\" \| \"write\" \| \"admin\";\n containerId: string;\n expectedGroupName?: string \| undefined;\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n recipientGroupId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<SharedRemoteContainerState \| null> {\n const writer = resolveContainerWriterContext(\n input.runtime,\n \"container group share\",\n );\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n if (!shareWithGroup)\n throw new ProjectionDependencyUnavailableError(\n \"Group sharing requires private paged recovery\",\n );\n const shared = await shareWithGroup({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n accessLevel: input.accessLevel,\n apiClient,\n author,\n containerId: input.containerId,\n execSql,\n expectedGroupName: input.expectedGroupName ?? null,\n readEncryptedName: (bundle) =>\n createRuntimeGroupMetadataAccess(\n input.runtime,\n author.organizationId,\n input.stillCurrent,\n ).readName(bundle),\n knownContainerKeks: input.knownContainerKeks,\n previousProjection: input.previousProjection,\n recipientGroupId: input.recipientGroupId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n signingKeyPair: input.runtime.crypto.signingKeyPair,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!shared) {\n return null;\n }\n\n return sharedRemoteContainerStateFromMutation(\n input.previousProjection,\n shared.response,\n );\n}\n\nexport async function moveRemoteContainer(input: {\n containerId: string;\n parentContainerId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) \| undefined;\n}): Promise<RemoteContainer \| null> {\n const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n if (!writer) {\n return null;\n }\n const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n const moved = await moveRemoteContainerMutation({\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient,\n author,\n containerId: input.containerId,\n destinationParentContainerId: input.parentContainerId,\n execSql,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (!moved) {\n return null;\n }\n\n return {\n createdAt: moved.response.createdAt,\n effectiveAccessLevel: \"admin\",\n id: moved.response.containerId,\n organizationId: moved.response.organizationId,\n parentId: moved.response.parentId,\n metadataDocumentId: readContainerMutationMetadataDocumentId({\n response: moved.response,\n }),\n metadataAccessEpoch: moved.response.manifestHead.epoch,\n metadataAccessStateHash: moved.response.manifestHead.manifestHash,\n metadataReferencedPrincipals:\n referencedPrincipalHeadsFromContainerMutationResponse({\n response: moved.response,\n }),\n updatedAt: moved.response.updatedAt,\n };\n}\n\nexport async function deleteRemoteContainer(input: {\n containerId: string;\n organizationId: string;\n requiredAncestorId?: string \| undefined;\n runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } \| null> {\n const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n input.containerId,\n {\n expectedPaymentRequiredOrganizationId: input.organizationId,\n reportErrors: false,\n requiredAncestorId: input.requiredAncestorId,\n },\n );\n if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n deleteResult.report();\n return null;\n }\n\n if (!deleteResult.ok) {\n // A 404 proves this immutable id is permanently absent, but it does not\n // carry the server deletion time. A maximal fence prevents an older\n // in-flight listing page from resurrecting it.\n return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n }\n\n return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}

package/workflows/container-contents/container-state/share/groupGrantVerification.js ADDED Viewed

@@ -0,0 +1,71 @@
+import { getTargetContainerContext, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
+import { referencedPrincipalHeadFromPolicy } from "../../../containers/index.js";
+import { createRuntimeCurrentSharePrincipalPolicy } from "../../../containers/child/share/currentSharePrincipalPolicy.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
+import { loadContainerWriterProjectionForState } from "../projectionCache.js";
+function projectionHasCurrentGroupGrant(input) {
+    const state = readContainerState(getTargetContainerContext(input.projection).manifest);
+    return (state.containerId === input.expectedContainerId &&
+        state.organizationId === input.expectedOrganizationId &&
+        state.directGrants.some((grant) => grant.subjectType === "group" &&
+            grant.subjectId === input.groupId &&
+            grant.accessLevel === input.accessLevel) &&
+        state.referencedPrincipalHeads.some((head) => head.principalType === input.currentHead.principalType &&
+            head.principalId === input.currentHead.principalId &&
+            head.version === input.currentHead.version &&
+            head.keyEpoch === input.currentHead.keyEpoch &&
+            head.stateHash === input.currentHead.stateHash &&
+            head.keyFingerprint === input.currentHead.keyFingerprint));
+}
+async function containerStateHasCurrentGroupGrantInternal(input) {
+    if (input.stillCurrent?.() === false)
+        return false;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection ||
+        input.stillCurrent?.() === false ||
+        input.expectedGroupHead.principalType !== "group" ||
+        input.expectedGroupHead.principalId !== input.groupId ||
+        input.containerState.container.id !== input.expectedContainerId ||
+        input.containerState.container.organizationId !==
+            input.expectedOrganizationId ||
+        projection.containerId !== input.expectedContainerId ||
+        projection.organizationId !== input.expectedOrganizationId) {
+        return false;
+    }
+    const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);
+    if (!readCurrent)
+        throw new ProjectionDependencyUnavailableError("Group sharing requires private paged recovery");
+    return readCurrent({
+        expectedGroupHead: input.expectedGroupHead,
+        groupId: input.groupId,
+        organizationId: input.expectedOrganizationId,
+        stillCurrent: input.stillCurrent ?? (() => true),
+    }, async ({ checkpointPolicies, policy, stillCurrent }) => {
+        await verifyContainerWriterProjection({
+            execSql: input.runtime.infra.execSql,
+            principalPolicyCache: principalPolicyCacheForVerifiedPolicies(checkpointPolicies),
+            projection,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+        });
+        return projectionHasCurrentGroupGrant({
+            accessLevel: input.accessLevel,
+            currentHead: referencedPrincipalHeadFromPolicy(policy),
+            expectedContainerId: input.expectedContainerId,
+            expectedOrganizationId: input.expectedOrganizationId,
+            groupId: input.groupId,
+            projection,
+        });
+    });
+}
+export async function containerStateHasCurrentGroupGrant(input) {
+    return ((await nullOnProjectionVerificationCancellation(() => containerStateHasCurrentGroupGrantInternal(input))) ?? false);
+}
+//# sourceMappingURL=groupGrantVerification.js.map

package/workflows/container-contents/container-state/share/groupGrantVerification.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupGrantVerification.js","sourceRoot":"","sources":["groupGrantVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,oBAAoB,CAAC;AAK3E,SAAS,8BAA8B,CAAC,KASvC;IACC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CACrD,CAAC;IACF,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QAC/C,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACrD,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C;QACD,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,WAAW,CAAC,aAAa;YACtD,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW;YAClD,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO;YAC1C,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ;YAC5C,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,CAAC,SAAS;YAC9C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,CAAC,cAAc,CAC3D,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAUzD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IACE,CAAC,UAAU;QACX,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAChC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;QACjD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,mBAAmB;QAC/D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC3C,KAAK,CAAC,sBAAsB;QAC9B,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QACpD,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAC1D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,OAAO,WAAW,CAChB;QACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,sBAAsB;QAC5C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;QACrD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;YAC7D,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY;YACZ,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,OAAO,8BAA8B,CAAC;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,iCAAiC,CAAC,MAAM,CAAC;YACtD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAuE;IAEvE,OAAO,CACL,CAAC,MAAM,wCAAwC,CAAC,GAAG,EAAE,CACnD,0CAA0C,CAAC,KAAK,CAAC,CAClD,CAAC,IAAI,KAAK,CACZ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport {\n getTargetContainerContext,\n readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport {\n nullOnProjectionVerificationCancellation,\n type ProjectionUserKeyResolver,\n verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { referencedPrincipalHeadFromPolicy } from \"../../../containers\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"../../../containers/child/share/currentSharePrincipalPolicy\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"../projectionCache\";\nimport type { ContainerWorkflowRuntime } from \"../types\";\n\ntype GroupGrantAccessLevel = \"read\" | \"write\" | \"admin\";\n\nfunction projectionHasCurrentGroupGrant(input: {\n accessLevel: GroupGrantAccessLevel;\n expectedContainerId: string;\n expectedOrganizationId: string;\n groupId: string;\n currentHead: ReferencedPrincipalHead;\n projection: NonNullable<\n Awaited<ReturnType<typeof loadContainerWriterProjectionForState>>\n >;\n}): boolean {\n const state = readContainerState(\n getTargetContainerContext(input.projection).manifest,\n );\n return (\n state.containerId === input.expectedContainerId &&\n state.organizationId === input.expectedOrganizationId &&\n state.directGrants.some(\n (grant) =>\n grant.subjectType === \"group\" &&\n grant.subjectId === input.groupId &&\n grant.accessLevel === input.accessLevel,\n ) &&\n state.referencedPrincipalHeads.some(\n (head) =>\n head.principalType === input.currentHead.principalType &&\n head.principalId === input.currentHead.principalId &&\n head.version === input.currentHead.version &&\n head.keyEpoch === input.currentHead.keyEpoch &&\n head.stateHash === input.currentHead.stateHash &&\n head.keyFingerprint === input.currentHead.keyFingerprint,\n )\n );\n}\n\nasync function containerStateHasCurrentGroupGrantInternal(input: {\n accessLevel: GroupGrantAccessLevel;\n containerState: ContainerState;\n expectedContainerId: string;\n expectedGroupHead: ReferencedPrincipalHead;\n expectedOrganizationId: string;\n groupId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n if (input.stillCurrent?.() === false) return false;\n const projection = await loadContainerWriterProjectionForState({\n containerState: input.containerState,\n runtime: input.runtime,\n });\n if (\n !projection ||\n input.stillCurrent?.() === false ||\n input.expectedGroupHead.principalType !== \"group\" ||\n input.expectedGroupHead.principalId !== input.groupId ||\n input.containerState.container.id !== input.expectedContainerId ||\n input.containerState.container.organizationId !==\n input.expectedOrganizationId ||\n projection.containerId !== input.expectedContainerId ||\n projection.organizationId !== input.expectedOrganizationId\n ) {\n return false;\n }\n\n const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);\n if (!readCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Group sharing requires private paged recovery\",\n );\n return readCurrent(\n {\n expectedGroupHead: input.expectedGroupHead,\n groupId: input.groupId,\n organizationId: input.expectedOrganizationId,\n stillCurrent: input.stillCurrent ?? (() => true),\n },\n async ({ checkpointPolicies, policy, stillCurrent }) => {\n await verifyContainerWriterProjection({\n execSql: input.runtime.infra.execSql,\n principalPolicyCache:\n principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n projection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n return projectionHasCurrentGroupGrant({\n accessLevel: input.accessLevel,\n currentHead: referencedPrincipalHeadFromPolicy(policy),\n expectedContainerId: input.expectedContainerId,\n expectedOrganizationId: input.expectedOrganizationId,\n groupId: input.groupId,\n projection,\n });\n },\n );\n}\n\nexport async function containerStateHasCurrentGroupGrant(\n input: Parameters<typeof containerStateHasCurrentGroupGrantInternal>[0],\n): Promise<boolean> {\n return (\n (await nullOnProjectionVerificationCancellation(() =>\n containerStateHasCurrentGroupGrantInternal(input),\n )) ?? false\n );\n}\n"]}

package/workflows/container-contents/container-state/share/groupShareEpoch.js ADDED Viewed

@@ -0,0 +1,16 @@
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { createRuntimeCurrentSharePrincipalPolicy } from "../../../containers/child/share/currentSharePrincipalPolicy.js";
+export async function resolveCurrentGroupKeyEpoch(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);
+    if (!readCurrent)
+        throw new ProjectionDependencyUnavailableError("Group sharing requires private paged recovery");
+    return readCurrent({
+        expectedGroupName: input.expectedGroupName,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent ?? (() => true),
+    }, async ({ policy }) => policy.keyEpoch);
+}
+//# sourceMappingURL=groupShareEpoch.js.map

package/workflows/container-contents/container-state/share/groupShareEpoch.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupShareEpoch.js","sourceRoot":"","sources":["groupShareEpoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AAGvH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,WAAW,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,OAAO,WAAW,CAChB;QACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"../../../containers/child/share/currentSharePrincipalPolicy\";\nimport type { ContainerWorkflowRuntime } from \"../types\";\n\nexport async function resolveCurrentGroupKeyEpoch(input: {\n // Bound here, in the one verified load a duplicate share performs, so a\n // duplicate never reports success for a group the user did not choose.\n expectedGroupName?: string | undefined;\n groupId: string;\n organizationId: string;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<number | null> {\n if (input.stillCurrent?.() === false) return null;\n const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);\n if (!readCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Group sharing requires private paged recovery\",\n );\n return readCurrent(\n {\n expectedGroupName: input.expectedGroupName,\n groupId: input.groupId,\n organizationId: input.organizationId,\n stillCurrent: input.stillCurrent ?? (() => true),\n },\n async ({ policy }) => policy.keyEpoch,\n );\n}\n"]}

package/workflows/container-contents/container-state/share/index.js ADDED Viewed

@@ -0,0 +1,283 @@
+import { getTargetContainerContext, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
+import { projectionGeneration } from "../../projectionGeneration.js";
+import { loadContainerWriterProjectionForState } from "../projectionCache.js";
+import { shareRemoteContainer, shareRemoteContainerWithGroup } from "../remote.js";
+import { resolveCurrentGroupKeyEpoch } from "./groupShareEpoch.js";
+import { persistDuplicateContainerShare, persistSharedContainerState, } from "./sharePersistence.js";
+function readOptionalProjectionString(projection, key) {
+    const value = Reflect.get(projection, key);
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+// A container's KEK is wrapped to a group's encapsulation key at a specific key
+// epoch, pinned into the manifest as a referenced principal head. When the group
+// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM
+// keypair), that wrap goes stale: members holding only the new epoch secret can
+// no longer unwrap it. A re-share to the same group at the same access level is
+// therefore NOT redundant when the pinned epoch trails the group's current head,
+// so it must not be deduped away. The current epoch comes from a network-fresh,
+// fully verified current policy guarded by durable local checkpoints.
+function groupGrantIsStale(input) {
+    const pinnedHead = (input.referencedPrincipalHeads ?? []).find((head) => head.principalType === "group" && head.principalId === input.subjectId);
+    if (!pinnedHead) {
+        return true;
+    }
+    return pinnedHead.keyEpoch !== input.currentKeyEpoch;
+}
+async function loadRemoteContainerShareContext(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection || input.stillCurrent?.() === false) {
+        return null;
+    }
+    const target = getTargetContainerContext(projection);
+    const remoteState = readContainerState(target.manifest);
+    const hasMatchingGrant = remoteState.directGrants.some((grant) => grant.subjectType === input.subjectType &&
+        grant.subjectId === input.subjectId &&
+        grant.accessLevel === input.accessLevel);
+    if (!hasMatchingGrant) {
+        if (input.requireExistingGrant) {
+            // Re-wrap-only callers must never mint a brand-new grant: the container's
+            // system slot is server-supplied and could point at a container that does
+            // not already grant this subject, so minting here would leak its contents.
+            input.runtime.util.log(`Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`);
+            return null;
+        }
+        return { matchingGrant: null, projection };
+    }
+    if (input.subjectType === "group" &&
+        input.requireExistingGrant &&
+        input.forceExistingGrantRewrap) {
+        // The cheap epoch probe below reads an unverified response and cannot prove
+        // that a security-critical re-wrap is current. Force the verified policy
+        // load and a real same-level mutation; failures must reach the retry owner.
+        input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`);
+        return { matchingGrant: null, projection };
+    }
+    if (input.subjectType === "group") {
+        const pinnedHead = remoteState.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === input.subjectId);
+        const currentKeyEpoch = pinnedHead
+            ? await resolveCurrentGroupKeyEpoch({
+                expectedGroupName: input.expectedGroupName,
+                groupId: input.subjectId,
+                organizationId: remoteState.organizationId,
+                runtime: input.runtime,
+                stillCurrent: input.stillCurrent,
+            })
+            : null;
+        if (input.stillCurrent?.() === false)
+            return null;
+        if (!pinnedHead ||
+            (currentKeyEpoch !== null &&
+                groupGrantIsStale({
+                    currentKeyEpoch,
+                    referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
+                    subjectId: input.subjectId,
+                }))) {
+            input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`);
+            return { matchingGrant: null, projection };
+        }
+    }
+    return {
+        matchingGrant: {
+            accessEpoch: remoteState.epoch,
+            accessStateHash: target.manifest.manifestHash,
+            createdAt: readOptionalProjectionString(projection, "createdAt"),
+            metadataDocumentId: remoteState.metadataDocumentId,
+            referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
+            updatedAt: readOptionalProjectionString(projection, "updatedAt"),
+        },
+        projection,
+    };
+}
+async function prepareContainerStateGroupRewrapInternal(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const projection = await loadContainerWriterProjectionForState({
+        containerState: input.containerState,
+        runtime: input.runtime,
+    });
+    if (!projection || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (input.requireExistingGrant) {
+        await verifyContainerWriterProjection({
+            execSql: input.runtime.infra.execSql,
+            projection,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+        });
+        if (input.stillCurrent?.() === false)
+            return null;
+        const verifiedState = readContainerState(getTargetContainerContext(projection).manifest);
+        if (projection.containerId !== input.containerState.container.id ||
+            projection.organizationId !==
+                input.containerState.container.organizationId ||
+            verifiedState.containerId !== input.containerState.container.id ||
+            verifiedState.organizationId !==
+                input.containerState.container.organizationId ||
+            verifiedState.parentContainerId !==
+                input.containerState.container.parentId) {
+            throw new Error("Prepared container group re-wrap target is inconsistent");
+        }
+        const hasGrant = verifiedState.directGrants.some((grant) => grant.subjectType === "group" &&
+            grant.subjectId === input.groupId &&
+            grant.accessLevel === input.accessLevel);
+        if (!hasGrant) {
+            return { status: "not-granted" };
+        }
+    }
+    const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;
+    if (!targetSecretKey) {
+        return null;
+    }
+    const target = getTargetContainerContext(projection);
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.runtime.infra.execSql,
+        projection,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        secretKey: targetSecretKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);
+    return targetKek
+        ? {
+            knownContainerKeks: new Map([
+                [target.kek.containerKeyEpochId, targetKek],
+            ]),
+            status: "prepared",
+        }
+        : null;
+}
+export function prepareContainerStateGroupRewrap(input) {
+    return nullOnProjectionVerificationCancellation(() => prepareContainerStateGroupRewrapInternal(input));
+}
+export async function shareContainerState(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Before the projection load and the share request: a hint that lands during
+    // either must keep the resulting projection out of the cache.
+    const writerProjectionGeneration = projectionGeneration(input.containerState);
+    const shareContext = await loadRemoteContainerShareContext({
+        accessLevel: input.accessLevel,
+        containerState: input.containerState,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        subjectId: input.recipientUserId,
+        subjectType: "user",
+    });
+    if (!shareContext || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (shareContext.matchingGrant) {
+        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`);
+        return persistDuplicateContainerShare({
+            containerState: input.containerState,
+            grant: shareContext.matchingGrant,
+            persistence: input.persistence,
+            projection: shareContext.projection,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+            writerProjectionGeneration,
+        });
+    }
+    const shared = await shareRemoteContainer({
+        accessLevel: input.accessLevel,
+        containerId: input.containerState.container.id,
+        previousProjection: shareContext.projection,
+        recipientUserId: input.recipientUserId,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!shared)
+        return null;
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    return persistSharedContainerState({
+        containerState: input.containerState,
+        persistence: input.persistence,
+        runtime: input.runtime,
+        shared,
+        stillCurrent: input.stillCurrent,
+        writerProjectionGeneration,
+    });
+}
+export async function shareContainerStateWithGroup(input) {
+    // A share chosen by name must carry that name so it can be bound to the
+    // signed group policy. Only the grant-preserving re-wrap, which never mints
+    // a grant, may run without one. Enforced here, in the workflow facade, so
+    // every caller (not only the store) meets the invariant.
+    if (!input.requireExistingGrant && input.expectedGroupName === undefined) {
+        throw new Error("Container group share requires the chosen group name");
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Before the projection load and the share request: a hint that lands during
+    // either must keep the resulting projection out of the cache.
+    const writerProjectionGeneration = projectionGeneration(input.containerState);
+    const shareContext = await loadRemoteContainerShareContext({
+        accessLevel: input.accessLevel,
+        containerState: input.containerState,
+        expectedGroupName: input.expectedGroupName,
+        forceExistingGrantRewrap: input.requireExistingGrant && input.knownContainerKeks !== undefined,
+        requireExistingGrant: input.requireExistingGrant,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+        subjectId: input.recipientGroupId,
+        subjectType: "group",
+    });
+    if (!shareContext || input.stillCurrent?.() === false) {
+        return null;
+    }
+    if (shareContext.matchingGrant) {
+        // A duplicate share mints nothing, but it must not report success for a
+        // group the user did not choose. A matching grant is only found after the
+        // key-epoch probe verified the group's policy with the chosen name bound,
+        // so the name is already checked here.
+        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`);
+        return persistDuplicateContainerShare({
+            containerState: input.containerState,
+            grant: shareContext.matchingGrant,
+            persistence: input.persistence,
+            projection: shareContext.projection,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+            writerProjectionGeneration,
+        });
+    }
+    const shared = await shareRemoteContainerWithGroup({
+        accessLevel: input.accessLevel,
+        containerId: input.containerState.container.id,
+        expectedGroupName: input.expectedGroupName,
+        knownContainerKeks: input.knownContainerKeks,
+        previousProjection: shareContext.projection,
+        recipientGroupId: input.recipientGroupId,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        runtime: input.runtime,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!shared)
+        return null;
+    if (input.stillCurrent?.() === false)
+        return { status: "confirmed" };
+    return persistSharedContainerState({
+        containerState: input.containerState,
+        persistence: input.persistence,
+        runtime: input.runtime,
+        shared,
+        stillCurrent: input.stillCurrent,
+        writerProjectionGeneration,
+    });
+}
+//# sourceMappingURL=index.js.map

package/workflows/container-contents/container-state/share/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,qCAAqC,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAEL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAU5B,SAAS,4BAA4B,CACnC,UAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAI1B;IACC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,+CAA+C,KAAK,CAAC,WAAW,cAAc,KAAK,CAAC,SAAS,iBAAiB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kDAAkD,CAClM,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IACE,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,wBAAwB,EAC9B,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,gDAAgD,CAC5J,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAC1D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;QACF,MAAM,eAAe,GAAG,UAAU;YAChC,CAAC,CAAC,MAAM,2BAA2B,CAAC;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,CAAC,UAAU;YACX,CAAC,eAAe,KAAK,IAAI;gBACvB,iBAAiB,CAAC;oBAChB,eAAe;oBACf,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;oBAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC,EACL,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,uDAAuD,CACnK,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE;YACb,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC7C,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;YAChE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;YAClD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;SACjE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAQvD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,aAAa,GAAG,kBAAkB,CACtC,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;QACF,IACE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC5D,UAAU,CAAC,cAAc;gBACvB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC/D,aAAa,CAAC,cAAc;gBAC1B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,iBAAiB;gBAC7B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,UAAU;QACV,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,SAAS,EAAE,eAAe;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,SAAS;QACd,CAAC,CAAC;YACE,kBAAkB,EAAE,IAAI,GAAG,CAAC;gBAC1B,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC;aAC5C,CAAC;YACF,MAAM,EAAE,UAAU;SACnB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAqE;IAErE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,wCAAwC,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,cAAc,KAAK,CAAC,eAAe,EAAE,CACpI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAelD;IACC,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,wBAAwB,EACtB,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,gBAAgB;QACjC,WAAW,EAAE,OAAO;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uCAAuC;QACvC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,gBAAgB,EAAE,CACtI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n ContainerWriterProjectionResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport {\n getTargetContainerContext,\n readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport {\n nullOnProjectionVerificationCancellation,\n type ProjectionUserKeyResolver,\n verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport { projectionGeneration } from \"../../projectionGeneration\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"../projectionCache\";\nimport { shareRemoteContainer, shareRemoteContainerWithGroup } from \"../remote\";\nimport type {\n ContainerWorkflowRuntime,\n SharedContainerStateResult,\n} from \"../types\";\nimport { resolveCurrentGroupKeyEpoch } from \"./groupShareEpoch\";\nimport {\n type MatchingRemoteContainerGrant,\n persistDuplicateContainerShare,\n persistSharedContainerState,\n} from \"./sharePersistence\";\n\ntype ContainerShareSubjectType = \"group\" | \"user\";\ntype ContainerShareAccessLevel = \"read\" | \"write\" | \"admin\";\n\ninterface RemoteContainerShareContext {\n matchingGrant: MatchingRemoteContainerGrant | null;\n projection: ContainerWriterProjectionResponse;\n}\n\nfunction readOptionalProjectionString(\n projection: ContainerWriterProjectionResponse,\n key: string,\n): string | null {\n const value = Reflect.get(projection, key);\n return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n// A container's KEK is wrapped to a group's encapsulation key at a specific key\n// epoch, pinned into the manifest as a referenced principal head. When the group\n// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM\n// keypair), that wrap goes stale: members holding only the new epoch secret can\n// no longer unwrap it. A re-share to the same group at the same access level is\n// therefore NOT redundant when the pinned epoch trails the group's current head,\n// so it must not be deduped away. The current epoch comes from a network-fresh,\n// fully verified current policy guarded by durable local checkpoints.\nfunction groupGrantIsStale(input: {\n currentKeyEpoch: number;\n referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n subjectId: string;\n}): boolean {\n const pinnedHead = (input.referencedPrincipalHeads ?? []).find(\n (head) =>\n head.principalType === \"group\" && head.principalId === input.subjectId,\n );\n if (!pinnedHead) {\n return true;\n }\n return pinnedHead.keyEpoch !== input.currentKeyEpoch;\n}\n\nasync function loadRemoteContainerShareContext(input: {\n accessLevel: ContainerShareAccessLevel;\n containerState: ContainerState;\n expectedGroupName?: string | undefined;\n forceExistingGrantRewrap?: boolean | undefined;\n requireExistingGrant?: boolean | undefined;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n subjectId: string;\n subjectType: ContainerShareSubjectType;\n}): Promise<RemoteContainerShareContext | null> {\n if (input.stillCurrent?.() === false) return null;\n const projection = await loadContainerWriterProjectionForState({\n containerState: input.containerState,\n runtime: input.runtime,\n });\n if (!projection || input.stillCurrent?.() === false) {\n return null;\n }\n\n const target = getTargetContainerContext(projection);\n const remoteState = readContainerState(target.manifest);\n const hasMatchingGrant = remoteState.directGrants.some(\n (grant) =>\n grant.subjectType === input.subjectType &&\n grant.subjectId === input.subjectId &&\n grant.accessLevel === input.accessLevel,\n );\n if (!hasMatchingGrant) {\n if (input.requireExistingGrant) {\n // Re-wrap-only callers must never mint a brand-new grant: the container's\n // system slot is server-supplied and could point at a container that does\n // not already grant this subject, so minting here would leak its contents.\n input.runtime.util.log(\n `Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`,\n );\n return null;\n }\n return { matchingGrant: null, projection };\n }\n\n if (\n input.subjectType === \"group\" &&\n input.requireExistingGrant &&\n input.forceExistingGrantRewrap\n ) {\n // The cheap epoch probe below reads an unverified response and cannot prove\n // that a security-critical re-wrap is current. Force the verified policy\n // load and a real same-level mutation; failures must reach the retry owner.\n input.runtime.util.log(\n `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`,\n );\n return { matchingGrant: null, projection };\n }\n\n if (input.subjectType === \"group\") {\n const pinnedHead = remoteState.referencedPrincipalHeads.find(\n (head) =>\n head.principalType === \"group\" && head.principalId === input.subjectId,\n );\n const currentKeyEpoch = pinnedHead\n ? await resolveCurrentGroupKeyEpoch({\n expectedGroupName: input.expectedGroupName,\n groupId: input.subjectId,\n organizationId: remoteState.organizationId,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n })\n : null;\n if (input.stillCurrent?.() === false) return null;\n if (\n !pinnedHead ||\n (currentKeyEpoch !== null &&\n groupGrantIsStale({\n currentKeyEpoch,\n referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n subjectId: input.subjectId,\n }))\n ) {\n input.runtime.util.log(\n `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`,\n );\n return { matchingGrant: null, projection };\n }\n }\n\n return {\n matchingGrant: {\n accessEpoch: remoteState.epoch,\n accessStateHash: target.manifest.manifestHash,\n createdAt: readOptionalProjectionString(projection, \"createdAt\"),\n metadataDocumentId: remoteState.metadataDocumentId,\n referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n updatedAt: readOptionalProjectionString(projection, \"updatedAt\"),\n },\n projection,\n };\n}\n\nasync function prepareContainerStateGroupRewrapInternal(input: {\n accessLevel: ContainerShareAccessLevel;\n containerState: ContainerState;\n groupId: string;\n requireExistingGrant?: boolean | undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n | { status: \"not-granted\" }\n | {\n knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n status: \"prepared\";\n }\n | null\n> {\n if (input.stillCurrent?.() === false) return null;\n const projection = await loadContainerWriterProjectionForState({\n containerState: input.containerState,\n runtime: input.runtime,\n });\n if (!projection || input.stillCurrent?.() === false) {\n return null;\n }\n\n if (input.requireExistingGrant) {\n await verifyContainerWriterProjection({\n execSql: input.runtime.infra.execSql,\n projection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (input.stillCurrent?.() === false) return null;\n const verifiedState = readContainerState(\n getTargetContainerContext(projection).manifest,\n );\n if (\n projection.containerId !== input.containerState.container.id ||\n projection.organizationId !==\n input.containerState.container.organizationId ||\n verifiedState.containerId !== input.containerState.container.id ||\n verifiedState.organizationId !==\n input.containerState.container.organizationId ||\n verifiedState.parentContainerId !==\n input.containerState.container.parentId\n ) {\n throw new Error(\n \"Prepared container group re-wrap target is inconsistent\",\n );\n }\n const hasGrant = verifiedState.directGrants.some(\n (grant) =>\n grant.subjectType === \"group\" &&\n grant.subjectId === input.groupId &&\n grant.accessLevel === input.accessLevel,\n );\n if (!hasGrant) {\n return { status: \"not-granted\" };\n }\n }\n\n const targetSecretKey =\n input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;\n if (!targetSecretKey) {\n return null;\n }\n\n const target = getTargetContainerContext(projection);\n const keksByEpochId = await unwrapContainerKekPath({\n execSql: input.runtime.infra.execSql,\n projection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n secretKey: targetSecretKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n if (input.stillCurrent?.() === false) return null;\n const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);\n return targetKek\n ? {\n knownContainerKeks: new Map([\n [target.kek.containerKeyEpochId, targetKek],\n ]),\n status: \"prepared\",\n }\n : null;\n}\n\nexport function prepareContainerStateGroupRewrap(\n input: Parameters<typeof prepareContainerStateGroupRewrapInternal>[0],\n): ReturnType<typeof prepareContainerStateGroupRewrapInternal> {\n return nullOnProjectionVerificationCancellation(() =>\n prepareContainerStateGroupRewrapInternal(input),\n );\n}\n\nexport async function shareContainerState(input: {\n accessLevel: ContainerShareAccessLevel;\n containerState: ContainerState;\n persistence: ContainerContentsPersistence;\n recipientUserId: string;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n if (input.stillCurrent?.() === false) return null;\n // Before the projection load and the share request: a hint that lands during\n // either must keep the resulting projection out of the cache.\n const writerProjectionGeneration = projectionGeneration(input.containerState);\n const shareContext = await loadRemoteContainerShareContext({\n accessLevel: input.accessLevel,\n containerState: input.containerState,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n subjectId: input.recipientUserId,\n subjectType: \"user\",\n });\n if (!shareContext || input.stillCurrent?.() === false) {\n return null;\n }\n if (shareContext.matchingGrant) {\n input.runtime.util.log(\n `Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`,\n );\n return persistDuplicateContainerShare({\n containerState: input.containerState,\n grant: shareContext.matchingGrant,\n persistence: input.persistence,\n projection: shareContext.projection,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n writerProjectionGeneration,\n });\n }\n\n const shared = await shareRemoteContainer({\n accessLevel: input.accessLevel,\n containerId: input.containerState.container.id,\n previousProjection: shareContext.projection,\n recipientUserId: input.recipientUserId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n\n if (!shared) return null;\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n return persistSharedContainerState({\n containerState: input.containerState,\n persistence: input.persistence,\n runtime: input.runtime,\n shared,\n stillCurrent: input.stillCurrent,\n writerProjectionGeneration,\n });\n}\n\nexport async function shareContainerStateWithGroup(input: {\n accessLevel: ContainerShareAccessLevel;\n containerState: ContainerState;\n expectedGroupName?: string | undefined;\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n persistence: ContainerContentsPersistence;\n recipientGroupId: string;\n // When set, a re-share only re-wraps an already-granted group and never mints\n // a new grant. Used by organization access repair so a server cannot redirect\n // the operation onto a container the group is not entitled to. A prepared\n // re-wrap also supplies captured KEKs and must submit a real mutation.\n requireExistingGrant?: boolean | undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n runtime: ContainerWorkflowRuntime;\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n // A share chosen by name must carry that name so it can be bound to the\n // signed group policy. Only the grant-preserving re-wrap, which never mints\n // a grant, may run without one. Enforced here, in the workflow facade, so\n // every caller (not only the store) meets the invariant.\n if (!input.requireExistingGrant && input.expectedGroupName === undefined) {\n throw new Error(\"Container group share requires the chosen group name\");\n }\n if (input.stillCurrent?.() === false) return null;\n // Before the projection load and the share request: a hint that lands during\n // either must keep the resulting projection out of the cache.\n const writerProjectionGeneration = projectionGeneration(input.containerState);\n const shareContext = await loadRemoteContainerShareContext({\n accessLevel: input.accessLevel,\n containerState: input.containerState,\n expectedGroupName: input.expectedGroupName,\n forceExistingGrantRewrap:\n input.requireExistingGrant && input.knownContainerKeks !== undefined,\n requireExistingGrant: input.requireExistingGrant,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n subjectId: input.recipientGroupId,\n subjectType: \"group\",\n });\n if (!shareContext || input.stillCurrent?.() === false) {\n return null;\n }\n if (shareContext.matchingGrant) {\n // A duplicate share mints nothing, but it must not report success for a\n // group the user did not choose. A matching grant is only found after the\n // key-epoch probe verified the group's policy with the chosen name bound,\n // so the name is already checked here.\n input.runtime.util.log(\n `Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`,\n );\n return persistDuplicateContainerShare({\n containerState: input.containerState,\n grant: shareContext.matchingGrant,\n persistence: input.persistence,\n projection: shareContext.projection,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n writerProjectionGeneration,\n });\n }\n\n const shared = await shareRemoteContainerWithGroup({\n accessLevel: input.accessLevel,\n containerId: input.containerState.container.id,\n expectedGroupName: input.expectedGroupName,\n knownContainerKeks: input.knownContainerKeks,\n previousProjection: shareContext.projection,\n recipientGroupId: input.recipientGroupId,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n\n if (!shared) return null;\n if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n return persistSharedContainerState({\n containerState: input.containerState,\n persistence: input.persistence,\n runtime: input.runtime,\n shared,\n stillCurrent: input.stillCurrent,\n writerProjectionGeneration,\n });\n}\n"]}