@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/container-contents/container-state/purgeTreeScope.js

@@ -1,175 +0,0 @@
-import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { verifyContainerWriterProjection } from "../../../data/keyingProjectionVerification/containerProjectionVerification.js";
-import { runWithSecurityIncidentReporting } from "../../../data/keyingProjectionVerification/error.js";
-import { rethrowProjectionVerificationCancelled } from "../../../data/keyingProjectionVerification/types.js";
-import { hasUnsettledDocumentPlacement } from "../../../data/persistence/container-contents/documentPurgePlacement.js";
-import { sqlDocumentsPersistence } from "../../../data/persistence/documents/documentsPersistence.js";
-import { errorMessage } from "../../../data/shared/errorMessage.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { assertLocalPurgeScope } from "./localPurgeScope.js";
-import { snapshotContainerStates } from "./purgeTreeCollection.js";
-import { readLocalPurgeScope } from "./readLocalPurgeScope.js";
-async function verifiedRemoteScope(input, current, verifiedAncestorsById) {
-    const { runtime, rootContainerId } = input;
-    const targetId = current.container.id;
-    return runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
-        objectId: targetId,
-        objectKind: "container",
-        operation: "container.purge.scope",
-    }, async () => {
-        runtime.apiClient.evictContainerWriterProjection(targetId);
-        const projection = await runtime.apiClient.getContainerWriterProjection(targetId);
-        if (!projection || input.stillCurrent?.() === false)
-            return false;
-        if (projection.containerId !== targetId ||
-            projection.organizationId !== current.container.organizationId) {
-            throw new KeyingVerificationError("object_mismatch", "Subtree purge container identity mismatch");
-        }
-        const path = await verifyContainerWriterProjection({
-            execSql: runtime.infra.execSql,
-            projection,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
-        });
-        const rootIndex = path.findIndex((head) => head.state.containerId === rootContainerId);
-        const latest = await input.persistence.loadContainerMetadataState(runtime.infra.execSql, targetId);
-        const pendingMoves = await readPendingMoves(input);
-        const allowed = rootIndex >= 0 &&
-            path[rootIndex]?.state.parentContainerId ===
-                input.containersById.get(rootContainerId)?.container.parentId &&
-            latest?.container.parentId === current.container.parentId &&
-            latest.record?.documentId === current.record.documentId &&
-            !path
-                .slice(rootIndex)
-                .some((head) => pendingMoves.has(head.state.containerId)) &&
-            input.stillCurrent?.() !== false;
-        if (allowed)
-            verifiedAncestorsById.set(targetId, path.slice(rootIndex).map((head) => head.state.containerId));
-        return allowed;
-    });
-}
-/**
- * A local-only unit cites no signed request, so a remote ordinary root must
- * prove that it still sits under the parent it was selected from. A system
- * root's signed topology is fixed by its destination role.
- */
-async function rootPlacementIsCurrent(input, verifiedAncestorsById) {
-    const root = input.containersById.get(input.rootContainerId);
-    if (!root?.record.documentId || (root.container.systemSlot ?? null) !== null)
-        return true;
-    return verifiedRemoteScope(input, root, verifiedAncestorsById);
-}
-async function allowsContainer(input, containerId, verifiedAncestorsById, localOnlyUnit) {
-    const { runtime, persistence, rootContainerId } = input;
-    if (input.stillCurrent?.() === false)
-        return false;
-    const execSql = runtime.infra.execSql;
-    const pendingMoves = await readPendingMoves(input);
-    if (pendingMoves.has(rootContainerId))
-        return false;
-    const seen = new Set([rootContainerId]);
-    let currentId = containerId;
-    let verifiedRemoteAncestry = false;
-    while (currentId !== rootContainerId) {
-        if (!currentId || seen.has(currentId) || pendingMoves.has(currentId))
-            return false;
-        seen.add(currentId);
-        const expected = input.containersById.get(currentId);
-        const current = await persistence.loadContainerMetadataState(execSql, currentId);
-        if (!expected ||
-            !current?.record ||
-            current.container.parentId !== expected.container.parentId ||
-            current.container.organizationId !== expected.container.organizationId ||
-            current.record.documentId !== expected.record.documentId)
-            return false;
-        if (current.record.documentId) {
-            if (!(await verifiedRemoteScope(input, {
-                container: current.container,
-                record: current.record,
-            }, verifiedAncestorsById)))
-                return false;
-            verifiedRemoteAncestry = true;
-            break;
-        }
-        currentId = current.container.parentId;
-    }
-    if (localOnlyUnit &&
-        !verifiedRemoteAncestry &&
-        !(await rootPlacementIsCurrent(input, verifiedAncestorsById)))
-        return false;
-    return readLocalPurgeScope({
-        ...input,
-        containerId,
-        execSql,
-        verifiedAncestorsById,
-    });
-}
-async function readPendingMoves(input) {
-    return new Set((await input.persistence.listUnsyncedMoveIntents(input.runtime.infra.execSql)).map((intent) => intent.containerId));
-}
-async function documentPlacementIsCurrent(input, document) {
-    const execSql = input.runtime.infra.execSql;
-    if (await hasUnsettledDocumentPlacement(execSql, document.id))
-        return false;
-    const current = await sqlDocumentsPersistence.loadDocument(execSql, document.id);
-    return (current !== null &&
-        current.documentId === document.documentId &&
-        current.containerId === document.containerId &&
-        input.stillCurrent?.() !== false);
-}
-/** Listing edges only select candidates; each destructive unit proves its scope. */
-export function createSubtreePurgeScope(request) {
-    const input = {
-        ...request,
-        containersById: snapshotContainerStates(request.containersById),
-    };
-    const verifiedAncestorsById = new Map();
-    return {
-        allowsLocalScopeInTransaction: (execSql, containerId) => checkAvailableScope(input, async () => {
-            await assertLocalPurgeScope({
-                ...input,
-                execSql,
-                containerId,
-                verifiedAncestorsById,
-            });
-            return true;
-        }),
-        assertLocalScopeInTransaction: (execSql, containerId, localId) => assertLocalPurgeScope({
-            ...input,
-            execSql,
-            containerId,
-            localId,
-            verifiedAncestorsById,
-        }),
-        allowsContainer: (containerId) => checkAvailableScope(input, () => allowsContainer(input, containerId, verifiedAncestorsById, !input.containersById.get(containerId)?.record.documentId)),
-        allowsDocument: (document) => checkAvailableScope(input, async () => {
-            if (!document.containerId ||
-                !(await documentPlacementIsCurrent(input, document)))
-                return false;
-            if (!(await allowsContainer(input, document.containerId, verifiedAncestorsById, !document.documentId)))
-                return false;
-            // Freeze local placement checks together after all remote verification.
-            return readLocalPurgeScope({
-                ...input,
-                containerId: document.containerId,
-                execSql: input.runtime.infra.execSql,
-                localId: document.id,
-                verifiedAncestorsById,
-            }, document);
-        }),
-    };
-}
-async function checkAvailableScope(input, check) {
-    try {
-        return await check();
-    }
-    catch (error) {
-        rethrowProjectionVerificationCancelled(error);
-        if (error instanceof KeyingVerificationError)
-            throw error;
-        input.runtime.util.log(`Container contents: purge scope unavailable: ${errorMessage(error)}`);
-        return false;
-    }
-}
-//# sourceMappingURL=purgeTreeScope.js.map

package/workflows/container-contents/container-state/purgeTreeScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"purgeTreeScope.js","sourceRoot":"","sources":["purgeTreeScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4EAA4E,CAAC;AAC7H,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAW5D,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,OAAqD,EACrD,qBAAqD;IAErD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACtC,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,uBAAuB;KACnC,EACD,KAAK,IAAI,EAAE;QACT,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,UAAU,GACd,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IACE,UAAU,CAAC,WAAW,KAAK,QAAQ;YACnC,UAAU,CAAC,cAAc,KAAK,OAAO,CAAC,SAAS,CAAC,cAAc,EAC9D,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC;YACjD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,eAAe,CACrD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,QAAQ,CACT,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,SAAS,IAAI,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,iBAAiB;gBACtC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ;YAC/D,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ;YACzD,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU;YACvD,CAAC,IAAI;iBACF,KAAK,CAAC,SAAS,CAAC;iBAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3D,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACnC,IAAI,OAAO;YACT,qBAAqB,CAAC,GAAG,CACvB,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5D,CAAC;QACJ,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAA6B,EAC7B,qBAAqD;IAErD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1E,OAAO,IAAI,CAAC;IACd,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA6B,EAC7B,WAAmB,EACnB,qBAAqD,EACrD,aAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,GAAkB,WAAW,CAAC;IAC3C,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,OAAO,SAAS,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,0BAA0B,CAC1D,OAAO,EACP,SAAS,CACV,CAAC;QACF,IACE,CAAC,QAAQ;YACT,CAAC,OAAO,EAAE,MAAM;YAChB,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;YAC1D,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,cAAc;YACtE,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;YAExD,OAAO,KAAK,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC9B,IACE,CAAC,CAAC,MAAM,mBAAmB,CACzB,KAAK,EACL;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,EACD,qBAAqB,CACtB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzC,CAAC;IACD,IACE,aAAa;QACb,CAAC,sBAAsB;QACvB,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAE7D,OAAO,KAAK,CAAC;IACf,OAAO,mBAAmB,CAAC;QACzB,GAAG,KAAK;QACR,WAAW;QACX,OAAO;QACP,qBAAqB;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAA6B;IAC3D,OAAO,IAAI,GAAG,CACZ,CACE,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CACF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA6B,EAC7B,QAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,IAAI,MAAM,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChE,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnE,OAAO;QACL,6BAA6B,EAAE,CAAC,OAAgB,EAAE,WAAmB,EAAE,EAAE,CACvE,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,qBAAqB,CAAC;gBAC1B,GAAG,KAAK;gBACR,OAAO;gBACP,WAAW;gBACX,qBAAqB;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACJ,6BAA6B,EAAE,CAC7B,OAAgB,EAChB,WAAsC,EACtC,OAAe,EACf,EAAE,CACF,qBAAqB,CAAC;YACpB,GAAG,KAAK;YACR,OAAO;YACP,WAAW;YACX,OAAO;YACP,qBAAqB;SACtB,CAAC;QACJ,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC9B,eAAe,CACb,KAAK,EACL,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAC1D,CACF;QACH,cAAc,EAAE,CAAC,QAAyB,EAAE,EAAE,CAC5C,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,IACE,CAAC,QAAQ,CAAC,WAAW;gBACrB,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAEpD,OAAO,KAAK,CAAC;YACf,IACE,CAAC,CAAC,MAAM,eAAe,CACrB,KAAK,EACL,QAAQ,CAAC,WAAW,EACpB,qBAAqB,EACrB,CAAC,QAAQ,CAAC,UAAU,CACrB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,wEAAwE;YACxE,OAAO,mBAAmB,CACxB;gBACE,GAAG,KAAK;gBACR,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACpB,qBAAqB;aACtB,EACD,QAAQ,CACT,CAAC;QACJ,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,gDAAgD,YAAY,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { verifyContainerWriterProjection } from \"../../../data/keyingProjectionVerification/containerProjectionVerification\";\nimport { runWithSecurityIncidentReporting } from \"../../../data/keyingProjectionVerification/error\";\nimport { rethrowProjectionVerificationCancelled } from \"../../../data/keyingProjectionVerification/types\";\nimport { hasUnsettledDocumentPlacement } from \"../../../data/persistence/container-contents/documentPurgePlacement\";\nimport { sqlDocumentsPersistence } from \"../../../data/persistence/documents/documentsPersistence\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\nimport { snapshotContainerStates } from \"./purgeTreeCollection\";\nimport { readLocalPurgeScope } from \"./readLocalPurgeScope\";\n\ninterface SubtreePurgeScopeInput {\n  containersById: ReadonlyMap<string, ContainerState>;\n  persistence: ContainerContentsPersistence;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rootContainerId: string;\n  runtime: ContainerContentsWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function verifiedRemoteScope(\n  input: SubtreePurgeScopeInput,\n  current: Pick<ContainerState, \"container\" | \"record\">,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n  const { runtime, rootContainerId } = input;\n  const targetId = current.container.id;\n  return runWithSecurityIncidentReporting(\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: targetId,\n      objectKind: \"container\",\n      operation: \"container.purge.scope\",\n    },\n    async () => {\n      runtime.apiClient.evictContainerWriterProjection(targetId);\n      const projection =\n        await runtime.apiClient.getContainerWriterProjection(targetId);\n      if (!projection || input.stillCurrent?.() === false) return false;\n      if (\n        projection.containerId !== targetId ||\n        projection.organizationId !== current.container.organizationId\n      ) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Subtree purge container identity mismatch\",\n        );\n      }\n      const path = await verifyContainerWriterProjection({\n        execSql: runtime.infra.execSql,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies:\n          createRuntimePrincipalPolicyWarmer(runtime),\n      });\n      const rootIndex = path.findIndex(\n        (head) => head.state.containerId === rootContainerId,\n      );\n      const latest = await input.persistence.loadContainerMetadataState(\n        runtime.infra.execSql,\n        targetId,\n      );\n      const pendingMoves = await readPendingMoves(input);\n      const allowed =\n        rootIndex >= 0 &&\n        path[rootIndex]?.state.parentContainerId ===\n          input.containersById.get(rootContainerId)?.container.parentId &&\n        latest?.container.parentId === current.container.parentId &&\n        latest.record?.documentId === current.record.documentId &&\n        !path\n          .slice(rootIndex)\n          .some((head) => pendingMoves.has(head.state.containerId)) &&\n        input.stillCurrent?.() !== false;\n      if (allowed)\n        verifiedAncestorsById.set(\n          targetId,\n          path.slice(rootIndex).map((head) => head.state.containerId),\n        );\n      return allowed;\n    },\n  );\n}\n\n/**\n * A local-only unit cites no signed request, so a remote ordinary root must\n * prove that it still sits under the parent it was selected from. A system\n * root's signed topology is fixed by its destination role.\n */\nasync function rootPlacementIsCurrent(\n  input: SubtreePurgeScopeInput,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n  const root = input.containersById.get(input.rootContainerId);\n  if (!root?.record.documentId || (root.container.systemSlot ?? null) !== null)\n    return true;\n  return verifiedRemoteScope(input, root, verifiedAncestorsById);\n}\n\nasync function allowsContainer(\n  input: SubtreePurgeScopeInput,\n  containerId: string,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n  localOnlyUnit: boolean,\n): Promise<boolean> {\n  const { runtime, persistence, rootContainerId } = input;\n  if (input.stillCurrent?.() === false) return false;\n  const execSql = runtime.infra.execSql;\n  const pendingMoves = await readPendingMoves(input);\n  if (pendingMoves.has(rootContainerId)) return false;\n  const seen = new Set<string>([rootContainerId]);\n  let currentId: string | null = containerId;\n  let verifiedRemoteAncestry = false;\n  while (currentId !== rootContainerId) {\n    if (!currentId || seen.has(currentId) || pendingMoves.has(currentId))\n      return false;\n    seen.add(currentId);\n    const expected = input.containersById.get(currentId);\n    const current = await persistence.loadContainerMetadataState(\n      execSql,\n      currentId,\n    );\n    if (\n      !expected ||\n      !current?.record ||\n      current.container.parentId !== expected.container.parentId ||\n      current.container.organizationId !== expected.container.organizationId ||\n      current.record.documentId !== expected.record.documentId\n    )\n      return false;\n    if (current.record.documentId) {\n      if (\n        !(await verifiedRemoteScope(\n          input,\n          {\n            container: current.container,\n            record: current.record,\n          },\n          verifiedAncestorsById,\n        ))\n      )\n        return false;\n      verifiedRemoteAncestry = true;\n      break;\n    }\n    currentId = current.container.parentId;\n  }\n  if (\n    localOnlyUnit &&\n    !verifiedRemoteAncestry &&\n    !(await rootPlacementIsCurrent(input, verifiedAncestorsById))\n  )\n    return false;\n  return readLocalPurgeScope({\n    ...input,\n    containerId,\n    execSql,\n    verifiedAncestorsById,\n  });\n}\n\nasync function readPendingMoves(input: SubtreePurgeScopeInput) {\n  return new Set(\n    (\n      await input.persistence.listUnsyncedMoveIntents(\n        input.runtime.infra.execSql,\n      )\n    ).map((intent) => intent.containerId),\n  );\n}\n\nasync function documentPlacementIsCurrent(\n  input: SubtreePurgeScopeInput,\n  document: DocumentSummary,\n): Promise<boolean> {\n  const execSql = input.runtime.infra.execSql;\n  if (await hasUnsettledDocumentPlacement(execSql, document.id)) return false;\n  const current = await sqlDocumentsPersistence.loadDocument(\n    execSql,\n    document.id,\n  );\n  return (\n    current !== null &&\n    current.documentId === document.documentId &&\n    current.containerId === document.containerId &&\n    input.stillCurrent?.() !== false\n  );\n}\n\n/** Listing edges only select candidates; each destructive unit proves its scope. */\nexport function createSubtreePurgeScope(request: SubtreePurgeScopeInput) {\n  const input = {\n    ...request,\n    containersById: snapshotContainerStates(request.containersById),\n  };\n  const verifiedAncestorsById = new Map<string, readonly string[]>();\n  return {\n    allowsLocalScopeInTransaction: (execSql: ExecSql, containerId: string) =>\n      checkAvailableScope(input, async () => {\n        await assertLocalPurgeScope({\n          ...input,\n          execSql,\n          containerId,\n          verifiedAncestorsById,\n        });\n        return true;\n      }),\n    assertLocalScopeInTransaction: (\n      execSql: ExecSql,\n      containerId: string | null | undefined,\n      localId: string,\n    ) =>\n      assertLocalPurgeScope({\n        ...input,\n        execSql,\n        containerId,\n        localId,\n        verifiedAncestorsById,\n      }),\n    allowsContainer: (containerId: string) =>\n      checkAvailableScope(input, () =>\n        allowsContainer(\n          input,\n          containerId,\n          verifiedAncestorsById,\n          !input.containersById.get(containerId)?.record.documentId,\n        ),\n      ),\n    allowsDocument: (document: DocumentSummary) =>\n      checkAvailableScope(input, async () => {\n        if (\n          !document.containerId ||\n          !(await documentPlacementIsCurrent(input, document))\n        )\n          return false;\n        if (\n          !(await allowsContainer(\n            input,\n            document.containerId,\n            verifiedAncestorsById,\n            !document.documentId,\n          ))\n        )\n          return false;\n        // Freeze local placement checks together after all remote verification.\n        return readLocalPurgeScope(\n          {\n            ...input,\n            containerId: document.containerId,\n            execSql: input.runtime.infra.execSql,\n            localId: document.id,\n            verifiedAncestorsById,\n          },\n          document,\n        );\n      }),\n  };\n}\n\nasync function checkAvailableScope(\n  input: SubtreePurgeScopeInput,\n  check: () => Promise<boolean>,\n): Promise<boolean> {\n  try {\n    return await check();\n  } catch (error) {\n    rethrowProjectionVerificationCancelled(error);\n    if (error instanceof KeyingVerificationError) throw error;\n    input.runtime.util.log(\n      `Container contents: purge scope unavailable: ${errorMessage(error)}`,\n    );\n    return false;\n  }\n}\n"]}

package/workflows/container-contents/container-state/readLocalPurgeScope.js

@@ -1,18 +0,0 @@
-import { sqlDocumentsPersistence } from "../../../data/persistence/documents/documentsPersistence.js";
-import { getClientSQLitePersistenceRuntime } from "../../../data/sqlite/sqlitePersistenceRuntime.js";
-import { runSerializedSqlMutation } from "../../../data/sqlite/sqlSchema.js";
-import { assertLocalPurgeScope } from "./localPurgeScope.js";
-/** Final local scope check before HTTP dispatch, with no remote I/O under lock. */
-export function readLocalPurgeScope(input, document) {
-    return runSerializedSqlMutation(input.execSql, async (lockedExecSql) => getClientSQLitePersistenceRuntime(lockedExecSql).transaction(async () => {
-        await assertLocalPurgeScope({ ...input, execSql: lockedExecSql });
-        if (!document)
-            return true;
-        const current = await sqlDocumentsPersistence.loadDocument(lockedExecSql, document.id);
-        return (current !== null &&
-            current.documentId === document.documentId &&
-            current.containerId === document.containerId &&
-            input.stillCurrent?.() !== false);
-    }, { behavior: "immediate" }));
-}
-//# sourceMappingURL=readLocalPurgeScope.js.map

package/workflows/container-contents/container-state/readLocalPurgeScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"readLocalPurgeScope.js","sourceRoot":"","sources":["readLocalPurgeScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,KAAkD,EAClD,QAA0B;IAE1B,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CACrE,iCAAiC,CAAC,aAAa,CAAC,CAAC,WAAW,CAC1D,KAAK,IAAI,EAAE;QACT,MAAM,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,aAAa,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,CACL,OAAO,KAAK,IAAI;YAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;IACJ,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../data/documents/documentSummary\";\nimport { sqlDocumentsPersistence } from \"../../../data/persistence/documents/documentsPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../../data/sqlite/sqlitePersistenceRuntime\";\nimport { runSerializedSqlMutation } from \"../../../data/sqlite/sqlSchema\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\n\n/** Final local scope check before HTTP dispatch, with no remote I/O under lock. */\nexport function readLocalPurgeScope(\n  input: Parameters<typeof assertLocalPurgeScope>[0],\n  document?: DocumentSummary,\n): Promise<boolean> {\n  return runSerializedSqlMutation(input.execSql, async (lockedExecSql) =>\n    getClientSQLitePersistenceRuntime(lockedExecSql).transaction(\n      async () => {\n        await assertLocalPurgeScope({ ...input, execSql: lockedExecSql });\n        if (!document) return true;\n        const current = await sqlDocumentsPersistence.loadDocument(\n          lockedExecSql,\n          document.id,\n        );\n        return (\n          current !== null &&\n          current.documentId === document.documentId &&\n          current.containerId === document.containerId &&\n          input.stillCurrent?.() !== false\n        );\n      },\n      { behavior: \"immediate\" },\n    ),\n  );\n}\n"]}

package/workflows/container-contents/container-state/share.js

@@ -1,283 +0,0 @@
-import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { projectionGeneration } from "../projectionGeneration.js";
-import { resolveCurrentGroupKeyEpoch } from "./groupShareEpoch.js";
-import { loadContainerWriterProjectionForState } from "./projectionCache.js";
-import { shareRemoteContainer, shareRemoteContainerWithGroup } from "./remote.js";
-import { persistDuplicateContainerShare, persistSharedContainerState, } from "./sharePersistence.js";
-function readOptionalProjectionString(projection, key) {
-    const value = Reflect.get(projection, key);
-    return typeof value === "string" && value.length > 0 ? value : null;
-}
-// A container's KEK is wrapped to a group's encapsulation key at a specific key
-// epoch, pinned into the manifest as a referenced principal head. When the group
-// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM
-// keypair), that wrap goes stale: members holding only the new epoch secret can
-// no longer unwrap it. A re-share to the same group at the same access level is
-// therefore NOT redundant when the pinned epoch trails the group's current head,
-// so it must not be deduped away. The current epoch comes from a network-fresh,
-// fully verified current policy guarded by durable local checkpoints.
-function groupGrantIsStale(input) {
-    const pinnedHead = (input.referencedPrincipalHeads ?? []).find((head) => head.principalType === "group" && head.principalId === input.subjectId);
-    if (!pinnedHead) {
-        return true;
-    }
-    return pinnedHead.keyEpoch !== input.currentKeyEpoch;
-}
-async function loadRemoteContainerShareContext(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    const projection = await loadContainerWriterProjectionForState({
-        containerState: input.containerState,
-        runtime: input.runtime,
-    });
-    if (!projection || input.stillCurrent?.() === false) {
-        return null;
-    }
-    const target = getTargetContainerContext(projection);
-    const remoteState = readContainerState(target.manifest);
-    const hasMatchingGrant = remoteState.directGrants.some((grant) => grant.subjectType === input.subjectType &&
-        grant.subjectId === input.subjectId &&
-        grant.accessLevel === input.accessLevel);
-    if (!hasMatchingGrant) {
-        if (input.requireExistingGrant) {
-            // Re-wrap-only callers must never mint a brand-new grant: the container's
-            // system slot is server-supplied and could point at a container that does
-            // not already grant this subject, so minting here would leak its contents.
-            input.runtime.util.log(`Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`);
-            return null;
-        }
-        return { matchingGrant: null, projection };
-    }
-    if (input.subjectType === "group" &&
-        input.requireExistingGrant &&
-        input.forceExistingGrantRewrap) {
-        // The cheap epoch probe below reads an unverified response and cannot prove
-        // that a security-critical re-wrap is current. Force the verified policy
-        // load and a real same-level mutation; failures must reach the retry owner.
-        input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`);
-        return { matchingGrant: null, projection };
-    }
-    if (input.subjectType === "group") {
-        const pinnedHead = remoteState.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === input.subjectId);
-        const currentKeyEpoch = pinnedHead
-            ? await resolveCurrentGroupKeyEpoch({
-                expectedGroupName: input.expectedGroupName,
-                groupId: input.subjectId,
-                organizationId: remoteState.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            })
-            : null;
-        if (input.stillCurrent?.() === false)
-            return null;
-        if (!pinnedHead ||
-            (currentKeyEpoch !== null &&
-                groupGrantIsStale({
-                    currentKeyEpoch,
-                    referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
-                    subjectId: input.subjectId,
-                }))) {
-            input.runtime.util.log(`Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`);
-            return { matchingGrant: null, projection };
-        }
-    }
-    return {
-        matchingGrant: {
-            accessEpoch: remoteState.epoch,
-            accessStateHash: target.manifest.manifestHash,
-            createdAt: readOptionalProjectionString(projection, "createdAt"),
-            metadataDocumentId: remoteState.metadataDocumentId,
-            referencedPrincipalHeads: remoteState.referencedPrincipalHeads,
-            updatedAt: readOptionalProjectionString(projection, "updatedAt"),
-        },
-        projection,
-    };
-}
-async function prepareContainerStateGroupRewrapInternal(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    const projection = await loadContainerWriterProjectionForState({
-        containerState: input.containerState,
-        runtime: input.runtime,
-    });
-    if (!projection || input.stillCurrent?.() === false) {
-        return null;
-    }
-    if (input.requireExistingGrant) {
-        await verifyContainerWriterProjection({
-            execSql: input.runtime.infra.execSql,
-            projection,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
-        });
-        if (input.stillCurrent?.() === false)
-            return null;
-        const verifiedState = readContainerState(getTargetContainerContext(projection).manifest);
-        if (projection.containerId !== input.containerState.container.id ||
-            projection.organizationId !==
-                input.containerState.container.organizationId ||
-            verifiedState.containerId !== input.containerState.container.id ||
-            verifiedState.organizationId !==
-                input.containerState.container.organizationId ||
-            verifiedState.parentContainerId !==
-                input.containerState.container.parentId) {
-            throw new Error("Prepared container group re-wrap target is inconsistent");
-        }
-        const hasGrant = verifiedState.directGrants.some((grant) => grant.subjectType === "group" &&
-            grant.subjectId === input.groupId &&
-            grant.accessLevel === input.accessLevel);
-        if (!hasGrant) {
-            return { status: "not-granted" };
-        }
-    }
-    const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;
-    if (!targetSecretKey) {
-        return null;
-    }
-    const target = getTargetContainerContext(projection);
-    const keksByEpochId = await unwrapContainerKekPath({
-        execSql: input.runtime.infra.execSql,
-        projection,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        secretKey: targetSecretKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
-    });
-    if (input.stillCurrent?.() === false)
-        return null;
-    const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);
-    return targetKek
-        ? {
-            knownContainerKeks: new Map([
-                [target.kek.containerKeyEpochId, targetKek],
-            ]),
-            status: "prepared",
-        }
-        : null;
-}
-export function prepareContainerStateGroupRewrap(input) {
-    return nullOnProjectionVerificationCancellation(() => prepareContainerStateGroupRewrapInternal(input));
-}
-export async function shareContainerState(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    // Before the projection load and the share request: a hint that lands during
-    // either must keep the resulting projection out of the cache.
-    const writerProjectionGeneration = projectionGeneration(input.containerState);
-    const shareContext = await loadRemoteContainerShareContext({
-        accessLevel: input.accessLevel,
-        containerState: input.containerState,
-        runtime: input.runtime,
-        stillCurrent: input.stillCurrent,
-        subjectId: input.recipientUserId,
-        subjectType: "user",
-    });
-    if (!shareContext || input.stillCurrent?.() === false) {
-        return null;
-    }
-    if (shareContext.matchingGrant) {
-        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`);
-        return persistDuplicateContainerShare({
-            containerState: input.containerState,
-            grant: shareContext.matchingGrant,
-            persistence: input.persistence,
-            projection: shareContext.projection,
-            runtime: input.runtime,
-            stillCurrent: input.stillCurrent,
-            writerProjectionGeneration,
-        });
-    }
-    const shared = await shareRemoteContainer({
-        accessLevel: input.accessLevel,
-        containerId: input.containerState.container.id,
-        previousProjection: shareContext.projection,
-        recipientUserId: input.recipientUserId,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        runtime: input.runtime,
-        stillCurrent: input.stillCurrent,
-    });
-    if (!shared)
-        return null;
-    if (input.stillCurrent?.() === false)
-        return { status: "confirmed" };
-    return persistSharedContainerState({
-        containerState: input.containerState,
-        persistence: input.persistence,
-        runtime: input.runtime,
-        shared,
-        stillCurrent: input.stillCurrent,
-        writerProjectionGeneration,
-    });
-}
-export async function shareContainerStateWithGroup(input) {
-    // A share chosen by name must carry that name so it can be bound to the
-    // signed group policy. Only the grant-preserving re-wrap, which never mints
-    // a grant, may run without one. Enforced here, in the workflow facade, so
-    // every caller (not only the store) meets the invariant.
-    if (!input.requireExistingGrant && input.expectedGroupName === undefined) {
-        throw new Error("Container group share requires the chosen group name");
-    }
-    if (input.stillCurrent?.() === false)
-        return null;
-    // Before the projection load and the share request: a hint that lands during
-    // either must keep the resulting projection out of the cache.
-    const writerProjectionGeneration = projectionGeneration(input.containerState);
-    const shareContext = await loadRemoteContainerShareContext({
-        accessLevel: input.accessLevel,
-        containerState: input.containerState,
-        expectedGroupName: input.expectedGroupName,
-        forceExistingGrantRewrap: input.requireExistingGrant && input.knownContainerKeks !== undefined,
-        requireExistingGrant: input.requireExistingGrant,
-        runtime: input.runtime,
-        stillCurrent: input.stillCurrent,
-        subjectId: input.recipientGroupId,
-        subjectType: "group",
-    });
-    if (!shareContext || input.stillCurrent?.() === false) {
-        return null;
-    }
-    if (shareContext.matchingGrant) {
-        // A duplicate share mints nothing, but it must not report success for a
-        // group the user did not choose. A matching grant is only found after the
-        // key-epoch probe verified the group's policy with the chosen name bound,
-        // so the name is already checked here.
-        input.runtime.util.log(`Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`);
-        return persistDuplicateContainerShare({
-            containerState: input.containerState,
-            grant: shareContext.matchingGrant,
-            persistence: input.persistence,
-            projection: shareContext.projection,
-            runtime: input.runtime,
-            stillCurrent: input.stillCurrent,
-            writerProjectionGeneration,
-        });
-    }
-    const shared = await shareRemoteContainerWithGroup({
-        accessLevel: input.accessLevel,
-        containerId: input.containerState.container.id,
-        expectedGroupName: input.expectedGroupName,
-        knownContainerKeks: input.knownContainerKeks,
-        previousProjection: shareContext.projection,
-        recipientGroupId: input.recipientGroupId,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        runtime: input.runtime,
-        stillCurrent: input.stillCurrent,
-    });
-    if (!shared)
-        return null;
-    if (input.stillCurrent?.() === false)
-        return { status: "confirmed" };
-    return persistSharedContainerState({
-        containerState: input.containerState,
-        persistence: input.persistence,
-        runtime: input.runtime,
-        shared,
-        stillCurrent: input.stillCurrent,
-        writerProjectionGeneration,
-    });
-}
-//# sourceMappingURL=share.js.map

package/workflows/container-contents/container-state/share.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"share.js","sourceRoot":"","sources":["share.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAEL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAc5B,SAAS,4BAA4B,CACnC,UAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAI1B;IACC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,+CAA+C,KAAK,CAAC,WAAW,cAAc,KAAK,CAAC,SAAS,iBAAiB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kDAAkD,CAClM,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IACE,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,wBAAwB,EAC9B,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,gDAAgD,CAC5J,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAC1D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;QACF,MAAM,eAAe,GAAG,UAAU;YAChC,CAAC,CAAC,MAAM,2BAA2B,CAAC;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,CAAC,UAAU;YACX,CAAC,eAAe,KAAK,IAAI;gBACvB,iBAAiB,CAAC;oBAChB,eAAe;oBACf,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;oBAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC,EACL,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,uDAAuD,CACnK,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE;YACb,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC7C,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;YAChE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;YAClD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;SACjE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAQvD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,aAAa,GAAG,kBAAkB,CACtC,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;QACF,IACE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC5D,UAAU,CAAC,cAAc;gBACvB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC/D,aAAa,CAAC,cAAc;gBAC1B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,iBAAiB;gBAC7B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,UAAU;QACV,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,SAAS,EAAE,eAAe;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,SAAS;QACd,CAAC,CAAC;YACE,kBAAkB,EAAE,IAAI,GAAG,CAAC;gBAC1B,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC;aAC5C,CAAC;YACF,MAAM,EAAE,UAAU;SACnB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAqE;IAErE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,wCAAwC,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,cAAc,KAAK,CAAC,eAAe,EAAE,CACpI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAelD;IACC,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,wBAAwB,EACtB,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,gBAAgB;QACjC,WAAW,EAAE,OAAO;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uCAAuC;QACvC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,gBAAgB,EAAE,CACtI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport { projectionGeneration } from \"../projectionGeneration\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { resolveCurrentGroupKeyEpoch } from \"./groupShareEpoch\";\nimport { loadContainerWriterProjectionForState } from \"./projectionCache\";\nimport { shareRemoteContainer, shareRemoteContainerWithGroup } from \"./remote\";\nimport {\n  type MatchingRemoteContainerGrant,\n  persistDuplicateContainerShare,\n  persistSharedContainerState,\n} from \"./sharePersistence\";\nimport type {\n  ContainerWorkflowRuntime,\n  SharedContainerStateResult,\n} from \"./types\";\n\ntype ContainerShareSubjectType = \"group\" | \"user\";\ntype ContainerShareAccessLevel = \"read\" | \"write\" | \"admin\";\n\ninterface RemoteContainerShareContext {\n  matchingGrant: MatchingRemoteContainerGrant | null;\n  projection: ContainerWriterProjectionResponse;\n}\n\nfunction readOptionalProjectionString(\n  projection: ContainerWriterProjectionResponse,\n  key: string,\n): string | null {\n  const value = Reflect.get(projection, key);\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n// A container's KEK is wrapped to a group's encapsulation key at a specific key\n// epoch, pinned into the manifest as a referenced principal head. When the group\n// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM\n// keypair), that wrap goes stale: members holding only the new epoch secret can\n// no longer unwrap it. A re-share to the same group at the same access level is\n// therefore NOT redundant when the pinned epoch trails the group's current head,\n// so it must not be deduped away. The current epoch comes from a network-fresh,\n// fully verified current policy guarded by durable local checkpoints.\nfunction groupGrantIsStale(input: {\n  currentKeyEpoch: number;\n  referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n  subjectId: string;\n}): boolean {\n  const pinnedHead = (input.referencedPrincipalHeads ?? []).find(\n    (head) =>\n      head.principalType === \"group\" && head.principalId === input.subjectId,\n  );\n  if (!pinnedHead) {\n    return true;\n  }\n  return pinnedHead.keyEpoch !== input.currentKeyEpoch;\n}\n\nasync function loadRemoteContainerShareContext(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  forceExistingGrantRewrap?: boolean | undefined;\n  requireExistingGrant?: boolean | undefined;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n  subjectId: string;\n  subjectType: ContainerShareSubjectType;\n}): Promise<RemoteContainerShareContext | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const remoteState = readContainerState(target.manifest);\n  const hasMatchingGrant = remoteState.directGrants.some(\n    (grant) =>\n      grant.subjectType === input.subjectType &&\n      grant.subjectId === input.subjectId &&\n      grant.accessLevel === input.accessLevel,\n  );\n  if (!hasMatchingGrant) {\n    if (input.requireExistingGrant) {\n      // Re-wrap-only callers must never mint a brand-new grant: the container's\n      // system slot is server-supplied and could point at a container that does\n      // not already grant this subject, so minting here would leak its contents.\n      input.runtime.util.log(\n        `Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`,\n      );\n      return null;\n    }\n    return { matchingGrant: null, projection };\n  }\n\n  if (\n    input.subjectType === \"group\" &&\n    input.requireExistingGrant &&\n    input.forceExistingGrantRewrap\n  ) {\n    // The cheap epoch probe below reads an unverified response and cannot prove\n    // that a security-critical re-wrap is current. Force the verified policy\n    // load and a real same-level mutation; failures must reach the retry owner.\n    input.runtime.util.log(\n      `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`,\n    );\n    return { matchingGrant: null, projection };\n  }\n\n  if (input.subjectType === \"group\") {\n    const pinnedHead = remoteState.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.subjectId,\n    );\n    const currentKeyEpoch = pinnedHead\n      ? await resolveCurrentGroupKeyEpoch({\n          expectedGroupName: input.expectedGroupName,\n          groupId: input.subjectId,\n          organizationId: remoteState.organizationId,\n          runtime: input.runtime,\n          stillCurrent: input.stillCurrent,\n        })\n      : null;\n    if (input.stillCurrent?.() === false) return null;\n    if (\n      !pinnedHead ||\n      (currentKeyEpoch !== null &&\n        groupGrantIsStale({\n          currentKeyEpoch,\n          referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n          subjectId: input.subjectId,\n        }))\n    ) {\n      input.runtime.util.log(\n        `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`,\n      );\n      return { matchingGrant: null, projection };\n    }\n  }\n\n  return {\n    matchingGrant: {\n      accessEpoch: remoteState.epoch,\n      accessStateHash: target.manifest.manifestHash,\n      createdAt: readOptionalProjectionString(projection, \"createdAt\"),\n      metadataDocumentId: remoteState.metadataDocumentId,\n      referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n      updatedAt: readOptionalProjectionString(projection, \"updatedAt\"),\n    },\n    projection,\n  };\n}\n\nasync function prepareContainerStateGroupRewrapInternal(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  groupId: string;\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | { status: \"not-granted\" }\n  | {\n      knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n      status: \"prepared\";\n    }\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  if (input.requireExistingGrant) {\n    await verifyContainerWriterProjection({\n      execSql: input.runtime.infra.execSql,\n      projection,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n        input.runtime,\n      ),\n    });\n    if (input.stillCurrent?.() === false) return null;\n    const verifiedState = readContainerState(\n      getTargetContainerContext(projection).manifest,\n    );\n    if (\n      projection.containerId !== input.containerState.container.id ||\n      projection.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.containerId !== input.containerState.container.id ||\n      verifiedState.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.parentContainerId !==\n        input.containerState.container.parentId\n    ) {\n      throw new Error(\n        \"Prepared container group re-wrap target is inconsistent\",\n      );\n    }\n    const hasGrant = verifiedState.directGrants.some(\n      (grant) =>\n        grant.subjectType === \"group\" &&\n        grant.subjectId === input.groupId &&\n        grant.accessLevel === input.accessLevel,\n    );\n    if (!hasGrant) {\n      return { status: \"not-granted\" };\n    }\n  }\n\n  const targetSecretKey =\n    input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;\n  if (!targetSecretKey) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.runtime.infra.execSql,\n    projection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    secretKey: targetSecretKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);\n  return targetKek\n    ? {\n        knownContainerKeks: new Map([\n          [target.kek.containerKeyEpochId, targetKek],\n        ]),\n        status: \"prepared\",\n      }\n    : null;\n}\n\nexport function prepareContainerStateGroupRewrap(\n  input: Parameters<typeof prepareContainerStateGroupRewrapInternal>[0],\n): ReturnType<typeof prepareContainerStateGroupRewrapInternal> {\n  return nullOnProjectionVerificationCancellation(() =>\n    prepareContainerStateGroupRewrapInternal(input),\n  );\n}\n\nexport async function shareContainerState(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  persistence: ContainerContentsPersistence;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientUserId,\n    subjectType: \"user\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainer({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    previousProjection: shareContext.projection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n\nexport async function shareContainerStateWithGroup(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistence: ContainerContentsPersistence;\n  recipientGroupId: string;\n  // When set, a re-share only re-wraps an already-granted group and never mints\n  // a new grant. Used by organization access repair so a server cannot redirect\n  // the operation onto a container the group is not entitled to. A prepared\n  // re-wrap also supplies captured KEKs and must submit a real mutation.\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  // A share chosen by name must carry that name so it can be bound to the\n  // signed group policy. Only the grant-preserving re-wrap, which never mints\n  // a grant, may run without one. Enforced here, in the workflow facade, so\n  // every caller (not only the store) meets the invariant.\n  if (!input.requireExistingGrant && input.expectedGroupName === undefined) {\n    throw new Error(\"Container group share requires the chosen group name\");\n  }\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    expectedGroupName: input.expectedGroupName,\n    forceExistingGrantRewrap:\n      input.requireExistingGrant && input.knownContainerKeks !== undefined,\n    requireExistingGrant: input.requireExistingGrant,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientGroupId,\n    subjectType: \"group\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    // A duplicate share mints nothing, but it must not report success for a\n    // group the user did not choose. A matching grant is only found after the\n    // key-epoch probe verified the group's policy with the chosen name bound,\n    // so the name is already checked here.\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainerWithGroup({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    expectedGroupName: input.expectedGroupName,\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: shareContext.projection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n"]}