@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/crypto/keying/documentAccess.js

@@ -0,0 +1,447 @@
+import { isPlainObject } from "../../validators/isPlainObject.js";
+import { computeAccessManifestHash, verifyAccessManifest, verifySignedAccessEvent, } from "./accessEvent.js";
+import { computeKeyingDomainHash } from "./canonical.js";
+import { assertAttachmentDocumentAuthority, requireAnyDocumentLinkedContainerWriteAccess, requireDocumentContainerPathWriteAccess, requireEventDependency, } from "./documentAccessAuthorization.js";
+import { normalizeDocumentAccessEventBody } from "./documentAccessBody.js";
+import { assertDocumentBlobRewrapScope } from "./documentBlobRewraps.js";
+import { assertDocumentLinkSetCitationScope } from "./documentCitationScope.js";
+import { assertExactKeys, normalizeUniqueSortedStrings, ok, readHashString, readNullableHashString, readNullableString, readPositiveInteger, readString, readStringArray, readVersion, runVerifier, throwVerification, toVerificationResult, } from "./shared.js";
+import { makeVerifiedAttachmentBinding, makeVerifiedAttachmentDetach, makeVerifiedContainerParentEdge, makeVerifiedDocumentLinkSetManifest, } from "./types.js";
+export { requireEventDependency } from "./documentAccessAuthorization.js";
+export { normalizeDocumentAccessEventBody } from "./documentAccessBody.js";
+export { requireWriteAccessThroughCommittedBlobTarget, requireWriteAccessThroughCommittedDocumentTarget, } from "./documentContentWriteAuthority.js";
+function normalizeDocumentLinkSetStructural(value) {
+    const record = assertExactKeys(value, ["linkedContainerIds"], "document link-set structural state");
+    const linkedContainerIds = normalizeUniqueSortedStrings(readStringArray(record, "linkedContainerIds", "document link-set structural state"), "document link-set linkedContainerIds");
+    if (linkedContainerIds.length === 0) {
+        throwVerification("missing_dependency", "document link-set must include at least one linked container");
+    }
+    return { linkedContainerIds };
+}
+export function normalizeDocumentLinkSetManifestState(value) {
+    const record = assertExactKeys(value, [
+        "documentId",
+        "epoch",
+        "eventHash",
+        "linkedContainerIds",
+        "organizationId",
+        "previousManifestHash",
+        "version",
+    ], "document link-set manifest state");
+    const structural = normalizeDocumentLinkSetStructural({
+        linkedContainerIds: record.linkedContainerIds,
+    });
+    return {
+        version: readVersion(record, "document link-set manifest state"),
+        documentId: readString(record, "documentId", "document link-set manifest state"),
+        organizationId: readString(record, "organizationId", "document link-set manifest state"),
+        epoch: readPositiveInteger(record, "epoch", "document link-set manifest state"),
+        previousManifestHash: readNullableHashString(record, "previousManifestHash", "document link-set manifest state"),
+        eventHash: readHashString(record, "eventHash", "document link-set manifest state"),
+        linkedContainerIds: structural.linkedContainerIds,
+    };
+}
+export async function computeDocumentLinkSetStructuralHash(structural) {
+    const payload = normalizeDocumentLinkSetStructural(structural);
+    return computeKeyingDomainHash("tearleads.keying.document-link-set-structural", payload);
+}
+export async function computeDocumentLinkSetGrantRoot() {
+    return computeKeyingDomainHash("tearleads.keying.document-link-set-grants", {
+        grants: [],
+    });
+}
+export async function computeDocumentLinkSetKeyTargetHash() {
+    return computeKeyingDomainHash("tearleads.keying.document-link-set-key-target", { targetMode: "current-linked-container-keks" });
+}
+export async function deriveDocumentLinkSetManifest(state) {
+    const normalizedState = normalizeDocumentLinkSetManifestState(state);
+    return {
+        version: 1,
+        objectKind: "document",
+        objectId: normalizedState.documentId,
+        organizationId: normalizedState.organizationId,
+        epoch: normalizedState.epoch,
+        previousManifestHash: normalizedState.previousManifestHash,
+        eventHash: normalizedState.eventHash,
+        structuralHash: await computeDocumentLinkSetStructuralHash({
+            linkedContainerIds: normalizedState.linkedContainerIds,
+        }),
+        grantRoot: await computeDocumentLinkSetGrantRoot(),
+        referencedPrincipalHeads: [],
+        keyTargetHash: await computeDocumentLinkSetKeyTargetHash(),
+    };
+}
+function normalizeAttachmentBindAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "bindingId",
+        "blobId",
+        "documentId",
+        "documentManifestHash",
+        "eventType",
+        "expectedBindingId",
+        "slotId",
+    ], "attachment.bind event body");
+    return {
+        eventType: "attachment.bind",
+        bindingId: readString(record, "bindingId", "attachment.bind event body"),
+        blobId: readString(record, "blobId", "attachment.bind event body"),
+        documentId: readString(record, "documentId", "attachment.bind event body"),
+        slotId: readString(record, "slotId", "attachment.bind event body"),
+        expectedBindingId: readNullableString(record, "expectedBindingId", "attachment.bind event body"),
+        documentManifestHash: readHashString(record, "documentManifestHash", "attachment.bind event body"),
+    };
+}
+function normalizeAttachmentDetachAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "bindingId",
+        "blobId",
+        "documentId",
+        "documentManifestHash",
+        "eventType",
+        "slotId",
+    ], "attachment.detach event body");
+    return {
+        eventType: "attachment.detach",
+        bindingId: readString(record, "bindingId", "attachment.detach event body"),
+        blobId: readString(record, "blobId", "attachment.detach event body"),
+        documentId: readString(record, "documentId", "attachment.detach event body"),
+        slotId: readString(record, "slotId", "attachment.detach event body"),
+        documentManifestHash: readHashString(record, "documentManifestHash", "attachment.detach event body"),
+    };
+}
+export function normalizeAttachmentAccessEventBody(value) {
+    if (!isPlainObject(value)) {
+        throwVerification("invalid_shape", "attachment access event body must be a plain object");
+    }
+    const eventType = readString(value, "eventType", "attachment access body");
+    if (eventType === "attachment.bind") {
+        return normalizeAttachmentBindAccessEventBody(value);
+    }
+    if (eventType === "attachment.detach") {
+        return normalizeAttachmentDetachAccessEventBody(value);
+    }
+    throwVerification("invalid_domain", "attachment access event body eventType is unsupported");
+}
+function assertAttachmentAccessEventDomain(input) {
+    const { body, event } = input;
+    if (event.event.objectKind !== "blob") {
+        throwVerification("object_mismatch", "attachment access event must target a blob");
+    }
+    if (event.event.objectId !== body.blobId) {
+        throwVerification("object_mismatch", "attachment access event blob id does not match body");
+    }
+    if (event.event.eventType !== body.eventType) {
+        throwVerification("invalid_domain", "attachment access event body type does not match event type");
+    }
+    requireEventDependency({
+        event,
+        manifestHash: body.documentManifestHash,
+        label: "attachment access event document link-set",
+    });
+}
+function assertExpectedAttachmentEventFields(input) {
+    if (input.expectedBindingId !== undefined &&
+        input.body.bindingId !== input.expectedBindingId) {
+        throwVerification("object_mismatch", "attachment event binding id does not match expected binding id");
+    }
+    if (input.expectedBlobId !== undefined &&
+        input.body.blobId !== input.expectedBlobId) {
+        throwVerification("object_mismatch", "attachment event blob id does not match expected blob id");
+    }
+    if (input.expectedDocumentId !== undefined &&
+        input.body.documentId !== input.expectedDocumentId) {
+        throwVerification("object_mismatch", "attachment event document id does not match expected document id");
+    }
+    if (input.expectedDocumentManifestHash !== undefined &&
+        input.body.documentManifestHash !== input.expectedDocumentManifestHash) {
+        throwVerification("stale_predecessor", "attachment event document manifest hash does not match expected manifest");
+    }
+}
+async function verifyAttachmentAccessEvent(input) {
+    const body = normalizeAttachmentAccessEventBody(input.body);
+    const canonicalBody = body;
+    const event = await verifySignedAccessEvent({
+        body: canonicalBody,
+        event: input.event,
+        signerPublicKey: input.signerPublicKey,
+    });
+    if (!event.ok) {
+        throw event.error;
+    }
+    assertAttachmentAccessEventDomain({ body, event: event.value });
+    return { body, event: event.value };
+}
+export async function verifyAttachmentBindingEvent({ authorizationMembership = "current", authorizingContainerPaths, documentManifest, expectedBindingId, expectedBlobId, expectedDocumentId, expectedDocumentManifestHash, expectedPreviousBindingId, principalPolicies = [], ...input }) {
+    return runVerifier(async () => {
+        const { body, event } = await verifyAttachmentAccessEvent(input);
+        if (body.eventType !== "attachment.bind") {
+            throwVerification("invalid_domain", "attachment binding verifier requires an attachment.bind event");
+        }
+        assertExpectedAttachmentEventFields({
+            body,
+            expectedBindingId,
+            expectedBlobId,
+            expectedDocumentId,
+            expectedDocumentManifestHash,
+        });
+        if (expectedPreviousBindingId !== undefined &&
+            body.expectedBindingId !== expectedPreviousBindingId) {
+            throwVerification("stale_predecessor", "attachment binding previous binding id does not match expected binding id");
+        }
+        assertAttachmentDocumentAuthority({
+            authorizationMembership,
+            authorizingContainerPaths,
+            body,
+            documentManifest,
+            event,
+            principalPolicies,
+        });
+        return makeVerifiedAttachmentBinding({
+            bindingId: body.bindingId,
+            blobId: body.blobId,
+            documentId: body.documentId,
+            slotId: body.slotId,
+            documentManifestHash: body.documentManifestHash,
+            event,
+            body,
+        });
+    });
+}
+export async function verifyAttachmentDetachEvent({ authorizationMembership = "current", authorizingContainerPaths, documentManifest, expectedBindingId, expectedBlobId, expectedDocumentId, expectedDocumentManifestHash, principalPolicies = [], ...input }) {
+    return runVerifier(async () => {
+        const { body, event } = await verifyAttachmentAccessEvent(input);
+        if (body.eventType !== "attachment.detach") {
+            throwVerification("invalid_domain", "attachment detach verifier requires an attachment.detach event");
+        }
+        assertExpectedAttachmentEventFields({
+            body,
+            expectedBindingId,
+            expectedBlobId,
+            expectedDocumentId,
+            expectedDocumentManifestHash,
+        });
+        assertAttachmentDocumentAuthority({
+            authorizationMembership,
+            authorizingContainerPaths,
+            body,
+            documentManifest,
+            event,
+            principalPolicies,
+        });
+        return makeVerifiedAttachmentDetach({
+            bindingId: body.bindingId,
+            blobId: body.blobId,
+            documentId: body.documentId,
+            slotId: body.slotId,
+            documentManifestHash: body.documentManifestHash,
+            event,
+            body,
+        });
+    });
+}
+function assertDocumentAccessEventDomain(input) {
+    const { body, event } = input;
+    if (event.event.objectKind !== "document") {
+        throwVerification("object_mismatch", "document access event must target a document");
+    }
+    if (body.eventType !== event.event.eventType) {
+        throwVerification("invalid_domain", "document access event body type does not match event type");
+    }
+}
+function preparePreviousDocumentLinkSetTransition(input) {
+    const { event, previousManifest } = input;
+    if (!previousManifest) {
+        throwVerification("missing_dependency", `${input.body.eventType} requires the previous document link-set manifest`);
+    }
+    if (event.event.previousManifestHash !== previousManifest.manifestHash) {
+        throwVerification("stale_predecessor", "document access event previous manifest does not match supplied previous manifest");
+    }
+    if (previousManifest.state.documentId !== event.event.objectId ||
+        previousManifest.state.organizationId !== event.event.organizationId) {
+        throwVerification("object_mismatch", "document access previous manifest targets the wrong document");
+    }
+    assertDocumentLinkSetCitationScope(input);
+    return {
+        previousState: previousManifest.state,
+        nextBase: {
+            version: 1,
+            documentId: previousManifest.state.documentId,
+            organizationId: previousManifest.state.organizationId,
+            epoch: previousManifest.state.epoch + 1,
+            previousManifestHash: previousManifest.manifestHash,
+            eventHash: event.eventHash,
+        },
+    };
+}
+function deriveInitialDocumentLinkSetManifestState(input, body) {
+    if (body.blobRewraps.length !== 0) {
+        throwVerification("invalid_shape", "initial document.link cannot rewrap attachments");
+    }
+    if (input.event.event.previousManifestHash !== null) {
+        throwVerification("stale_predecessor", "initial document.link must not have a previous manifest");
+    }
+    assertDocumentLinkSetCitationScope(input);
+    requireDocumentContainerPathWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        containerId: body.containerId,
+        event: input.event,
+        label: "document.link target",
+        manifestHash: body.containerManifestHash,
+        organizationId: input.event.event.organizationId,
+        path: input.targetContainerPath,
+        principalPolicies: input.principalPolicies,
+    });
+    return normalizeDocumentLinkSetManifestState({
+        version: 1,
+        documentId: input.event.event.objectId,
+        organizationId: input.event.event.organizationId,
+        epoch: 1,
+        previousManifestHash: null,
+        eventHash: input.event.eventHash,
+        linkedContainerIds: [body.containerId],
+    });
+}
+function deriveDocumentLinkManifestState(input, body, previous) {
+    if (previous.previousState.linkedContainerIds.includes(body.containerId)) {
+        throwVerification("duplicate_entry", "document.link target container is already linked");
+    }
+    requireAnyDocumentLinkedContainerWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        event: input.event,
+        label: "document.link existing access",
+        linkedContainerIds: previous.previousState.linkedContainerIds,
+        organizationId: previous.previousState.organizationId,
+        paths: input.authorizingContainerPaths,
+        principalPolicies: input.principalPolicies,
+    });
+    requireDocumentContainerPathWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        containerId: body.containerId,
+        event: input.event,
+        label: "document.link target",
+        manifestHash: body.containerManifestHash,
+        organizationId: previous.previousState.organizationId,
+        path: input.targetContainerPath,
+        principalPolicies: input.principalPolicies,
+    });
+    return normalizeDocumentLinkSetManifestState({
+        ...previous.nextBase,
+        linkedContainerIds: [
+            ...previous.previousState.linkedContainerIds,
+            body.containerId,
+        ],
+    });
+}
+function deriveDocumentUnlinkManifestState(input, body, previous) {
+    if (!previous.previousState.linkedContainerIds.includes(body.containerId)) {
+        throwVerification("missing_dependency", "document.unlink target container is not linked");
+    }
+    const remainingLinkedContainerIds = previous.previousState.linkedContainerIds.filter((containerId) => containerId !== body.containerId);
+    if (remainingLinkedContainerIds.length === 0) {
+        throwVerification("missing_dependency", "document.unlink must leave at least one linked container");
+    }
+    requireDocumentContainerPathWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        containerId: body.containerId,
+        event: input.event,
+        label: "document.unlink target",
+        manifestHash: body.containerManifestHash,
+        organizationId: previous.previousState.organizationId,
+        path: input.targetContainerPath,
+        principalPolicies: input.principalPolicies,
+    });
+    requireAnyDocumentLinkedContainerWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        event: input.event,
+        label: "document.unlink remaining access",
+        linkedContainerIds: remainingLinkedContainerIds,
+        organizationId: previous.previousState.organizationId,
+        paths: input.authorizingContainerPaths,
+        principalPolicies: input.principalPolicies,
+    });
+    return normalizeDocumentLinkSetManifestState({
+        ...previous.nextBase,
+        linkedContainerIds: remainingLinkedContainerIds,
+    });
+}
+function deriveDocumentLinkSetManifestStateFromEvent(input) {
+    assertDocumentAccessEventDomain(input);
+    if (input.body.eventType === "document.link" && !input.previousManifest) {
+        return deriveInitialDocumentLinkSetManifestState(input, input.body);
+    }
+    const previous = preparePreviousDocumentLinkSetTransition(input);
+    if (input.body.eventType === "document.link") {
+        return deriveDocumentLinkManifestState(input, input.body, previous);
+    }
+    return deriveDocumentUnlinkManifestState(input, input.body, previous);
+}
+export async function verifyDocumentLinkSetManifest({ authorizationMembership = "current", authorizingContainerPaths, checkpointPredecessors, event, expectedManifestHash, localCheckpoint, manifest, previousManifest = null, principalPolicies = [], targetContainerPath, }) {
+    return runVerifier(async () => {
+        const body = normalizeDocumentAccessEventBody(event.body);
+        const state = deriveDocumentLinkSetManifestStateFromEvent({
+            authorizationMembership,
+            authorizingContainerPaths,
+            body,
+            event,
+            previousManifest,
+            principalPolicies,
+            targetContainerPath,
+        });
+        assertDocumentBlobRewrapScope(body.blobRewraps, state);
+        const derivedManifest = await deriveDocumentLinkSetManifest(state);
+        const derivedManifestHash = await computeAccessManifestHash(derivedManifest);
+        if (derivedManifestHash !== expectedManifestHash) {
+            throwVerification("hash_mismatch", "document link-set manifest hash does not match derived state");
+        }
+        const verifiedManifest = await verifyAccessManifest({
+            manifest,
+            expectedManifestHash,
+            event,
+            expectedObject: {
+                objectKind: "document",
+                objectId: state.documentId,
+            },
+            expectedPreviousManifestHash: state.previousManifestHash,
+            localCheckpoint,
+            checkpointPredecessors,
+        });
+        if (!verifiedManifest.ok) {
+            throw verifiedManifest.error;
+        }
+        return makeVerifiedDocumentLinkSetManifest({
+            manifest: verifiedManifest.value.manifest,
+            manifestHash: verifiedManifest.value.manifestHash,
+            event,
+            state,
+            checkpoint: verifiedManifest.value.checkpoint,
+        });
+    });
+}
+export function verifyContainerParentEdge({ child, parentHistory, }) {
+    try {
+        if (!child.state.parentContainerId || !child.state.parentManifestHash) {
+            throwVerification("missing_dependency", "container parent edge requires a parent manifest hash");
+        }
+        if (parentHistory.length === 0) {
+            throwVerification("missing_dependency", "container parent edge requires parent manifest history");
+        }
+        for (const parentManifest of parentHistory) {
+            if (parentManifest.state.containerId !== child.state.parentContainerId) {
+                throwVerification("object_mismatch", "container parent edge history contains the wrong parent container");
+            }
+        }
+        if (!parentHistory.some((parentManifest) => parentManifest.manifestHash === child.state.parentManifestHash)) {
+            throwVerification("missing_dependency", "container parent manifest hash is not present in parent history");
+        }
+        return ok(makeVerifiedContainerParentEdge({
+            childContainerId: child.state.containerId,
+            childManifestHash: child.manifestHash,
+            parentContainerId: child.state.parentContainerId,
+            parentManifestHash: child.state.parentManifestHash,
+        }));
+    }
+    catch (error) {
+        return toVerificationResult(error);
+    }
+}
+//# sourceMappingURL=documentAccess.js.map

package/internal/crypto/keying/documentAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentAccess.js","sourceRoot":"","sources":["documentAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,iCAAiC,EACjC,4CAA4C,EAC5C,uCAAuC,EACvC,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,EAAE,EACF,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AA4BlB,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,4CAA4C,EAC5C,gDAAgD,GACjD,MAAM,iCAAiC,CAAC;AAEzC,SAAS,kCAAkC,CACzC,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,oBAAoB,CAAC,EACtB,oCAAoC,CACrC,CAAC;IACF,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,eAAe,CACb,MAAM,EACN,oBAAoB,EACpB,oCAAoC,CACrC,EACD,sCAAsC,CACvC,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,iBAAiB,CACf,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,YAAY;QACZ,OAAO;QACP,WAAW;QACX,oBAAoB;QACpB,gBAAgB;QAChB,sBAAsB;QACtB,SAAS;KACV,EACD,kCAAkC,CACnC,CAAC;IACF,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC;QAChE,UAAU,EAAE,UAAU,CACpB,MAAM,EACN,YAAY,EACZ,kCAAkC,CACnC;QACD,cAAc,EAAE,UAAU,CACxB,MAAM,EACN,gBAAgB,EAChB,kCAAkC,CACnC;QACD,KAAK,EAAE,mBAAmB,CACxB,MAAM,EACN,OAAO,EACP,kCAAkC,CACnC;QACD,oBAAoB,EAAE,sBAAsB,CAC1C,MAAM,EACN,sBAAsB,EACtB,kCAAkC,CACnC;QACD,SAAS,EAAE,cAAc,CACvB,MAAM,EACN,WAAW,EACX,kCAAkC,CACnC;QACD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,UAAqC;IAErC,MAAM,OAAO,GACX,kCAAkC,CAAC,UAAU,CAAC,CAAC;IAEjD,OAAO,uBAAuB,CAC5B,+CAA+C,EAC/C,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,OAAO,uBAAuB,CAAC,2CAA2C,EAAE;QAC1E,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,OAAO,uBAAuB,CAC5B,+CAA+C,EAC/C,EAAE,UAAU,EAAE,+BAA+B,EAAE,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAmC;IAEnC,MAAM,eAAe,GAAG,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAErE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,eAAe,CAAC,UAAU;QACpC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,KAAK,EAAE,eAAe,CAAC,KAAK;QAC5B,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,cAAc,EAAE,MAAM,oCAAoC,CAAC;YACzD,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAC;QACF,SAAS,EAAE,MAAM,+BAA+B,EAAE;QAClD,wBAAwB,EAAE,EAAE;QAC5B,aAAa,EAAE,MAAM,mCAAmC,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,WAAW;QACX,QAAQ;QACR,YAAY;QACZ,sBAAsB;QACtB,WAAW;QACX,mBAAmB;QACnB,QAAQ;KACT,EACD,4BAA4B,CAC7B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,4BAA4B,CAAC;QACxE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA4B,CAAC;QAClE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,4BAA4B,CAAC;QAC1E,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA4B,CAAC;QAClE,iBAAiB,EAAE,kBAAkB,CACnC,MAAM,EACN,mBAAmB,EACnB,4BAA4B,CAC7B;QACD,oBAAoB,EAAE,cAAc,CAClC,MAAM,EACN,sBAAsB,EACtB,4BAA4B,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wCAAwC,CAC/C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,WAAW;QACX,QAAQ;QACR,YAAY;QACZ,sBAAsB;QACtB,WAAW;QACX,QAAQ;KACT,EACD,8BAA8B,CAC/B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,8BAA8B,CAAC;QAC1E,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,8BAA8B,CAAC;QACpE,UAAU,EAAE,UAAU,CACpB,MAAM,EACN,YAAY,EACZ,8BAA8B,CAC/B;QACD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,8BAA8B,CAAC;QACpE,oBAAoB,EAAE,cAAc,CAClC,MAAM,EACN,sBAAsB,EACtB,8BAA8B,CAC/B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAA0B;IAE1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,iBAAiB,CACf,eAAe,EACf,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAE3E,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;QACtC,OAAO,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,iBAAiB,CACf,gBAAgB,EAChB,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CAAC,KAG1C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAE9B,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACtC,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,iBAAiB,CACf,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,iBAAiB,CACf,gBAAgB,EAChB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC;QACrB,KAAK;QACL,YAAY,EAAE,IAAI,CAAC,oBAAoB;QACvC,KAAK,EAAE,2CAA2C;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mCAAmC,CAAC,KAM5C;IACC,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,EAChD,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;QAClC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,EAC1C,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB,EAClD,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,4BAA4B,KAAK,SAAS;QAChD,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC,4BAA4B,EACtE,CAAC;QACD,iBAAiB,CACf,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA6B;IAK7B,MAAM,IAAI,GAAG,kCAAkC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAsD,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC;QAC1C,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,iCAAiC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,uBAAuB,GAAG,SAAS,EACnC,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,iBAAiB,GAAG,EAAE,EACtB,GAAG,KAAK,EAC0B;IAGlC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACzC,iBAAiB,CACf,gBAAgB,EAChB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,mCAAmC,CAAC;YAClC,IAAI;YACJ,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,4BAA4B;SAC7B,CAAC,CAAC;QACH,IACE,yBAAyB,KAAK,SAAS;YACvC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,EACpD,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,iCAAiC,CAAC;YAChC,uBAAuB;YACvB,yBAAyB;YACzB,IAAI;YACJ,gBAAgB;YAChB,KAAK;YACL,iBAAiB;SAClB,CAAC,CAAC;QAEH,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,KAAK;YACL,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,uBAAuB,GAAG,SAAS,EACnC,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,GAAG,EAAE,EACtB,GAAG,KAAK,EACyB;IAGjC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;YAC3C,iBAAiB,CACf,gBAAgB,EAChB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,mCAAmC,CAAC;YAClC,IAAI;YACJ,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,4BAA4B;SAC7B,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,uBAAuB;YACvB,yBAAyB;YACzB,IAAI;YACJ,gBAAgB;YAChB,KAAK;YACL,iBAAiB;SAClB,CAAC,CAAC;QAEH,OAAO,4BAA4B,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,KAAK;YACL,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAqBD,SAAS,+BAA+B,CACtC,KAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAE9B,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC1C,iBAAiB,CACf,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC7C,iBAAiB,CACf,gBAAgB,EAChB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wCAAwC,CAC/C,KAA6C;IAE7C,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAE1C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,iBAAiB,CACf,oBAAoB,EACpB,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,mDAAmD,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACvE,iBAAiB,CACf,mBAAmB,EACnB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,IACE,gBAAgB,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC1D,gBAAgB,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,KAAK,CAAC,cAAc,EACpE,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO;QACL,aAAa,EAAE,gBAAgB,CAAC,KAAK;QACrC,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU;YAC7C,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,cAAc;YACrD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;YACvC,oBAAoB,EAAE,gBAAgB,CAAC,YAAY;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yCAAyC,CAChD,KAA6C,EAC7C,IAAiC;IAEjC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,iBAAiB,CACf,eAAe,EACf,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACpD,iBAAiB,CACf,mBAAmB,EACnB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC1C,uCAAuC,CAAC;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,IAAI,CAAC,qBAAqB;QACxC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc;QAChD,IAAI,EAAE,KAAK,CAAC,mBAAmB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,OAAO,qCAAqC,CAAC;QAC3C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;QACtC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc;QAChD,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,kBAAkB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CACtC,KAA6C,EAC7C,IAAiC,EACjC,QAA2C;IAE3C,IAAI,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,iBAAiB,CACf,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,4CAA4C,CAAC;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,+BAA+B;QACtC,kBAAkB,EAAE,QAAQ,CAAC,aAAa,CAAC,kBAAkB;QAC7D,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,cAAc;QACrD,KAAK,EAAE,KAAK,CAAC,yBAAyB;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,uCAAuC,CAAC;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,IAAI,CAAC,qBAAqB;QACxC,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,cAAc;QACrD,IAAI,EAAE,KAAK,CAAC,mBAAmB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,OAAO,qCAAqC,CAAC;QAC3C,GAAG,QAAQ,CAAC,QAAQ;QACpB,kBAAkB,EAAE;YAClB,GAAG,QAAQ,CAAC,aAAa,CAAC,kBAAkB;YAC5C,IAAI,CAAC,WAAW;SACjB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,KAA6C,EAC7C,IAAmC,EACnC,QAA2C;IAE3C,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,iBAAiB,CACf,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,2BAA2B,GAC/B,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAC9C,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAClD,CAAC;IAEJ,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,iBAAiB,CACf,oBAAoB,EACpB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,uCAAuC,CAAC;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,wBAAwB;QAC/B,YAAY,EAAE,IAAI,CAAC,qBAAqB;QACxC,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,cAAc;QACrD,IAAI,EAAE,KAAK,CAAC,mBAAmB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,4CAA4C,CAAC;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,kCAAkC;QACzC,kBAAkB,EAAE,2BAA2B;QAC/C,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,cAAc;QACrD,KAAK,EAAE,KAAK,CAAC,yBAAyB;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,OAAO,qCAAqC,CAAC;QAC3C,GAAG,QAAQ,CAAC,QAAQ;QACpB,kBAAkB,EAAE,2BAA2B;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2CAA2C,CAClD,KAA6C;IAE7C,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACxE,OAAO,yCAAyC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,QAAQ,GAAG,wCAAwC,CAAC,KAAK,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO,+BAA+B,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,uBAAuB,GAAG,SAAS,EACnC,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,EACL,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,gBAAgB,GAAG,IAAI,EACvB,iBAAiB,GAAG,EAAE,EACtB,mBAAmB,GACgB;IAGnC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,2CAA2C,CAAC;YACxD,uBAAuB;YACvB,yBAAyB;YACzB,IAAI;YACJ,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,mBAAmB;SACpB,CAAC,CAAC;QACH,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,mBAAmB,GACvB,MAAM,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAEnD,IAAI,mBAAmB,KAAK,oBAAoB,EAAE,CAAC;YACjD,iBAAiB,CACf,eAAe,EACf,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC;YAClD,QAAQ;YACR,oBAAoB;YACpB,KAAK;YACL,cAAc,EAAE;gBACd,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;aAC3B;YACD,4BAA4B,EAAE,KAAK,CAAC,oBAAoB;YACxD,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,gBAAgB,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,OAAO,mCAAmC,CAAC;YACzC,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ;YACzC,YAAY,EAAE,gBAAgB,CAAC,KAAK,CAAC,YAAY;YACjD,KAAK;YACL,KAAK;YACL,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,EACxC,KAAK,EACL,aAAa,GACkB;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACtE,iBAAiB,CACf,oBAAoB,EACpB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,iBAAiB,CACf,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,cAAc,IAAI,aAAa,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBACvE,iBAAiB,CACf,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IACE,CAAC,aAAa,CAAC,IAAI,CACjB,CAAC,cAAc,EAAE,EAAE,CACjB,cAAc,CAAC,YAAY,KAAK,KAAK,CAAC,KAAK,CAAC,kBAAkB,CACjE,EACD,CAAC;YACD,iBAAiB,CACf,oBAAoB,EACpB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CACP,+BAA+B,CAAC;YAC9B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACzC,iBAAiB,EAAE,KAAK,CAAC,YAAY;YACrC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAChD,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;SACnD,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport {\n  computeAccessManifestHash,\n  verifyAccessManifest,\n  verifySignedAccessEvent,\n} from \"./accessEvent\";\nimport { computeKeyingDomainHash } from \"./canonical\";\nimport {\n  assertAttachmentDocumentAuthority,\n  requireAnyDocumentLinkedContainerWriteAccess,\n  requireDocumentContainerPathWriteAccess,\n  requireEventDependency,\n} from \"./documentAccessAuthorization\";\nimport { normalizeDocumentAccessEventBody } from \"./documentAccessBody\";\nimport { assertDocumentBlobRewrapScope } from \"./documentBlobRewraps\";\nimport { assertDocumentLinkSetCitationScope } from \"./documentCitationScope\";\nimport {\n  assertExactKeys,\n  normalizeUniqueSortedStrings,\n  ok,\n  readHashString,\n  readNullableHashString,\n  readNullableString,\n  readPositiveInteger,\n  readString,\n  readStringArray,\n  readVersion,\n  runVerifier,\n  throwVerification,\n  toVerificationResult,\n} from \"./shared\";\nimport type {\n  AccessManifest,\n  AttachmentAccessEventBody,\n  AttachmentBindAccessEventBody,\n  AttachmentDetachAccessEventBody,\n  DocumentAccessEventBody,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentLinkSetStructural,\n  DocumentUnlinkAccessEventBody,\n  KeyingCanonicalJson,\n  KeyingCanonicalPayload,\n  KeyingVerificationResult,\n  PrincipalPolicyAuthorization as Policy,\n  VerifiedAccessEvent,\n  VerifiedAttachmentBinding,\n  VerifiedAttachmentDetach,\n  VerifiedContainerAccessManifest,\n  VerifiedContainerParentEdge,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedDocumentLinkSetStateEvidence,\n  VerifyAccessEventInput,\n  VerifyAttachmentBindingEventInput,\n  VerifyAttachmentDetachEventInput,\n  VerifyContainerParentEdgeInput,\n  VerifyDocumentLinkSetManifestInput,\n} from \"./types\";\nimport {\n  makeVerifiedAttachmentBinding,\n  makeVerifiedAttachmentDetach,\n  makeVerifiedContainerParentEdge,\n  makeVerifiedDocumentLinkSetManifest,\n} from \"./types\";\n\nexport { requireEventDependency } from \"./documentAccessAuthorization\";\nexport { normalizeDocumentAccessEventBody } from \"./documentAccessBody\";\nexport {\n  requireWriteAccessThroughCommittedBlobTarget,\n  requireWriteAccessThroughCommittedDocumentTarget,\n} from \"./documentContentWriteAuthority\";\n\nfunction normalizeDocumentLinkSetStructural(\n  value: unknown,\n): DocumentLinkSetStructural {\n  const record = assertExactKeys(\n    value,\n    [\"linkedContainerIds\"],\n    \"document link-set structural state\",\n  );\n  const linkedContainerIds = normalizeUniqueSortedStrings(\n    readStringArray(\n      record,\n      \"linkedContainerIds\",\n      \"document link-set structural state\",\n    ),\n    \"document link-set linkedContainerIds\",\n  );\n\n  if (linkedContainerIds.length === 0) {\n    throwVerification(\n      \"missing_dependency\",\n      \"document link-set must include at least one linked container\",\n    );\n  }\n\n  return { linkedContainerIds };\n}\n\nexport function normalizeDocumentLinkSetManifestState(\n  value: unknown,\n): DocumentLinkSetManifestState {\n  const record = assertExactKeys(\n    value,\n    [\n      \"documentId\",\n      \"epoch\",\n      \"eventHash\",\n      \"linkedContainerIds\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"version\",\n    ],\n    \"document link-set manifest state\",\n  );\n  const structural = normalizeDocumentLinkSetStructural({\n    linkedContainerIds: record.linkedContainerIds,\n  });\n\n  return {\n    version: readVersion(record, \"document link-set manifest state\"),\n    documentId: readString(\n      record,\n      \"documentId\",\n      \"document link-set manifest state\",\n    ),\n    organizationId: readString(\n      record,\n      \"organizationId\",\n      \"document link-set manifest state\",\n    ),\n    epoch: readPositiveInteger(\n      record,\n      \"epoch\",\n      \"document link-set manifest state\",\n    ),\n    previousManifestHash: readNullableHashString(\n      record,\n      \"previousManifestHash\",\n      \"document link-set manifest state\",\n    ),\n    eventHash: readHashString(\n      record,\n      \"eventHash\",\n      \"document link-set manifest state\",\n    ),\n    linkedContainerIds: structural.linkedContainerIds,\n  };\n}\n\nexport async function computeDocumentLinkSetStructuralHash(\n  structural: DocumentLinkSetStructural,\n): Promise<string> {\n  const payload: KeyingCanonicalPayload<DocumentLinkSetStructural> =\n    normalizeDocumentLinkSetStructural(structural);\n\n  return computeKeyingDomainHash(\n    \"tearleads.keying.document-link-set-structural\",\n    payload,\n  );\n}\n\nexport async function computeDocumentLinkSetGrantRoot(): Promise<string> {\n  return computeKeyingDomainHash(\"tearleads.keying.document-link-set-grants\", {\n    grants: [],\n  });\n}\n\nexport async function computeDocumentLinkSetKeyTargetHash(): Promise<string> {\n  return computeKeyingDomainHash(\n    \"tearleads.keying.document-link-set-key-target\",\n    { targetMode: \"current-linked-container-keks\" },\n  );\n}\n\nexport async function deriveDocumentLinkSetManifest(\n  state: DocumentLinkSetManifestState,\n): Promise<AccessManifest> {\n  const normalizedState = normalizeDocumentLinkSetManifestState(state);\n\n  return {\n    version: 1,\n    objectKind: \"document\",\n    objectId: normalizedState.documentId,\n    organizationId: normalizedState.organizationId,\n    epoch: normalizedState.epoch,\n    previousManifestHash: normalizedState.previousManifestHash,\n    eventHash: normalizedState.eventHash,\n    structuralHash: await computeDocumentLinkSetStructuralHash({\n      linkedContainerIds: normalizedState.linkedContainerIds,\n    }),\n    grantRoot: await computeDocumentLinkSetGrantRoot(),\n    referencedPrincipalHeads: [],\n    keyTargetHash: await computeDocumentLinkSetKeyTargetHash(),\n  };\n}\n\nfunction normalizeAttachmentBindAccessEventBody(\n  value: KeyingCanonicalJson,\n): AttachmentBindAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bindingId\",\n      \"blobId\",\n      \"documentId\",\n      \"documentManifestHash\",\n      \"eventType\",\n      \"expectedBindingId\",\n      \"slotId\",\n    ],\n    \"attachment.bind event body\",\n  );\n\n  return {\n    eventType: \"attachment.bind\",\n    bindingId: readString(record, \"bindingId\", \"attachment.bind event body\"),\n    blobId: readString(record, \"blobId\", \"attachment.bind event body\"),\n    documentId: readString(record, \"documentId\", \"attachment.bind event body\"),\n    slotId: readString(record, \"slotId\", \"attachment.bind event body\"),\n    expectedBindingId: readNullableString(\n      record,\n      \"expectedBindingId\",\n      \"attachment.bind event body\",\n    ),\n    documentManifestHash: readHashString(\n      record,\n      \"documentManifestHash\",\n      \"attachment.bind event body\",\n    ),\n  };\n}\n\nfunction normalizeAttachmentDetachAccessEventBody(\n  value: KeyingCanonicalJson,\n): AttachmentDetachAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bindingId\",\n      \"blobId\",\n      \"documentId\",\n      \"documentManifestHash\",\n      \"eventType\",\n      \"slotId\",\n    ],\n    \"attachment.detach event body\",\n  );\n\n  return {\n    eventType: \"attachment.detach\",\n    bindingId: readString(record, \"bindingId\", \"attachment.detach event body\"),\n    blobId: readString(record, \"blobId\", \"attachment.detach event body\"),\n    documentId: readString(\n      record,\n      \"documentId\",\n      \"attachment.detach event body\",\n    ),\n    slotId: readString(record, \"slotId\", \"attachment.detach event body\"),\n    documentManifestHash: readHashString(\n      record,\n      \"documentManifestHash\",\n      \"attachment.detach event body\",\n    ),\n  };\n}\n\nexport function normalizeAttachmentAccessEventBody(\n  value: KeyingCanonicalJson,\n): AttachmentAccessEventBody {\n  if (!isPlainObject(value)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"attachment access event body must be a plain object\",\n    );\n  }\n\n  const eventType = readString(value, \"eventType\", \"attachment access body\");\n\n  if (eventType === \"attachment.bind\") {\n    return normalizeAttachmentBindAccessEventBody(value);\n  }\n\n  if (eventType === \"attachment.detach\") {\n    return normalizeAttachmentDetachAccessEventBody(value);\n  }\n\n  throwVerification(\n    \"invalid_domain\",\n    \"attachment access event body eventType is unsupported\",\n  );\n}\n\nfunction assertAttachmentAccessEventDomain(input: {\n  readonly body: AttachmentAccessEventBody;\n  readonly event: VerifiedAccessEvent;\n}): void {\n  const { body, event } = input;\n\n  if (event.event.objectKind !== \"blob\") {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment access event must target a blob\",\n    );\n  }\n\n  if (event.event.objectId !== body.blobId) {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment access event blob id does not match body\",\n    );\n  }\n\n  if (event.event.eventType !== body.eventType) {\n    throwVerification(\n      \"invalid_domain\",\n      \"attachment access event body type does not match event type\",\n    );\n  }\n\n  requireEventDependency({\n    event,\n    manifestHash: body.documentManifestHash,\n    label: \"attachment access event document link-set\",\n  });\n}\n\nfunction assertExpectedAttachmentEventFields(input: {\n  readonly body: AttachmentAccessEventBody;\n  readonly expectedBindingId?: string | undefined;\n  readonly expectedBlobId?: string | undefined;\n  readonly expectedDocumentId?: string | undefined;\n  readonly expectedDocumentManifestHash?: string | undefined;\n}): void {\n  if (\n    input.expectedBindingId !== undefined &&\n    input.body.bindingId !== input.expectedBindingId\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment event binding id does not match expected binding id\",\n    );\n  }\n\n  if (\n    input.expectedBlobId !== undefined &&\n    input.body.blobId !== input.expectedBlobId\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment event blob id does not match expected blob id\",\n    );\n  }\n\n  if (\n    input.expectedDocumentId !== undefined &&\n    input.body.documentId !== input.expectedDocumentId\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment event document id does not match expected document id\",\n    );\n  }\n\n  if (\n    input.expectedDocumentManifestHash !== undefined &&\n    input.body.documentManifestHash !== input.expectedDocumentManifestHash\n  ) {\n    throwVerification(\n      \"stale_predecessor\",\n      \"attachment event document manifest hash does not match expected manifest\",\n    );\n  }\n}\n\nasync function verifyAttachmentAccessEvent(\n  input: VerifyAccessEventInput,\n): Promise<{\n  readonly body: AttachmentAccessEventBody;\n  readonly event: VerifiedAccessEvent;\n}> {\n  const body = normalizeAttachmentAccessEventBody(input.body);\n  const canonicalBody: KeyingCanonicalPayload<AttachmentAccessEventBody> = body;\n  const event = await verifySignedAccessEvent({\n    body: canonicalBody,\n    event: input.event,\n    signerPublicKey: input.signerPublicKey,\n  });\n\n  if (!event.ok) {\n    throw event.error;\n  }\n\n  assertAttachmentAccessEventDomain({ body, event: event.value });\n  return { body, event: event.value };\n}\n\nexport async function verifyAttachmentBindingEvent({\n  authorizationMembership = \"current\",\n  authorizingContainerPaths,\n  documentManifest,\n  expectedBindingId,\n  expectedBlobId,\n  expectedDocumentId,\n  expectedDocumentManifestHash,\n  expectedPreviousBindingId,\n  principalPolicies = [],\n  ...input\n}: VerifyAttachmentBindingEventInput): Promise<\n  KeyingVerificationResult<VerifiedAttachmentBinding>\n> {\n  return runVerifier(async () => {\n    const { body, event } = await verifyAttachmentAccessEvent(input);\n\n    if (body.eventType !== \"attachment.bind\") {\n      throwVerification(\n        \"invalid_domain\",\n        \"attachment binding verifier requires an attachment.bind event\",\n      );\n    }\n\n    assertExpectedAttachmentEventFields({\n      body,\n      expectedBindingId,\n      expectedBlobId,\n      expectedDocumentId,\n      expectedDocumentManifestHash,\n    });\n    if (\n      expectedPreviousBindingId !== undefined &&\n      body.expectedBindingId !== expectedPreviousBindingId\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"attachment binding previous binding id does not match expected binding id\",\n      );\n    }\n    assertAttachmentDocumentAuthority({\n      authorizationMembership,\n      authorizingContainerPaths,\n      body,\n      documentManifest,\n      event,\n      principalPolicies,\n    });\n\n    return makeVerifiedAttachmentBinding({\n      bindingId: body.bindingId,\n      blobId: body.blobId,\n      documentId: body.documentId,\n      slotId: body.slotId,\n      documentManifestHash: body.documentManifestHash,\n      event,\n      body,\n    });\n  });\n}\n\nexport async function verifyAttachmentDetachEvent({\n  authorizationMembership = \"current\",\n  authorizingContainerPaths,\n  documentManifest,\n  expectedBindingId,\n  expectedBlobId,\n  expectedDocumentId,\n  expectedDocumentManifestHash,\n  principalPolicies = [],\n  ...input\n}: VerifyAttachmentDetachEventInput): Promise<\n  KeyingVerificationResult<VerifiedAttachmentDetach>\n> {\n  return runVerifier(async () => {\n    const { body, event } = await verifyAttachmentAccessEvent(input);\n\n    if (body.eventType !== \"attachment.detach\") {\n      throwVerification(\n        \"invalid_domain\",\n        \"attachment detach verifier requires an attachment.detach event\",\n      );\n    }\n\n    assertExpectedAttachmentEventFields({\n      body,\n      expectedBindingId,\n      expectedBlobId,\n      expectedDocumentId,\n      expectedDocumentManifestHash,\n    });\n    assertAttachmentDocumentAuthority({\n      authorizationMembership,\n      authorizingContainerPaths,\n      body,\n      documentManifest,\n      event,\n      principalPolicies,\n    });\n\n    return makeVerifiedAttachmentDetach({\n      bindingId: body.bindingId,\n      blobId: body.blobId,\n      documentId: body.documentId,\n      slotId: body.slotId,\n      documentManifestHash: body.documentManifestHash,\n      event,\n      body,\n    });\n  });\n}\n\ntype DocumentLinkSetManifestDerivationInput = {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly body: DocumentAccessEventBody;\n  readonly event: VerifiedAccessEvent;\n  readonly previousManifest: VerifiedDocumentLinkSetStateEvidence | null;\n  readonly targetContainerPath:\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined;\n  readonly authorizingContainerPaths:\n    | readonly (readonly VerifiedContainerAccessManifest[])[]\n    | undefined;\n  readonly principalPolicies: readonly Policy[];\n};\n\ninterface PreviousDocumentLinkSetTransition {\n  readonly nextBase: Omit<DocumentLinkSetManifestState, \"linkedContainerIds\">;\n  readonly previousState: DocumentLinkSetManifestState;\n}\n\nfunction assertDocumentAccessEventDomain(\n  input: DocumentLinkSetManifestDerivationInput,\n): void {\n  const { body, event } = input;\n\n  if (event.event.objectKind !== \"document\") {\n    throwVerification(\n      \"object_mismatch\",\n      \"document access event must target a document\",\n    );\n  }\n\n  if (body.eventType !== event.event.eventType) {\n    throwVerification(\n      \"invalid_domain\",\n      \"document access event body type does not match event type\",\n    );\n  }\n}\n\nfunction preparePreviousDocumentLinkSetTransition(\n  input: DocumentLinkSetManifestDerivationInput,\n): PreviousDocumentLinkSetTransition {\n  const { event, previousManifest } = input;\n\n  if (!previousManifest) {\n    throwVerification(\n      \"missing_dependency\",\n      `${input.body.eventType} requires the previous document link-set manifest`,\n    );\n  }\n\n  if (event.event.previousManifestHash !== previousManifest.manifestHash) {\n    throwVerification(\n      \"stale_predecessor\",\n      \"document access event previous manifest does not match supplied previous manifest\",\n    );\n  }\n\n  if (\n    previousManifest.state.documentId !== event.event.objectId ||\n    previousManifest.state.organizationId !== event.event.organizationId\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"document access previous manifest targets the wrong document\",\n    );\n  }\n\n  assertDocumentLinkSetCitationScope(input);\n  return {\n    previousState: previousManifest.state,\n    nextBase: {\n      version: 1,\n      documentId: previousManifest.state.documentId,\n      organizationId: previousManifest.state.organizationId,\n      epoch: previousManifest.state.epoch + 1,\n      previousManifestHash: previousManifest.manifestHash,\n      eventHash: event.eventHash,\n    },\n  };\n}\n\nfunction deriveInitialDocumentLinkSetManifestState(\n  input: DocumentLinkSetManifestDerivationInput,\n  body: DocumentLinkAccessEventBody,\n): DocumentLinkSetManifestState {\n  if (body.blobRewraps.length !== 0) {\n    throwVerification(\n      \"invalid_shape\",\n      \"initial document.link cannot rewrap attachments\",\n    );\n  }\n  if (input.event.event.previousManifestHash !== null) {\n    throwVerification(\n      \"stale_predecessor\",\n      \"initial document.link must not have a previous manifest\",\n    );\n  }\n\n  assertDocumentLinkSetCitationScope(input);\n  requireDocumentContainerPathWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    containerId: body.containerId,\n    event: input.event,\n    label: \"document.link target\",\n    manifestHash: body.containerManifestHash,\n    organizationId: input.event.event.organizationId,\n    path: input.targetContainerPath,\n    principalPolicies: input.principalPolicies,\n  });\n\n  return normalizeDocumentLinkSetManifestState({\n    version: 1,\n    documentId: input.event.event.objectId,\n    organizationId: input.event.event.organizationId,\n    epoch: 1,\n    previousManifestHash: null,\n    eventHash: input.event.eventHash,\n    linkedContainerIds: [body.containerId],\n  });\n}\n\nfunction deriveDocumentLinkManifestState(\n  input: DocumentLinkSetManifestDerivationInput,\n  body: DocumentLinkAccessEventBody,\n  previous: PreviousDocumentLinkSetTransition,\n): DocumentLinkSetManifestState {\n  if (previous.previousState.linkedContainerIds.includes(body.containerId)) {\n    throwVerification(\n      \"duplicate_entry\",\n      \"document.link target container is already linked\",\n    );\n  }\n\n  requireAnyDocumentLinkedContainerWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    event: input.event,\n    label: \"document.link existing access\",\n    linkedContainerIds: previous.previousState.linkedContainerIds,\n    organizationId: previous.previousState.organizationId,\n    paths: input.authorizingContainerPaths,\n    principalPolicies: input.principalPolicies,\n  });\n  requireDocumentContainerPathWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    containerId: body.containerId,\n    event: input.event,\n    label: \"document.link target\",\n    manifestHash: body.containerManifestHash,\n    organizationId: previous.previousState.organizationId,\n    path: input.targetContainerPath,\n    principalPolicies: input.principalPolicies,\n  });\n\n  return normalizeDocumentLinkSetManifestState({\n    ...previous.nextBase,\n    linkedContainerIds: [\n      ...previous.previousState.linkedContainerIds,\n      body.containerId,\n    ],\n  });\n}\n\nfunction deriveDocumentUnlinkManifestState(\n  input: DocumentLinkSetManifestDerivationInput,\n  body: DocumentUnlinkAccessEventBody,\n  previous: PreviousDocumentLinkSetTransition,\n): DocumentLinkSetManifestState {\n  if (!previous.previousState.linkedContainerIds.includes(body.containerId)) {\n    throwVerification(\n      \"missing_dependency\",\n      \"document.unlink target container is not linked\",\n    );\n  }\n\n  const remainingLinkedContainerIds =\n    previous.previousState.linkedContainerIds.filter(\n      (containerId) => containerId !== body.containerId,\n    );\n\n  if (remainingLinkedContainerIds.length === 0) {\n    throwVerification(\n      \"missing_dependency\",\n      \"document.unlink must leave at least one linked container\",\n    );\n  }\n\n  requireDocumentContainerPathWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    containerId: body.containerId,\n    event: input.event,\n    label: \"document.unlink target\",\n    manifestHash: body.containerManifestHash,\n    organizationId: previous.previousState.organizationId,\n    path: input.targetContainerPath,\n    principalPolicies: input.principalPolicies,\n  });\n  requireAnyDocumentLinkedContainerWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    event: input.event,\n    label: \"document.unlink remaining access\",\n    linkedContainerIds: remainingLinkedContainerIds,\n    organizationId: previous.previousState.organizationId,\n    paths: input.authorizingContainerPaths,\n    principalPolicies: input.principalPolicies,\n  });\n\n  return normalizeDocumentLinkSetManifestState({\n    ...previous.nextBase,\n    linkedContainerIds: remainingLinkedContainerIds,\n  });\n}\n\nfunction deriveDocumentLinkSetManifestStateFromEvent(\n  input: DocumentLinkSetManifestDerivationInput,\n): DocumentLinkSetManifestState {\n  assertDocumentAccessEventDomain(input);\n\n  if (input.body.eventType === \"document.link\" && !input.previousManifest) {\n    return deriveInitialDocumentLinkSetManifestState(input, input.body);\n  }\n\n  const previous = preparePreviousDocumentLinkSetTransition(input);\n\n  if (input.body.eventType === \"document.link\") {\n    return deriveDocumentLinkManifestState(input, input.body, previous);\n  }\n\n  return deriveDocumentUnlinkManifestState(input, input.body, previous);\n}\n\nexport async function verifyDocumentLinkSetManifest({\n  authorizationMembership = \"current\",\n  authorizingContainerPaths,\n  checkpointPredecessors,\n  event,\n  expectedManifestHash,\n  localCheckpoint,\n  manifest,\n  previousManifest = null,\n  principalPolicies = [],\n  targetContainerPath,\n}: VerifyDocumentLinkSetManifestInput): Promise<\n  KeyingVerificationResult<VerifiedDocumentLinkSetManifest>\n> {\n  return runVerifier(async () => {\n    const body = normalizeDocumentAccessEventBody(event.body);\n    const state = deriveDocumentLinkSetManifestStateFromEvent({\n      authorizationMembership,\n      authorizingContainerPaths,\n      body,\n      event,\n      previousManifest,\n      principalPolicies,\n      targetContainerPath,\n    });\n    assertDocumentBlobRewrapScope(body.blobRewraps, state);\n    const derivedManifest = await deriveDocumentLinkSetManifest(state);\n    const derivedManifestHash =\n      await computeAccessManifestHash(derivedManifest);\n\n    if (derivedManifestHash !== expectedManifestHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"document link-set manifest hash does not match derived state\",\n      );\n    }\n\n    const verifiedManifest = await verifyAccessManifest({\n      manifest,\n      expectedManifestHash,\n      event,\n      expectedObject: {\n        objectKind: \"document\",\n        objectId: state.documentId,\n      },\n      expectedPreviousManifestHash: state.previousManifestHash,\n      localCheckpoint,\n      checkpointPredecessors,\n    });\n\n    if (!verifiedManifest.ok) {\n      throw verifiedManifest.error;\n    }\n\n    return makeVerifiedDocumentLinkSetManifest({\n      manifest: verifiedManifest.value.manifest,\n      manifestHash: verifiedManifest.value.manifestHash,\n      event,\n      state,\n      checkpoint: verifiedManifest.value.checkpoint,\n    });\n  });\n}\n\nexport function verifyContainerParentEdge({\n  child,\n  parentHistory,\n}: VerifyContainerParentEdgeInput): KeyingVerificationResult<VerifiedContainerParentEdge> {\n  try {\n    if (!child.state.parentContainerId || !child.state.parentManifestHash) {\n      throwVerification(\n        \"missing_dependency\",\n        \"container parent edge requires a parent manifest hash\",\n      );\n    }\n\n    if (parentHistory.length === 0) {\n      throwVerification(\n        \"missing_dependency\",\n        \"container parent edge requires parent manifest history\",\n      );\n    }\n\n    for (const parentManifest of parentHistory) {\n      if (parentManifest.state.containerId !== child.state.parentContainerId) {\n        throwVerification(\n          \"object_mismatch\",\n          \"container parent edge history contains the wrong parent container\",\n        );\n      }\n    }\n\n    if (\n      !parentHistory.some(\n        (parentManifest) =>\n          parentManifest.manifestHash === child.state.parentManifestHash,\n      )\n    ) {\n      throwVerification(\n        \"missing_dependency\",\n        \"container parent manifest hash is not present in parent history\",\n      );\n    }\n\n    return ok(\n      makeVerifiedContainerParentEdge({\n        childContainerId: child.state.containerId,\n        childManifestHash: child.manifestHash,\n        parentContainerId: child.state.parentContainerId,\n        parentManifestHash: child.state.parentManifestHash,\n      }),\n    );\n  } catch (error) {\n    return toVerificationResult(error);\n  }\n}\n"]}

package/internal/crypto/keying/documentAccessAuthorization.d.ts

@@ -0,0 +1,33 @@
+import type { AttachmentAccessEventBody, PrincipalPolicyAuthorization as Policy, VerifiedAccessEvent, VerifiedContainerAccessManifest, VerifiedDocumentLinkSetManifest } from "./types.js";
+export declare function requireEventDependency(input: {
+    readonly event: VerifiedAccessEvent;
+    readonly manifestHash: string;
+    readonly label: string;
+}): void;
+export declare function requireDocumentContainerPathWriteAccess(input: {
+    readonly authorizationMembership: "current" | "referenced";
+    readonly containerId: string;
+    readonly event: VerifiedAccessEvent;
+    readonly label: string;
+    readonly manifestHash: string;
+    readonly organizationId: string;
+    readonly path: readonly VerifiedContainerAccessManifest[] | undefined;
+    readonly principalPolicies: readonly Policy[];
+}): void;
+export declare function requireAnyDocumentLinkedContainerWriteAccess(input: {
+    readonly authorizationMembership: "current" | "referenced";
+    readonly event: VerifiedAccessEvent;
+    readonly label: string;
+    readonly linkedContainerIds: readonly string[];
+    readonly organizationId: string;
+    readonly paths: readonly (readonly VerifiedContainerAccessManifest[])[] | undefined;
+    readonly principalPolicies: readonly Policy[];
+}): void;
+export declare function assertAttachmentDocumentAuthority(input: {
+    readonly authorizationMembership: "current" | "referenced";
+    readonly authorizingContainerPaths: readonly (readonly VerifiedContainerAccessManifest[])[] | undefined;
+    readonly body: AttachmentAccessEventBody;
+    readonly documentManifest: VerifiedDocumentLinkSetManifest;
+    readonly event: VerifiedAccessEvent;
+    readonly principalPolicies: readonly Policy[];
+}): void;