@keyneom/sync-kit 0.1.1 → 0.2.0-rc.1

package/dist/sharing/controller.js

@@ -0,0 +1,693 @@
+import { SyncKitError } from "../core/errors.js";
+import { canAdministerSharedBackup, parseSharedBackupEnvelopeV1, sharedBackupParticipant, sharedBackupParticipants, } from "./index.js";
+import { acceptSharingPublicKeyResponseV1, createSharedBackupEnvelopeV1, createSharingInvitationV1, createSharingPublicKeyResponseV1, decryptSharedBackupEnvelopeV1, verifySharedBackupEnvelopeV1, verifySharingInvitationV1, } from "./web-crypto.js";
+import { formatSharingInviteEmailMessage, appendSharingJoinParams } from "./join.js";
+export { IndexedDbSharedBackupRegistry } from "./registry-indexeddb.js";
+export class MemorySharedBackupRegistry {
+    records = new Map();
+    get(datasetId) {
+        const record = this.records.get(datasetId);
+        return Promise.resolve(record ? structuredClone(record) : null);
+    }
+    set(record) {
+        this.records.set(record.datasetId, structuredClone(record));
+        return Promise.resolve();
+    }
+    delete(datasetId) {
+        this.records.delete(datasetId);
+        return Promise.resolve();
+    }
+}
+/**
+ * Headless, backend-independent sharing orchestration. Consumers own UI,
+ * persistence, lifecycle policy, and conflict resolution.
+ */
+export class SharedBackupController {
+    options;
+    queue = Promise.resolve();
+    constructor(options) {
+        this.options = options;
+        if (!options.appId.trim())
+            throw new TypeError("appId must not be empty.");
+    }
+    ensureStorage() {
+        return this.options.transport.ensureStorage();
+    }
+    listDatasets() {
+        return this.options.transport.listDatasets();
+    }
+    createDataset(datasetId, value) {
+        return this.serialized(async () => {
+            requireNonEmpty(datasetId, "datasetId");
+            const duplicate = (await this.options.transport.listDatasets()).find((dataset) => dataset.datasetId === datasetId);
+            if (duplicate) {
+                throw new SyncKitError("conflict", `Dataset ${datasetId} already exists.`);
+            }
+            const identity = await this.options.identity();
+            const envelope = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
+                appId: this.options.appId,
+                backupId: datasetId,
+                participants: [
+                    { publicKey: identity.publicKey, role: "owner" },
+                ],
+            }, this.cryptoOptions());
+            const stored = await this.options.transport.createDataset(datasetId, envelope);
+            await this.persistHead(stored, identity.publicKey.keyId);
+            return result(stored, value, "created");
+        });
+    }
+    loadDataset(datasetId) {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(datasetId);
+            const record = await this.requiredRegistry(datasetId);
+            await this.verifyHead(stored, record);
+            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, await this.options.identity(), this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+            await this.persistHead(stored, record.trustedOwnerKeyId, record);
+            return result(stored, value, "loaded");
+        });
+    }
+    syncDataset(datasetId, localValue) {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(datasetId);
+            const record = await this.requiredRegistry(datasetId);
+            const forked = await this.verifyHead(stored, record, true);
+            const identity = await this.options.identity();
+            const remoteValue = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+            if (forked) {
+                const decision = await this.options.resolveFork?.({
+                    datasetId,
+                    lastVerifiedRevisionId: record.lastRevisionId ?? "",
+                    remoteRevisionId: stored.envelope.revisionId,
+                    localValue,
+                    remoteValue,
+                });
+                if (decision !== "merge") {
+                    throw new SyncKitError("conflict", `Dataset ${datasetId} has a divergent signed head.`);
+                }
+            }
+            const merged = this.options.codec.merge(localValue, remoteValue);
+            if (this.options.codec.fingerprint(merged) ===
+                this.options.codec.fingerprint(remoteValue)) {
+                await this.persistHead(stored, record.trustedOwnerKeyId, record);
+                return result(stored, merged, "unchanged");
+            }
+            const next = await createSharedBackupEnvelopeV1(merged, this.options.codec, identity, {
+                appId: this.options.appId,
+                backupId: datasetId,
+                participants: participantInputs(stored.envelope),
+                previous: stored.envelope,
+            }, this.cryptoOptions());
+            const updated = await this.options.transport.writeDataset(stored, next);
+            await this.persistHead(updated, record.trustedOwnerKeyId, record);
+            return result(updated, merged, "updated");
+        });
+    }
+    inviteParticipant(input) {
+        return this.serialized(async () => {
+            const identity = await this.options.identity();
+            const trustedOwnerKeyIds = new Set();
+            for (const grant of input.requestedGrants) {
+                const stored = await this.readDatasetById(grant.datasetId);
+                const record = await this.requiredRegistry(grant.datasetId);
+                const verified = await verifySharedBackupEnvelopeV1(stored.envelope, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+                const actor = sharedBackupParticipant(verified, identity.publicKey.keyId);
+                if (!actor || !canAdministerSharedBackup(actor.role)) {
+                    throw new SyncKitError("authorization", `This identity cannot invite participants to ${grant.datasetId}.`);
+                }
+                trustedOwnerKeyIds.add(record.trustedOwnerKeyId);
+            }
+            if (trustedOwnerKeyIds.size !== 1) {
+                throw new SyncKitError("configuration", "One invitation cannot combine datasets with different owner trust roots.");
+            }
+            const trustedOwnerKeyId = [...trustedOwnerKeyIds][0];
+            if (!trustedOwnerKeyId) {
+                throw new SyncKitError("state", "The invitation has no owner trust root.");
+            }
+            const storage = await this.options.transport.ensureStorage();
+            const appDisplayName = input.appDisplayName?.trim() ?? this.options.appId;
+            const emailMessage = input.emailMessage ??
+                (input.joinLandingUrl
+                    ? formatSharingInviteEmailMessage({
+                        joinUrl: appendSharingJoinParams(input.joinLandingUrl, {
+                            appFolderId: storage.appFolderId,
+                        }),
+                        appDisplayName,
+                    })
+                    : input.joinUrl
+                        ? formatSharingInviteEmailMessage({
+                            joinUrl: input.joinUrl,
+                            appDisplayName,
+                        })
+                        : undefined);
+            const access = await this.options.transport.grantExchangeAccess(input.emailAddress, {
+                ...(input.sendNotificationEmail === undefined
+                    ? {}
+                    : { sendNotificationEmail: input.sendNotificationEmail }),
+                ...(emailMessage ? { emailMessage } : {}),
+            });
+            const invitation = await createSharingInvitationV1(identity, {
+                appId: this.options.appId,
+                appFolderId: access.appFolderId,
+                recipientDrivePermissionId: access.drivePermissionId,
+                requestedGrants: input.requestedGrants,
+                trustedOwnerKeyId,
+                ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
+            }, this.cryptoOptions());
+            return {
+                invitation,
+                invitationFileId: await this.options.transport.createInvitation(invitation),
+                drivePermissionId: access.drivePermissionId,
+            };
+        });
+    }
+    listExchanges(options) {
+        return this.options.transport.listExchanges(options);
+    }
+    submitKeyResponse(invitationFileId) {
+        return this.serialized(async () => {
+            const invitation = await verifySharingInvitationV1(await this.options.transport.readInvitation(invitationFileId), {
+                crypto: this.crypto(),
+                ...(this.options.now ? { now: this.options.now } : {}),
+            });
+            const storage = await this.options.transport.ensureStorage();
+            if (invitation.appId !== this.options.appId ||
+                invitation.appFolderId !== storage.appFolderId) {
+                throw new SyncKitError("compatibility", "The invitation belongs to another app storage hierarchy.");
+            }
+            const identity = await this.options.identity();
+            const accountBinding = await this.options.createAccountBinding?.({
+                appId: this.options.appId,
+                exchangeId: invitation.exchangeId,
+                sharingKeyId: identity.publicKey.keyId,
+            });
+            const response = await createSharingPublicKeyResponseV1(identity, {
+                appId: this.options.appId,
+                exchangeId: invitation.exchangeId,
+                ...(accountBinding ? { accountBinding } : {}),
+            }, this.cryptoOptions());
+            const datasets = await this.options.transport.listDatasets();
+            const registrations = await Promise.all(invitation.requestedGrants.map(async (grant) => {
+                const file = datasets.find((dataset) => dataset.datasetId === grant.datasetId);
+                const existing = await this.options.registry.get(grant.datasetId);
+                return { grant, file, existing };
+            }));
+            for (const { grant, existing } of registrations) {
+                if (existing &&
+                    existing.trustedOwnerKeyId !== invitation.trustedOwnerKeyId) {
+                    throw new SyncKitError("conflict", `Dataset ${grant.datasetId} is already pinned to another owner key.`);
+                }
+            }
+            for (const { grant, file, existing } of registrations) {
+                await this.options.registry.set(existing
+                    ? {
+                        ...existing,
+                        ...(file ? { fileId: file.fileId } : {}),
+                    }
+                    : {
+                        datasetId: grant.datasetId,
+                        ...(file ? { fileId: file.fileId } : {}),
+                        trustedOwnerKeyId: invitation.trustedOwnerKeyId,
+                    });
+            }
+            return {
+                responseFileId: await this.options.transport.createKeyResponse(response),
+                exchangeId: invitation.exchangeId,
+            };
+        });
+    }
+    acceptKeyResponse(input) {
+        return this.serialized(async () => {
+            const identity = await this.options.identity();
+            const responseFile = await this.options.transport.readKeyResponse(input.responseFileId, input.invitation.recipientDrivePermissionId);
+            const binding = responseFile.response.accountBinding;
+            if (this.options.requireAccountBinding && !binding) {
+                throw new SyncKitError("authorization", "The key response has no required Google/passkey account binding.");
+            }
+            const verifiedAccount = binding && this.options.verifyAccountBinding
+                ? await this.options.verifyAccountBinding(binding, {
+                    appId: this.options.appId,
+                    exchangeId: input.invitation.exchangeId,
+                    sharingKeyId: responseFile.response.keyId,
+                    credentialId: binding.passkey.credentialId,
+                })
+                : undefined;
+            if (binding &&
+                this.options.requireAccountBinding &&
+                !this.options.verifyAccountBinding) {
+                throw new SyncKitError("configuration", "Account binding is required but no verifier is configured.");
+            }
+            const accepted = await acceptSharingPublicKeyResponseV1(input.invitation, responseFile.response, {
+                acceptedByKeyId: identity.publicKey.keyId,
+                drivePermissionId: responseFile.ownerPermissionId,
+                ...(verifiedAccount
+                    ? { googleSubject: verifiedAccount.subject }
+                    : {}),
+            }, this.cryptoOptions());
+            if (verifiedAccount) {
+                await this.options.transport.deleteExchange(input.responseFileId);
+            }
+            const results = [];
+            for (const grant of accepted) {
+                try {
+                    const stored = await this.readDatasetById(grant.datasetId);
+                    const record = (await this.options.registry.get(grant.datasetId)) ??
+                        this.initialOwnerRecord(stored);
+                    await this.verifyHead(stored, record);
+                    const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+                    const participants = participantInputs(stored.envelope).filter((participant) => participant.publicKey.keyId !==
+                        grant.participant.publicKey.keyId);
+                    participants.push(grant.participant);
+                    const next = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
+                        appId: this.options.appId,
+                        backupId: grant.datasetId,
+                        participants,
+                        previous: stored.envelope,
+                    }, this.cryptoOptions());
+                    const updated = await this.options.transport.writeDataset(stored, next);
+                    const permission = await this.options.transport.setDatasetPermission(stored.fileId, input.recipientEmailAddress, grant.participant.role === "owner"
+                        ? "admin"
+                        : grant.participant.role, {
+                        hasInheritedReadAccess: true,
+                    });
+                    const participantPermissionIds = {
+                        ...record.participantPermissionIds,
+                        ...(permission.permissionId
+                            ? {
+                                [grant.participant.publicKey.keyId]: permission.permissionId,
+                            }
+                            : {}),
+                    };
+                    const nextRecord = {
+                        ...record,
+                        fileId: updated.fileId,
+                        lastRevisionId: updated.envelope.revisionId,
+                        participantPermissionIds,
+                    };
+                    await this.options.registry.set(nextRecord);
+                    results.push({
+                        datasetId: grant.datasetId,
+                        fileId: updated.fileId,
+                        revisionId: updated.envelope.revisionId,
+                        ...(permission.permissionId
+                            ? { permissionId: permission.permissionId }
+                            : {}),
+                        status: "accepted",
+                    });
+                }
+                catch (error) {
+                    results.push({
+                        datasetId: grant.datasetId,
+                        status: "failed",
+                        error,
+                    });
+                }
+            }
+            return results;
+        });
+    }
+    setDatasetRole(input) {
+        return this.changeParticipants(input.datasetId, (stored, value) => {
+            const participants = participantInputs(stored.envelope);
+            const participant = participants.find((candidate) => candidate.publicKey.keyId === input.keyId);
+            if (!participant) {
+                throw new SyncKitError("not-found", `Participant ${input.keyId} is not in this dataset.`);
+            }
+            participant.role = input.role;
+            return Promise.resolve({
+                participants,
+                value,
+                afterWrite: async (updated, record) => {
+                    const permission = await this.options.transport.setDatasetPermission(updated.fileId, input.emailAddress, input.role, {
+                        ...(record.participantPermissionIds?.[input.keyId]
+                            ? {
+                                existingDirectPermissionId: record.participantPermissionIds[input.keyId],
+                            }
+                            : {}),
+                        ...(input.role === "viewer"
+                            ? { hasInheritedReadAccess: true }
+                            : {}),
+                    });
+                    const participantPermissionIds = {
+                        ...record.participantPermissionIds,
+                        ...(permission.permissionId
+                            ? { [input.keyId]: permission.permissionId }
+                            : {}),
+                    };
+                    await this.options.registry.set({
+                        ...record,
+                        participantPermissionIds,
+                    });
+                },
+            });
+        });
+    }
+    revokeDatasetKey(input) {
+        return this.changeParticipants(input.datasetId, (stored, value) => {
+            const participant = sharedBackupParticipant(stored.envelope, input.keyId);
+            if (!participant) {
+                throw new SyncKitError("not-found", `Participant ${input.keyId} is not in this dataset.`);
+            }
+            if (participant.role === "owner") {
+                throw new SyncKitError("authorization", "Owner transfer or removal is not supported by sharing v1.");
+            }
+            const participants = participantInputs(stored.envelope).filter((candidate) => candidate.publicKey.keyId !== input.keyId);
+            return Promise.resolve({
+                participants,
+                value,
+                afterWrite: async (_updated, record) => {
+                    const permissionId = record.participantPermissionIds?.[input.keyId];
+                    if (permissionId) {
+                        await this.options.transport.removeDatasetPermission(stored.fileId, permissionId);
+                    }
+                    const participantPermissionIds = Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== input.keyId));
+                    await this.options.registry.set({
+                        ...record,
+                        participantPermissionIds,
+                    });
+                },
+            });
+        });
+    }
+    rotateLocalKey(replacementIdentity, datasetIds) {
+        return this.serialized(async () => {
+            const currentIdentity = await this.options.identity();
+            const results = [];
+            for (const datasetId of datasetIds) {
+                try {
+                    const stored = await this.readDatasetById(datasetId);
+                    const record = await this.requiredRegistry(datasetId);
+                    await this.verifyHead(stored, record);
+                    const current = sharedBackupParticipant(stored.envelope, currentIdentity.publicKey.keyId);
+                    if (!current || current.role === "viewer") {
+                        throw new SyncKitError("authorization", "Only a current owner, admin, or writer can rotate its own key.");
+                    }
+                    const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, currentIdentity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+                    const participants = participantInputs(stored.envelope).map((participant) => participant.publicKey.keyId === currentIdentity.publicKey.keyId
+                        ? {
+                            publicKey: replacementIdentity.publicKey,
+                            role: participant.role,
+                            ...(participant.accepted
+                                ? { accepted: participant.accepted }
+                                : {}),
+                        }
+                        : participant);
+                    const next = await createSharedBackupEnvelopeV1(value, this.options.codec, replacementIdentity, {
+                        appId: this.options.appId,
+                        backupId: datasetId,
+                        participants,
+                        previous: stored.envelope,
+                        keyRotation: { previousIdentity: currentIdentity },
+                    }, this.cryptoOptions());
+                    const updated = await this.options.transport.writeDataset(stored, next);
+                    const permission = record.participantPermissionIds?.[currentIdentity.publicKey.keyId];
+                    const permissions = Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== currentIdentity.publicKey.keyId));
+                    if (permission) {
+                        permissions[replacementIdentity.publicKey.keyId] = permission;
+                    }
+                    await this.persistHead(updated, record.trustedOwnerKeyId, {
+                        ...record,
+                        participantPermissionIds: permissions,
+                    });
+                    results.push({
+                        datasetId,
+                        status: "rotated",
+                        revisionId: updated.envelope.revisionId,
+                    });
+                }
+                catch (error) {
+                    results.push({ datasetId, status: "failed", error });
+                }
+            }
+            return results;
+        });
+    }
+    reconcileDrivePermissions(input) {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(input.datasetId);
+            const record = await this.requiredRegistry(input.datasetId);
+            await this.verifyHead(stored, record);
+            const identity = await this.options.identity();
+            const actor = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
+            if (!actor || !canAdministerSharedBackup(actor.role)) {
+                throw new SyncKitError("authorization", "Only a current owner or admin can reconcile Drive permissions.");
+            }
+            const livePermissions = await this.options.transport.listDatasetPermissions(stored.fileId);
+            const directPermissions = livePermissions.filter((permission) => !permission.inherited);
+            const actions = [];
+            const expectedPermissionIds = new Set();
+            let participantPermissionIds = {
+                ...record.participantPermissionIds,
+            };
+            const participants = sharedBackupParticipants(stored.envelope).filter((participant) => participant.role !== "owner");
+            for (const participant of participants) {
+                const emailAddress = input.participantEmails[participant.keyId]?.trim();
+                const expectedRole = sharingRoleToDriveRole(participant.role);
+                const permissionId = participantPermissionIds[participant.keyId];
+                const live = permissionId
+                    ? directPermissions.find((permission) => permission.permissionId === permissionId)
+                    : emailAddress
+                        ? directPermissions.find((permission) => permission.emailAddress?.toLowerCase() ===
+                            emailAddress.toLowerCase())
+                        : undefined;
+                if (participant.role === "viewer" &&
+                    !permissionId &&
+                    !emailAddress &&
+                    livePermissions.some((permission) => permission.inherited && permission.role === "reader")) {
+                    actions.push({
+                        kind: "unchanged",
+                        keyId: participant.keyId,
+                    });
+                    continue;
+                }
+                if (!emailAddress) {
+                    if (live?.role === expectedRole) {
+                        expectedPermissionIds.add(live.permissionId);
+                        actions.push({ kind: "unchanged", keyId: participant.keyId });
+                    }
+                    else {
+                        actions.push({
+                            kind: "skipped",
+                            keyId: participant.keyId,
+                            reason: "No email address was provided for reconciliation.",
+                        });
+                        if (live) {
+                            expectedPermissionIds.add(live.permissionId);
+                        }
+                    }
+                    continue;
+                }
+                if (live?.role === expectedRole) {
+                    expectedPermissionIds.add(live.permissionId);
+                    if (permissionId !== live.permissionId) {
+                        participantPermissionIds = {
+                            ...participantPermissionIds,
+                            [participant.keyId]: live.permissionId,
+                        };
+                    }
+                    actions.push({ kind: "unchanged", keyId: participant.keyId });
+                    continue;
+                }
+                const permission = await this.options.transport.setDatasetPermission(stored.fileId, emailAddress, participant.role, {
+                    ...(live?.permissionId
+                        ? { existingDirectPermissionId: live.permissionId }
+                        : {}),
+                    ...(participant.role === "viewer"
+                        ? { hasInheritedReadAccess: true }
+                        : {}),
+                });
+                if (!permission.permissionId) {
+                    actions.push({
+                        kind: "unchanged",
+                        keyId: participant.keyId,
+                    });
+                    continue;
+                }
+                expectedPermissionIds.add(permission.permissionId);
+                participantPermissionIds = {
+                    ...participantPermissionIds,
+                    [participant.keyId]: permission.permissionId,
+                };
+                actions.push({
+                    kind: live ? "updated" : "granted",
+                    keyId: participant.keyId,
+                    permissionId: permission.permissionId,
+                    role: permission.role,
+                });
+            }
+            if (JSON.stringify(participantPermissionIds) !==
+                JSON.stringify(record.participantPermissionIds ?? {})) {
+                await this.options.registry.set({
+                    ...record,
+                    participantPermissionIds,
+                });
+            }
+            const removedPermissionIds = new Set();
+            for (const permission of directPermissions) {
+                const tracked = Object.values(participantPermissionIds).includes(permission.permissionId);
+                if (tracked &&
+                    !expectedPermissionIds.has(permission.permissionId)) {
+                    await this.options.transport.removeDatasetPermission(stored.fileId, permission.permissionId);
+                    removedPermissionIds.add(permission.permissionId);
+                    actions.push({
+                        kind: "removed",
+                        permissionId: permission.permissionId,
+                    });
+                }
+            }
+            if (removedPermissionIds.size > 0) {
+                participantPermissionIds = Object.fromEntries(Object.entries(participantPermissionIds).filter(([, permissionId]) => !removedPermissionIds.has(permissionId)));
+                await this.options.registry.set({
+                    ...record,
+                    participantPermissionIds,
+                });
+            }
+            return { datasetId: input.datasetId, actions };
+        });
+    }
+    changeParticipants(datasetId, change) {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(datasetId);
+            const record = await this.requiredRegistry(datasetId);
+            await this.verifyHead(stored, record);
+            const identity = await this.options.identity();
+            const actor = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
+            if (!actor || !canAdministerSharedBackup(actor.role)) {
+                throw new SyncKitError("authorization", "Only a current owner or admin can change dataset access.");
+            }
+            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+            const changed = await change(stored, value);
+            const next = await createSharedBackupEnvelopeV1(changed.value, this.options.codec, identity, {
+                appId: this.options.appId,
+                backupId: datasetId,
+                participants: changed.participants,
+                previous: stored.envelope,
+            }, this.cryptoOptions());
+            const updated = await this.options.transport.writeDataset(stored, next);
+            const nextRecord = await this.persistHead(updated, record.trustedOwnerKeyId, record);
+            await changed.afterWrite?.(updated, nextRecord);
+            return result(updated, changed.value, "updated");
+        });
+    }
+    async readDatasetById(datasetId) {
+        requireNonEmpty(datasetId, "datasetId");
+        const record = await this.options.registry.get(datasetId);
+        const file = record?.fileId ??
+            (await this.options.transport.listDatasets()).find((candidate) => candidate.datasetId === datasetId)?.fileId;
+        if (!file) {
+            throw new SyncKitError("not-found", `Dataset ${datasetId} was not found.`);
+        }
+        return this.options.transport.readDataset(file);
+    }
+    async requiredRegistry(datasetId) {
+        const record = await this.options.registry.get(datasetId);
+        if (!record) {
+            throw new SyncKitError("state", `Dataset ${datasetId} has no pinned owner key. Open it from a verified invitation first.`);
+        }
+        return record;
+    }
+    async verifyHead(stored, record, allowFork = false) {
+        await verifySharedBackupEnvelopeV1(stored.envelope, this.crypto(), {
+            trustedOwnerKeyId: record.trustedOwnerKeyId,
+        });
+        if (!record.lastRevisionId)
+            return false;
+        if (stored.envelope.revisionId !== record.lastRevisionId &&
+            record.seenRevisionIds?.includes(stored.envelope.revisionId)) {
+            throw new SyncKitError("conflict", `Dataset ${stored.datasetId} rolled back to a previously verified revision.`);
+        }
+        if (stored.envelope.revisionId === record.lastRevisionId ||
+            stored.envelope.parentRevisionId === record.lastRevisionId ||
+            stored.envelope.revisionAncestors?.includes(record.lastRevisionId)) {
+            return false;
+        }
+        if (allowFork)
+            return true;
+        throw new SyncKitError("conflict", `Dataset ${stored.datasetId} has a divergent signed head.`);
+    }
+    initialOwnerRecord(stored) {
+        const owner = sharedBackupParticipants(stored.envelope).find((participant) => participant.role === "owner");
+        if (!owner) {
+            throw new SyncKitError("compatibility", "The dataset has no owner.");
+        }
+        return {
+            datasetId: stored.datasetId,
+            fileId: stored.fileId,
+            trustedOwnerKeyId: owner.keyId,
+        };
+    }
+    async persistHead(stored, trustedOwnerKeyId, previous) {
+        const record = {
+            datasetId: stored.datasetId,
+            fileId: stored.fileId,
+            trustedOwnerKeyId,
+            lastRevisionId: stored.envelope.revisionId,
+            seenRevisionIds: [
+                ...new Set([
+                    ...(previous?.seenRevisionIds ?? []),
+                    ...(previous?.lastRevisionId ? [previous.lastRevisionId] : []),
+                    stored.envelope.revisionId,
+                ]),
+            ].slice(-256),
+            ...(previous?.participantPermissionIds
+                ? { participantPermissionIds: previous.participantPermissionIds }
+                : {}),
+        };
+        await this.options.registry.set(record);
+        return record;
+    }
+    crypto() {
+        const implementation = this.options.crypto ?? globalThis.crypto;
+        if (!implementation?.subtle) {
+            throw new SyncKitError("configuration", "WebCrypto is required by the sharing controller.");
+        }
+        return implementation;
+    }
+    cryptoOptions() {
+        return {
+            crypto: this.crypto(),
+            ...(this.options.now ? { now: this.options.now } : {}),
+            ...(this.options.randomUUID
+                ? { randomUUID: this.options.randomUUID }
+                : {}),
+        };
+    }
+    serialized(operation) {
+        const run = this.queue.then(operation, operation);
+        this.queue = run.then(() => undefined, () => undefined);
+        return run;
+    }
+}
+export function createSharedBackupController(options) {
+    return new SharedBackupController(options);
+}
+function sharingRoleToDriveRole(role) {
+    return role === "viewer" ? "reader" : "writer";
+}
+function participantInputs(envelope) {
+    return sharedBackupParticipants(envelope).map((participant) => ({
+        publicKey: {
+            keyId: participant.keyId,
+            encryptionAlgorithm: participant.encryptionAlgorithm,
+            encryptionPublicKey: participant.encryptionPublicKey,
+            signatureAlgorithm: participant.signatureAlgorithm,
+            signingPublicKey: participant.signingPublicKey,
+        },
+        role: participant.role,
+        ...(participant.accepted ? { accepted: participant.accepted } : {}),
+    }));
+}
+function result(stored, value, outcome) {
+    const envelope = parseSharedBackupEnvelopeV1(stored.envelope);
+    return {
+        datasetId: stored.datasetId,
+        fileId: stored.fileId,
+        revisionId: envelope.revisionId,
+        value,
+        outcome,
+    };
+}
+function requireNonEmpty(value, name) {
+    if (!value.trim())
+        throw new TypeError(`${name} must not be empty.`);
+}
+//# sourceMappingURL=controller.js.map