@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/crypto/keying/documentAccessAuthorization.js

@@ -0,0 +1,89 @@
+import { containerAccessLevelRank, requireContainerPathLast, requireContainerPathUserAccess, resolveContainerPathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, } from "./containerAccess.js";
+import { assertDocumentCitationScope } from "./documentCitationScope.js";
+import { throwVerification } from "./shared.js";
+export function requireEventDependency(input) {
+    if (!input.event.event.dependencyManifestHashes.includes(input.manifestHash)) {
+        throwVerification("missing_dependency", `${input.label} manifest hash is not signed as an event dependency`);
+    }
+}
+function requireContainerPathCurrentManifest(input) {
+    const manifest = requireContainerPathLast(input.path, input.label);
+    if (manifest.state.containerId !== input.containerId ||
+        manifest.manifestHash !== input.manifestHash) {
+        throwVerification("missing_dependency", `${input.label} path does not end at the signed container manifest`);
+    }
+    if (manifest.state.organizationId !== input.organizationId) {
+        throwVerification("object_mismatch", `${input.label} container belongs to the wrong organization`);
+    }
+    requireEventDependency({
+        event: input.event,
+        manifestHash: input.manifestHash,
+        label: input.label,
+    });
+    return manifest;
+}
+export function requireDocumentContainerPathWriteAccess(input) {
+    requireContainerPathCurrentManifest(input);
+    requireContainerPathUserAccess({
+        membershipAt: input.authorizationMembership,
+        label: input.label,
+        minimumAccessLevel: "write",
+        path: input.path,
+        principalPolicies: input.principalPolicies,
+        userId: input.event.event.signerUserId,
+    });
+}
+export function requireAnyDocumentLinkedContainerWriteAccess(input) {
+    const dependencyManifestHashes = new Set(input.event.event.dependencyManifestHashes);
+    const linkedContainerIds = new Set(input.linkedContainerIds);
+    for (const path of input.paths ?? []) {
+        const manifest = path.at(-1);
+        if (!manifest ||
+            !linkedContainerIds.has(manifest.state.containerId) ||
+            manifest.state.organizationId !== input.organizationId ||
+            !dependencyManifestHashes.has(manifest.manifestHash)) {
+            continue;
+        }
+        const resolveAccessLevel = input.authorizationMembership === "referenced"
+            ? resolveHistoricalContainerPathUserAccessLevel
+            : resolveContainerPathUserAccessLevel;
+        const accessLevel = resolveAccessLevel({
+            path,
+            principalPolicies: input.principalPolicies,
+            userId: input.event.event.signerUserId,
+        });
+        if (accessLevel !== null &&
+            containerAccessLevelRank(accessLevel) >= containerAccessLevelRank("write")) {
+            return;
+        }
+    }
+    throwVerification("unauthorized", `${input.label} signer lacks write access through a signed linked container dependency`);
+}
+export function assertAttachmentDocumentAuthority(input) {
+    if (input.body.documentId !== input.documentManifest.state.documentId ||
+        input.body.documentManifestHash !== input.documentManifest.manifestHash) {
+        throwVerification("stale_predecessor", "attachment event document manifest does not match body");
+    }
+    if (input.event.event.organizationId !==
+        input.documentManifest.state.organizationId) {
+        throwVerification("object_mismatch", "attachment event organization does not match document manifest");
+    }
+    assertDocumentCitationScope({
+        dependencyManifestHashes: input.event.event.dependencyManifestHashes,
+        additionalDependencyHashes: [input.documentManifest.manifestHash],
+        label: input.body.eventType,
+        linkedContainerIds: input.documentManifest.state.linkedContainerIds,
+        organizationId: input.documentManifest.state.organizationId,
+        paths: input.authorizingContainerPaths ?? [],
+    });
+    requireAnyDocumentLinkedContainerWriteAccess({
+        authorizationMembership: input.authorizationMembership,
+        event: input.event,
+        label: input.body.eventType,
+        linkedContainerIds: input.documentManifest.state.linkedContainerIds,
+        organizationId: input.documentManifest.state.organizationId,
+        paths: input.authorizingContainerPaths,
+        principalPolicies: input.principalPolicies,
+    });
+}
+//# sourceMappingURL=documentAccessAuthorization.js.map

package/internal/crypto/keying/documentAccessAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentAccessAuthorization.js","sourceRoot":"","sources":["documentAccessAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,6CAA6C,GAC9C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAS7C,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,IACE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EACxE,CAAC;QACD,iBAAiB,CACf,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,qDAAqD,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,KAO5C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEnE,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAChD,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAC5C,CAAC;QACD,iBAAiB,CACf,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,qDAAqD,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC3D,iBAAiB,CACf,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,8CAA8C,CAC7D,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uCAAuC,CAAC,KASvD;IACC,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC3C,8BAA8B,CAAC;QAC7B,YAAY,EAAE,KAAK,CAAC,uBAAuB;QAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,OAAO;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4CAA4C,CAAC,KAU5D;IACC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CACtC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAC3C,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IACE,CAAC,QAAQ;YACT,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;YACnD,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACtD,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EACpD,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,kBAAkB,GACtB,KAAK,CAAC,uBAAuB,KAAK,YAAY;YAC5C,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CAAC;YACrC,IAAI;YACJ,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;SACvC,CAAC,CAAC;QAEH,IACE,WAAW,KAAK,IAAI;YACpB,wBAAwB,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAC1E,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,iBAAiB,CACf,cAAc,EACd,GAAG,KAAK,CAAC,KAAK,yEAAyE,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KASjD;IACC,IACE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU;QACjE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY,EACvE,CAAC;QACD,iBAAiB,CACf,mBAAmB,EACnB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc;QAChC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAC3C,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC;QAC1B,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB;QACpE,0BAA0B,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACjE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC3B,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB;QACnE,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc;QAC3D,KAAK,EAAE,KAAK,CAAC,yBAAyB,IAAI,EAAE;KAC7C,CAAC,CAAC;IAEH,4CAA4C,CAAC;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC3B,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB;QACnE,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc;QAC3D,KAAK,EAAE,KAAK,CAAC,yBAAyB;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  containerAccessLevelRank,\n  requireContainerPathLast,\n  requireContainerPathUserAccess,\n  resolveContainerPathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n} from \"./containerAccess\";\nimport { assertDocumentCitationScope } from \"./documentCitationScope\";\nimport { throwVerification } from \"./shared\";\nimport type {\n  AttachmentAccessEventBody,\n  PrincipalPolicyAuthorization as Policy,\n  VerifiedAccessEvent,\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentLinkSetManifest,\n} from \"./types\";\n\nexport function requireEventDependency(input: {\n  readonly event: VerifiedAccessEvent;\n  readonly manifestHash: string;\n  readonly label: string;\n}): void {\n  if (\n    !input.event.event.dependencyManifestHashes.includes(input.manifestHash)\n  ) {\n    throwVerification(\n      \"missing_dependency\",\n      `${input.label} manifest hash is not signed as an event dependency`,\n    );\n  }\n}\n\nfunction requireContainerPathCurrentManifest(input: {\n  readonly containerId: string;\n  readonly event: VerifiedAccessEvent;\n  readonly label: string;\n  readonly manifestHash: string;\n  readonly organizationId: string;\n  readonly path: readonly VerifiedContainerAccessManifest[] | undefined;\n}): VerifiedContainerAccessManifest {\n  const manifest = requireContainerPathLast(input.path, input.label);\n\n  if (\n    manifest.state.containerId !== input.containerId ||\n    manifest.manifestHash !== input.manifestHash\n  ) {\n    throwVerification(\n      \"missing_dependency\",\n      `${input.label} path does not end at the signed container manifest`,\n    );\n  }\n\n  if (manifest.state.organizationId !== input.organizationId) {\n    throwVerification(\n      \"object_mismatch\",\n      `${input.label} container belongs to the wrong organization`,\n    );\n  }\n\n  requireEventDependency({\n    event: input.event,\n    manifestHash: input.manifestHash,\n    label: input.label,\n  });\n\n  return manifest;\n}\n\nexport function requireDocumentContainerPathWriteAccess(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly containerId: string;\n  readonly event: VerifiedAccessEvent;\n  readonly label: string;\n  readonly manifestHash: string;\n  readonly organizationId: string;\n  readonly path: readonly VerifiedContainerAccessManifest[] | undefined;\n  readonly principalPolicies: readonly Policy[];\n}): void {\n  requireContainerPathCurrentManifest(input);\n  requireContainerPathUserAccess({\n    membershipAt: input.authorizationMembership,\n    label: input.label,\n    minimumAccessLevel: \"write\",\n    path: input.path,\n    principalPolicies: input.principalPolicies,\n    userId: input.event.event.signerUserId,\n  });\n}\n\nexport function requireAnyDocumentLinkedContainerWriteAccess(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly event: VerifiedAccessEvent;\n  readonly label: string;\n  readonly linkedContainerIds: readonly string[];\n  readonly organizationId: string;\n  readonly paths:\n    | readonly (readonly VerifiedContainerAccessManifest[])[]\n    | undefined;\n  readonly principalPolicies: readonly Policy[];\n}): void {\n  const dependencyManifestHashes = new Set(\n    input.event.event.dependencyManifestHashes,\n  );\n  const linkedContainerIds = new Set(input.linkedContainerIds);\n\n  for (const path of input.paths ?? []) {\n    const manifest = path.at(-1);\n    if (\n      !manifest ||\n      !linkedContainerIds.has(manifest.state.containerId) ||\n      manifest.state.organizationId !== input.organizationId ||\n      !dependencyManifestHashes.has(manifest.manifestHash)\n    ) {\n      continue;\n    }\n\n    const resolveAccessLevel =\n      input.authorizationMembership === \"referenced\"\n        ? resolveHistoricalContainerPathUserAccessLevel\n        : resolveContainerPathUserAccessLevel;\n    const accessLevel = resolveAccessLevel({\n      path,\n      principalPolicies: input.principalPolicies,\n      userId: input.event.event.signerUserId,\n    });\n\n    if (\n      accessLevel !== null &&\n      containerAccessLevelRank(accessLevel) >= containerAccessLevelRank(\"write\")\n    ) {\n      return;\n    }\n  }\n\n  throwVerification(\n    \"unauthorized\",\n    `${input.label} signer lacks write access through a signed linked container dependency`,\n  );\n}\n\nexport function assertAttachmentDocumentAuthority(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly authorizingContainerPaths:\n    | readonly (readonly VerifiedContainerAccessManifest[])[]\n    | undefined;\n  readonly body: AttachmentAccessEventBody;\n  readonly documentManifest: VerifiedDocumentLinkSetManifest;\n  readonly event: VerifiedAccessEvent;\n  readonly principalPolicies: readonly Policy[];\n}): void {\n  if (\n    input.body.documentId !== input.documentManifest.state.documentId ||\n    input.body.documentManifestHash !== input.documentManifest.manifestHash\n  ) {\n    throwVerification(\n      \"stale_predecessor\",\n      \"attachment event document manifest does not match body\",\n    );\n  }\n\n  if (\n    input.event.event.organizationId !==\n    input.documentManifest.state.organizationId\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"attachment event organization does not match document manifest\",\n    );\n  }\n\n  assertDocumentCitationScope({\n    dependencyManifestHashes: input.event.event.dependencyManifestHashes,\n    additionalDependencyHashes: [input.documentManifest.manifestHash],\n    label: input.body.eventType,\n    linkedContainerIds: input.documentManifest.state.linkedContainerIds,\n    organizationId: input.documentManifest.state.organizationId,\n    paths: input.authorizingContainerPaths ?? [],\n  });\n\n  requireAnyDocumentLinkedContainerWriteAccess({\n    authorizationMembership: input.authorizationMembership,\n    event: input.event,\n    label: input.body.eventType,\n    linkedContainerIds: input.documentManifest.state.linkedContainerIds,\n    organizationId: input.documentManifest.state.organizationId,\n    paths: input.authorizingContainerPaths,\n    principalPolicies: input.principalPolicies,\n  });\n}\n"]}

package/internal/crypto/keying/documentAccessBody.d.ts

@@ -0,0 +1,2 @@
+import type { DocumentAccessEventBody, KeyingCanonicalJson } from "./types.js";
+export declare function normalizeDocumentAccessEventBody(value: KeyingCanonicalJson): DocumentAccessEventBody;

package/internal/crypto/keying/documentAccessBody.js

@@ -0,0 +1,35 @@
+import { isPlainObject } from "../../validators/isPlainObject.js";
+import { normalizeDocumentBlobRewraps } from "./documentBlobRewraps.js";
+import { assertExactKeys, readHashString, readString, throwVerification, } from "./shared.js";
+function normalizeDocumentLinkAccessEventBody(value) {
+    const record = assertExactKeys(value, ["blobRewraps", "containerId", "containerManifestHash", "eventType"], "document.link event body");
+    return {
+        eventType: "document.link",
+        blobRewraps: normalizeDocumentBlobRewraps(record.blobRewraps),
+        containerId: readString(record, "containerId", "document.link event body"),
+        containerManifestHash: readHashString(record, "containerManifestHash", "document.link event body"),
+    };
+}
+function normalizeDocumentUnlinkAccessEventBody(value) {
+    const record = assertExactKeys(value, ["blobRewraps", "containerId", "containerManifestHash", "eventType"], "document.unlink event body");
+    return {
+        eventType: "document.unlink",
+        blobRewraps: normalizeDocumentBlobRewraps(record.blobRewraps),
+        containerId: readString(record, "containerId", "document.unlink event body"),
+        containerManifestHash: readHashString(record, "containerManifestHash", "document.unlink event body"),
+    };
+}
+export function normalizeDocumentAccessEventBody(value) {
+    if (!isPlainObject(value)) {
+        throwVerification("invalid_shape", "document access event body must be a plain object");
+    }
+    const eventType = readString(value, "eventType", "document access body");
+    if (eventType === "document.link") {
+        return normalizeDocumentLinkAccessEventBody(value);
+    }
+    if (eventType === "document.unlink") {
+        return normalizeDocumentUnlinkAccessEventBody(value);
+    }
+    throwVerification("invalid_domain", "document access event body eventType is unsupported");
+}
+//# sourceMappingURL=documentAccessBody.js.map

package/internal/crypto/keying/documentAccessBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentAccessBody.js","sourceRoot":"","sources":["documentAccessBody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAQlB,SAAS,oCAAoC,CAC3C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,CAAC,EACpE,0BAA0B,CAC3B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,eAAe;QAC1B,WAAW,EAAE,4BAA4B,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,0BAA0B,CAAC;QAC1E,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,0BAA0B,CAC3B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,CAAC,EACpE,4BAA4B,CAC7B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,WAAW,EAAE,4BAA4B,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,WAAW,EAAE,UAAU,CACrB,MAAM,EACN,aAAa,EACb,4BAA4B,CAC7B;QACD,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,4BAA4B,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA0B;IAE1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC;IAEzE,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,OAAO,oCAAoC,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,iBAAiB,CACf,gBAAgB,EAChB,qDAAqD,CACtD,CAAC;AACJ,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport { normalizeDocumentBlobRewraps } from \"./documentBlobRewraps\";\nimport {\n  assertExactKeys,\n  readHashString,\n  readString,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  DocumentAccessEventBody,\n  DocumentLinkAccessEventBody,\n  DocumentUnlinkAccessEventBody,\n  KeyingCanonicalJson,\n} from \"./types\";\n\nfunction normalizeDocumentLinkAccessEventBody(\n  value: KeyingCanonicalJson,\n): DocumentLinkAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\"blobRewraps\", \"containerId\", \"containerManifestHash\", \"eventType\"],\n    \"document.link event body\",\n  );\n\n  return {\n    eventType: \"document.link\",\n    blobRewraps: normalizeDocumentBlobRewraps(record.blobRewraps),\n    containerId: readString(record, \"containerId\", \"document.link event body\"),\n    containerManifestHash: readHashString(\n      record,\n      \"containerManifestHash\",\n      \"document.link event body\",\n    ),\n  };\n}\n\nfunction normalizeDocumentUnlinkAccessEventBody(\n  value: KeyingCanonicalJson,\n): DocumentUnlinkAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\"blobRewraps\", \"containerId\", \"containerManifestHash\", \"eventType\"],\n    \"document.unlink event body\",\n  );\n\n  return {\n    eventType: \"document.unlink\",\n    blobRewraps: normalizeDocumentBlobRewraps(record.blobRewraps),\n    containerId: readString(\n      record,\n      \"containerId\",\n      \"document.unlink event body\",\n    ),\n    containerManifestHash: readHashString(\n      record,\n      \"containerManifestHash\",\n      \"document.unlink event body\",\n    ),\n  };\n}\n\nexport function normalizeDocumentAccessEventBody(\n  value: KeyingCanonicalJson,\n): DocumentAccessEventBody {\n  if (!isPlainObject(value)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"document access event body must be a plain object\",\n    );\n  }\n\n  const eventType = readString(value, \"eventType\", \"document access body\");\n\n  if (eventType === \"document.link\") {\n    return normalizeDocumentLinkAccessEventBody(value);\n  }\n\n  if (eventType === \"document.unlink\") {\n    return normalizeDocumentUnlinkAccessEventBody(value);\n  }\n\n  throwVerification(\n    \"invalid_domain\",\n    \"document access event body eventType is unsupported\",\n  );\n}\n"]}

package/internal/crypto/keying/documentBlobRewraps.js

@@ -0,0 +1,82 @@
+import { isPlainObject } from "../../validators/isPlainObject.js";
+import { normalizeCanonicalJsonValue } from "./canonical.js";
+import { assertExactKeys, readHashString, readPositiveInteger, readString, throwVerification, } from "./shared.js";
+function normalizeTarget(value) {
+    const label = "document blob rewrap target";
+    const target = assertExactKeys(value, [
+        "bindingId",
+        "documentId",
+        "containerId",
+        "containerManifestHash",
+        "containerKeyEpochId",
+        "containerKeyEpoch",
+        "wrappedKey",
+        "wrappingMetadata",
+    ], label);
+    if (!isPlainObject(target.wrappingMetadata))
+        throwVerification("invalid_shape", `${label} metadata must be an object`);
+    return {
+        bindingId: readString(target, "bindingId", label),
+        documentId: readString(target, "documentId", label),
+        containerId: readString(target, "containerId", label),
+        containerManifestHash: readHashString(target, "containerManifestHash", label),
+        containerKeyEpochId: readString(target, "containerKeyEpochId", label),
+        containerKeyEpoch: readPositiveInteger(target, "containerKeyEpoch", label),
+        wrappedKey: readString(target, "wrappedKey", label),
+        wrappingMetadata: normalizeCanonicalJsonValue(target.wrappingMetadata, `${label} metadata`),
+    };
+}
+function normalizeRewrap(entry) {
+    const label = "document blob rewrap";
+    const record = assertExactKeys(entry, ["blobId", "contentKeyEpoch", "targets"], label);
+    if (!Array.isArray(record.targets))
+        throwVerification("invalid_shape", `${label} targets must be an array`);
+    const identities = new Set();
+    const targets = record.targets.map((value) => {
+        const target = normalizeTarget(value);
+        const identity = JSON.stringify([
+            target.bindingId,
+            target.documentId,
+            target.containerId,
+        ]);
+        if (identities.has(identity))
+            throwVerification("duplicate_entry", `${label} repeats a target`);
+        identities.add(identity);
+        return target;
+    });
+    return {
+        blobId: readString(record, "blobId", label),
+        contentKeyEpoch: readPositiveInteger(record, "contentKeyEpoch", label),
+        targets,
+    };
+}
+/** The complete encrypted attachment key update is covered by the link signature. */
+export function normalizeDocumentBlobRewraps(value) {
+    if (!Array.isArray(value))
+        throwVerification("invalid_shape", "document blob rewraps must be an array");
+    const blobIds = new Set();
+    return value.map((entry) => {
+        const rewrap = normalizeRewrap(entry);
+        if (blobIds.has(rewrap.blobId))
+            throwVerification("duplicate_entry", "document blob rewrap repeats a blob");
+        blobIds.add(rewrap.blobId);
+        return rewrap;
+    });
+}
+export function assertDocumentBlobRewrapScope(rewraps, state) {
+    for (const rewrap of rewraps) {
+        const byBinding = new Map();
+        for (const target of rewrap.targets) {
+            if (target.documentId !== state.documentId ||
+                !state.linkedContainerIds.includes(target.containerId))
+                throwVerification("object_mismatch", "Document blob rewrap leaves the signed document scope");
+            const containers = byBinding.get(target.bindingId) ?? new Set();
+            containers.add(target.containerId);
+            byBinding.set(target.bindingId, containers);
+        }
+        if (byBinding.size === 0 ||
+            [...byBinding.values()].some((containers) => containers.size !== state.linkedContainerIds.length))
+            throwVerification("missing_dependency", "Document blob rewrap lacks a linked-container target");
+    }
+}
+//# sourceMappingURL=documentBlobRewraps.js.map

package/internal/crypto/keying/documentBlobRewraps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentBlobRewraps.js","sourceRoot":"","sources":["documentBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAGlB,SAAS,eAAe,CACtB,KAAc;IAEd,MAAM,KAAK,GAAG,6BAA6B,CAAC;IAC5C,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,WAAW;QACX,YAAY;QACZ,aAAa;QACb,uBAAuB;QACvB,qBAAqB;QACrB,mBAAmB;QACnB,YAAY;QACZ,kBAAkB;KACnB,EACD,KAAK,CACN,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACzC,iBAAiB,CAAC,eAAe,EAAE,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC;QACjD,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QACnD,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC;QACrD,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,KAAK,CACN;QACD,mBAAmB,EAAE,UAAU,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,CAAC;QACrE,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,CAAC;QAC1E,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QACnD,gBAAgB,EAAE,2BAA2B,CAC3C,MAAM,CAAC,gBAAgB,EACvB,GAAG,KAAK,WAAW,CACpB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,QAAQ,EAAE,iBAAiB,EAAE,SAAS,CAAC,EACxC,KAAK,CACN,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,iBAAiB,CAAC,eAAe,EAAE,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9B,MAAM,CAAC,SAAS;YAChB,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,WAAW;SACnB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1B,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;QACpE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3C,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC;QACtE,OAAO;KACR,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,iBAAiB,CACf,eAAe,EACf,wCAAwC,CACzC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,iBAAiB,CACf,iBAAiB,EACjB,qCAAqC,CACtC,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAsC,EACtC,KAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IACE,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;gBACtC,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;gBAEtD,iBAAiB,CACf,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;YACJ,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACxE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,CAAC;YACpB,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM,CACpE;YAED,iBAAiB,CACf,oBAAoB,EACpB,sDAAsD,CACvD,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport { normalizeCanonicalJsonValue } from \"./canonical\";\nimport {\n  assertExactKeys,\n  readHashString,\n  readPositiveInteger,\n  readString,\n  throwVerification,\n} from \"./shared\";\nimport type { DocumentBlobRewrap, DocumentLinkSetManifestState } from \"./types\";\n\nfunction normalizeTarget(\n  value: unknown,\n): DocumentBlobRewrap[\"targets\"][number] {\n  const label = \"document blob rewrap target\";\n  const target = assertExactKeys(\n    value,\n    [\n      \"bindingId\",\n      \"documentId\",\n      \"containerId\",\n      \"containerManifestHash\",\n      \"containerKeyEpochId\",\n      \"containerKeyEpoch\",\n      \"wrappedKey\",\n      \"wrappingMetadata\",\n    ],\n    label,\n  );\n  if (!isPlainObject(target.wrappingMetadata))\n    throwVerification(\"invalid_shape\", `${label} metadata must be an object`);\n  return {\n    bindingId: readString(target, \"bindingId\", label),\n    documentId: readString(target, \"documentId\", label),\n    containerId: readString(target, \"containerId\", label),\n    containerManifestHash: readHashString(\n      target,\n      \"containerManifestHash\",\n      label,\n    ),\n    containerKeyEpochId: readString(target, \"containerKeyEpochId\", label),\n    containerKeyEpoch: readPositiveInteger(target, \"containerKeyEpoch\", label),\n    wrappedKey: readString(target, \"wrappedKey\", label),\n    wrappingMetadata: normalizeCanonicalJsonValue(\n      target.wrappingMetadata,\n      `${label} metadata`,\n    ),\n  };\n}\n\nfunction normalizeRewrap(entry: unknown): DocumentBlobRewrap {\n  const label = \"document blob rewrap\";\n  const record = assertExactKeys(\n    entry,\n    [\"blobId\", \"contentKeyEpoch\", \"targets\"],\n    label,\n  );\n  if (!Array.isArray(record.targets))\n    throwVerification(\"invalid_shape\", `${label} targets must be an array`);\n  const identities = new Set<string>();\n  const targets = record.targets.map((value) => {\n    const target = normalizeTarget(value);\n    const identity = JSON.stringify([\n      target.bindingId,\n      target.documentId,\n      target.containerId,\n    ]);\n    if (identities.has(identity))\n      throwVerification(\"duplicate_entry\", `${label} repeats a target`);\n    identities.add(identity);\n    return target;\n  });\n  return {\n    blobId: readString(record, \"blobId\", label),\n    contentKeyEpoch: readPositiveInteger(record, \"contentKeyEpoch\", label),\n    targets,\n  };\n}\n\n/** The complete encrypted attachment key update is covered by the link signature. */\nexport function normalizeDocumentBlobRewraps(\n  value: unknown,\n): readonly DocumentBlobRewrap[] {\n  if (!Array.isArray(value))\n    throwVerification(\n      \"invalid_shape\",\n      \"document blob rewraps must be an array\",\n    );\n  const blobIds = new Set<string>();\n  return value.map((entry) => {\n    const rewrap = normalizeRewrap(entry);\n    if (blobIds.has(rewrap.blobId))\n      throwVerification(\n        \"duplicate_entry\",\n        \"document blob rewrap repeats a blob\",\n      );\n    blobIds.add(rewrap.blobId);\n    return rewrap;\n  });\n}\n\nexport function assertDocumentBlobRewrapScope(\n  rewraps: readonly DocumentBlobRewrap[],\n  state: DocumentLinkSetManifestState,\n): void {\n  for (const rewrap of rewraps) {\n    const byBinding = new Map<string, Set<string>>();\n    for (const target of rewrap.targets) {\n      if (\n        target.documentId !== state.documentId ||\n        !state.linkedContainerIds.includes(target.containerId)\n      )\n        throwVerification(\n          \"object_mismatch\",\n          \"Document blob rewrap leaves the signed document scope\",\n        );\n      const containers = byBinding.get(target.bindingId) ?? new Set<string>();\n      containers.add(target.containerId);\n      byBinding.set(target.bindingId, containers);\n    }\n    if (\n      byBinding.size === 0 ||\n      [...byBinding.values()].some(\n        (containers) => containers.size !== state.linkedContainerIds.length,\n      )\n    )\n      throwVerification(\n        \"missing_dependency\",\n        \"Document blob rewrap lacks a linked-container target\",\n      );\n  }\n}\n"]}

package/internal/crypto/keying/documentCitationScope.js

@@ -0,0 +1,55 @@
+import { assertContainerPathIntegrity } from "./containerParentAuthority.js";
+import { throwVerification } from "./shared.js";
+/**
+ * Historical readers reconstruct a path for every cited ancestor. Those
+ * ancestor heads are evidence only when a scoped leaf's path contains them.
+ * A writable path alone cannot license the rest of the citation set.
+ */
+export function assertDocumentCitationScope(input) {
+    for (const path of input.paths) {
+        assertContainerPathIntegrity(path, input.label);
+    }
+    if (input.targetPath) {
+        assertContainerPathIntegrity(input.targetPath, input.label);
+    }
+    const linkedIds = new Set(input.linkedContainerIds);
+    const scopedPaths = input.paths.filter((path) => {
+        const leaf = path.at(-1);
+        return (leaf &&
+            linkedIds.has(leaf.state.containerId) &&
+            (!input.leafManifestHashes ||
+                input.leafManifestHashes.has(leaf.manifestHash)));
+    });
+    const allowedHeads = [...scopedPaths.flat(), ...(input.targetPath ?? [])];
+    if (allowedHeads.some((head) => head.state.organizationId !== input.organizationId)) {
+        throwVerification("object_mismatch", `${input.label} authorizing path crosses organizations`);
+    }
+    const allowedHashes = new Set(allowedHeads.map((head) => head.manifestHash));
+    for (const path of input.paths) {
+        if (path.length === 0 ||
+            path.some((head) => !allowedHashes.has(head.manifestHash))) {
+            throwVerification("object_mismatch", `${input.label} authorizing path is outside the signed target scope`);
+        }
+    }
+    const dependencies = new Set([
+        ...allowedHashes,
+        ...(input.additionalDependencyHashes ?? []),
+    ]);
+    if (input.dependencyManifestHashes?.some((hash) => !dependencies.has(hash))) {
+        throwVerification("missing_dependency", `${input.label} authorizing citation lacks a supplied path`);
+    }
+}
+export function assertDocumentLinkSetCitationScope(input) {
+    const previousIds = input.previousManifest?.state.linkedContainerIds ?? [];
+    assertDocumentCitationScope({
+        dependencyManifestHashes: input.event.event.dependencyManifestHashes,
+        label: input.body.eventType,
+        linkedContainerIds: input.body.eventType === "document.unlink"
+            ? previousIds.filter((id) => id !== input.body.containerId)
+            : previousIds,
+        organizationId: input.event.event.organizationId,
+        paths: input.authorizingContainerPaths ?? [],
+        targetPath: input.targetContainerPath,
+    });
+}
+//# sourceMappingURL=documentCitationScope.js.map

package/internal/crypto/keying/documentCitationScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentCitationScope.js","sourceRoot":"","sources":["documentCitationScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAU7C;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAS3C;IACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,4BAA4B,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CACL,IAAI;YACJ,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,KAAK,CAAC,kBAAkB;gBACxB,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,IACE,YAAY,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAC7D,EACD,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,yCAAyC,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAC1D,CAAC;YACD,iBAAiB,CACf,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,sDAAsD,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,aAAa;QAChB,GAAG,CAAC,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,iBAAiB,CACf,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,6CAA6C,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAMlD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC3E,2BAA2B,CAAC;QAC1B,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB;QACpE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC3B,kBAAkB,EAChB,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB;YACxC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3D,CAAC,CAAC,WAAW;QACjB,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc;QAChD,KAAK,EAAE,KAAK,CAAC,yBAAyB,IAAI,EAAE;QAC5C,UAAU,EAAE,KAAK,CAAC,mBAAmB;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { assertContainerPathIntegrity } from \"./containerParentAuthority\";\nimport { throwVerification } from \"./shared\";\nimport type {\n  DocumentAccessEventBody,\n  VerifiedAccessEvent,\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentLinkSetStateEvidence,\n} from \"./types\";\n\ntype Path = readonly VerifiedContainerAccessManifest[];\n\n/**\n * Historical readers reconstruct a path for every cited ancestor. Those\n * ancestor heads are evidence only when a scoped leaf's path contains them.\n * A writable path alone cannot license the rest of the citation set.\n */\nexport function assertDocumentCitationScope(input: {\n  readonly dependencyManifestHashes?: readonly string[];\n  readonly additionalDependencyHashes?: readonly string[];\n  readonly label: string;\n  readonly linkedContainerIds: readonly string[];\n  readonly leafManifestHashes?: ReadonlySet<string>;\n  readonly organizationId: string;\n  readonly paths: readonly Path[];\n  readonly targetPath?: Path | undefined;\n}): void {\n  for (const path of input.paths) {\n    assertContainerPathIntegrity(path, input.label);\n  }\n  if (input.targetPath) {\n    assertContainerPathIntegrity(input.targetPath, input.label);\n  }\n  const linkedIds = new Set(input.linkedContainerIds);\n  const scopedPaths = input.paths.filter((path) => {\n    const leaf = path.at(-1);\n    return (\n      leaf &&\n      linkedIds.has(leaf.state.containerId) &&\n      (!input.leafManifestHashes ||\n        input.leafManifestHashes.has(leaf.manifestHash))\n    );\n  });\n  const allowedHeads = [...scopedPaths.flat(), ...(input.targetPath ?? [])];\n  if (\n    allowedHeads.some(\n      (head) => head.state.organizationId !== input.organizationId,\n    )\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      `${input.label} authorizing path crosses organizations`,\n    );\n  }\n  const allowedHashes = new Set(allowedHeads.map((head) => head.manifestHash));\n  for (const path of input.paths) {\n    if (\n      path.length === 0 ||\n      path.some((head) => !allowedHashes.has(head.manifestHash))\n    ) {\n      throwVerification(\n        \"object_mismatch\",\n        `${input.label} authorizing path is outside the signed target scope`,\n      );\n    }\n  }\n  const dependencies = new Set([\n    ...allowedHashes,\n    ...(input.additionalDependencyHashes ?? []),\n  ]);\n  if (input.dependencyManifestHashes?.some((hash) => !dependencies.has(hash))) {\n    throwVerification(\n      \"missing_dependency\",\n      `${input.label} authorizing citation lacks a supplied path`,\n    );\n  }\n}\n\nexport function assertDocumentLinkSetCitationScope(input: {\n  readonly authorizingContainerPaths: readonly Path[] | undefined;\n  readonly body: DocumentAccessEventBody;\n  readonly event: VerifiedAccessEvent;\n  readonly previousManifest: VerifiedDocumentLinkSetStateEvidence | null;\n  readonly targetContainerPath: Path | undefined;\n}): void {\n  const previousIds = input.previousManifest?.state.linkedContainerIds ?? [];\n  assertDocumentCitationScope({\n    dependencyManifestHashes: input.event.event.dependencyManifestHashes,\n    label: input.body.eventType,\n    linkedContainerIds:\n      input.body.eventType === \"document.unlink\"\n        ? previousIds.filter((id) => id !== input.body.containerId)\n        : previousIds,\n    organizationId: input.event.event.organizationId,\n    paths: input.authorizingContainerPaths ?? [],\n    targetPath: input.targetContainerPath,\n  });\n}\n"]}

package/internal/crypto/keying/documentContentWriteAuthority.d.ts

@@ -0,0 +1,18 @@
+import type { PrincipalPolicyAuthorization as Policy, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, WriteHeader } from "./types.js";
+export declare function requireWriteAccessThroughCommittedDocumentTarget(input: {
+    readonly authorizationMembership?: "current" | "referenced";
+    readonly documentKekTargets: VerifiedDocumentKekTargets;
+    readonly documentManifest: VerifiedDocumentLinkSetManifest;
+    readonly label: string;
+    readonly paths: readonly (readonly VerifiedContainerAccessManifest[])[];
+    readonly principalPolicies: readonly Policy[];
+    readonly userId: string;
+}): void;
+export declare function requireWriteAccessThroughCommittedBlobTarget(input: {
+    readonly authorizationMembership?: "current" | "referenced";
+    readonly blobKekTargets: VerifiedBlobKekTargets;
+    readonly header: WriteHeader;
+    readonly label: string;
+    readonly paths: readonly (readonly VerifiedContainerAccessManifest[])[];
+    readonly principalPolicies: readonly Policy[];
+}): void;

package/internal/crypto/keying/documentContentWriteAuthority.js

@@ -0,0 +1,81 @@
+import { containerAccessLevelRank, resolveContainerPathUserAccessLevel, } from "./containerAccess.js";
+import { resolveHistoricalContainerPathUserAccessLevel } from "./containerPathAccess.js";
+import { assertDocumentCitationScope } from "./documentCitationScope.js";
+import { throwVerification } from "./shared.js";
+export function requireWriteAccessThroughCommittedDocumentTarget(input) {
+    assertDocumentCitationScope({
+        label: input.label,
+        linkedContainerIds: input.documentManifest.state.linkedContainerIds,
+        leafManifestHashes: new Set(input.documentKekTargets.targets.map((target) => target.containerManifestHash)),
+        organizationId: input.documentManifest.state.organizationId,
+        paths: input.paths,
+    });
+    const targetHashByContainerId = new Map(input.documentKekTargets.targets.map((target) => [
+        target.containerId,
+        target.containerManifestHash,
+    ]));
+    const linkedContainerIds = new Set(input.documentManifest.state.linkedContainerIds);
+    for (const path of input.paths) {
+        const manifest = path.at(-1);
+        if (!manifest ||
+            !linkedContainerIds.has(manifest.state.containerId) ||
+            manifest.state.organizationId !==
+                input.documentManifest.state.organizationId ||
+            targetHashByContainerId.get(manifest.state.containerId) !==
+                manifest.manifestHash) {
+            continue;
+        }
+        const resolveAccess = input.authorizationMembership === "referenced"
+            ? resolveHistoricalContainerPathUserAccessLevel
+            : resolveContainerPathUserAccessLevel;
+        const accessLevel = resolveAccess({
+            path,
+            principalPolicies: input.principalPolicies,
+            userId: input.userId,
+        });
+        if (accessLevel !== null &&
+            containerAccessLevelRank(accessLevel) >= containerAccessLevelRank("write")) {
+            return;
+        }
+    }
+    throwVerification("unauthorized", `${input.label} signer lacks write access through a committed linked container target`);
+}
+export function requireWriteAccessThroughCommittedBlobTarget(input) {
+    assertDocumentCitationScope({
+        label: input.label,
+        linkedContainerIds: input.blobKekTargets.targets.map((target) => target.containerId),
+        leafManifestHashes: new Set(input.blobKekTargets.targets.map((target) => target.containerManifestHash)),
+        organizationId: input.header.organizationId,
+        paths: input.paths,
+    });
+    const targetManifestHashesByContainerId = new Map();
+    for (const target of input.blobKekTargets.targets) {
+        const manifestHashes = targetManifestHashesByContainerId.get(target.containerId) ?? new Set();
+        manifestHashes.add(target.containerManifestHash);
+        targetManifestHashesByContainerId.set(target.containerId, manifestHashes);
+    }
+    for (const path of input.paths) {
+        const manifest = path.at(-1);
+        if (!manifest ||
+            manifest.state.organizationId !== input.header.organizationId ||
+            !targetManifestHashesByContainerId
+                .get(manifest.state.containerId)
+                ?.has(manifest.manifestHash)) {
+            continue;
+        }
+        const resolveAccess = input.authorizationMembership === "referenced"
+            ? resolveHistoricalContainerPathUserAccessLevel
+            : resolveContainerPathUserAccessLevel;
+        const accessLevel = resolveAccess({
+            path,
+            principalPolicies: input.principalPolicies,
+            userId: input.header.writerUserId,
+        });
+        if (accessLevel !== null &&
+            containerAccessLevelRank(accessLevel) >= containerAccessLevelRank("write")) {
+            return;
+        }
+    }
+    throwVerification("unauthorized", `${input.label} signer lacks write access through a committed blob target`);
+}
+//# sourceMappingURL=documentContentWriteAuthority.js.map

package/internal/crypto/keying/documentContentWriteAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentContentWriteAuthority.js","sourceRoot":"","sources":["documentContentWriteAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAU7C,MAAM,UAAU,gDAAgD,CAAC,KAQhE;IACC,2BAA2B,CAAC;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB;QACnE,kBAAkB,EAAE,IAAI,GAAG,CACzB,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC,CACF;QACD,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,qBAAqB;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAChD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IACE,CAAC,QAAQ;YACT,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;YACnD,QAAQ,CAAC,KAAK,CAAC,cAAc;gBAC3B,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc;YAC7C,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;gBACrD,QAAQ,CAAC,YAAY,EACvB,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GACjB,KAAK,CAAC,uBAAuB,KAAK,YAAY;YAC5C,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,WAAW,GAAG,aAAa,CAAC;YAChC,IAAI;YACJ,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,IACE,WAAW,KAAK,IAAI;YACpB,wBAAwB,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAC1E,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,iBAAiB,CACf,cAAc,EACd,GAAG,KAAK,CAAC,KAAK,wEAAwE,CACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAAC,KAO5D;IACC,2BAA2B,CAAC;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAC/B;QACD,kBAAkB,EAAE,IAAI,GAAG,CACzB,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC,CACF;QACD,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,MAAM,iCAAiC,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,cAAc,GAClB,iCAAiC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACzE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjD,iCAAiC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc;YAC7D,CAAC,iCAAiC;iBAC/B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;gBAChC,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GACjB,KAAK,CAAC,uBAAuB,KAAK,YAAY;YAC5C,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,WAAW,GAAG,aAAa,CAAC;YAChC,IAAI;YACJ,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,IACE,WAAW,KAAK,IAAI;YACpB,wBAAwB,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAC1E,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,iBAAiB,CACf,cAAc,EACd,GAAG,KAAK,CAAC,KAAK,4DAA4D,CAC3E,CAAC;AACJ,CAAC","sourcesContent":["import {\n  containerAccessLevelRank,\n  resolveContainerPathUserAccessLevel,\n} from \"./containerAccess\";\nimport { resolveHistoricalContainerPathUserAccessLevel } from \"./containerPathAccess\";\nimport { assertDocumentCitationScope } from \"./documentCitationScope\";\nimport { throwVerification } from \"./shared\";\nimport type {\n  PrincipalPolicyAuthorization as Policy,\n  VerifiedBlobKekTargets,\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentKekTargets,\n  VerifiedDocumentLinkSetManifest,\n  WriteHeader,\n} from \"./types\";\n\nexport function requireWriteAccessThroughCommittedDocumentTarget(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\";\n  readonly documentKekTargets: VerifiedDocumentKekTargets;\n  readonly documentManifest: VerifiedDocumentLinkSetManifest;\n  readonly label: string;\n  readonly paths: readonly (readonly VerifiedContainerAccessManifest[])[];\n  readonly principalPolicies: readonly Policy[];\n  readonly userId: string;\n}): void {\n  assertDocumentCitationScope({\n    label: input.label,\n    linkedContainerIds: input.documentManifest.state.linkedContainerIds,\n    leafManifestHashes: new Set(\n      input.documentKekTargets.targets.map(\n        (target) => target.containerManifestHash,\n      ),\n    ),\n    organizationId: input.documentManifest.state.organizationId,\n    paths: input.paths,\n  });\n  const targetHashByContainerId = new Map(\n    input.documentKekTargets.targets.map((target) => [\n      target.containerId,\n      target.containerManifestHash,\n    ]),\n  );\n  const linkedContainerIds = new Set(\n    input.documentManifest.state.linkedContainerIds,\n  );\n\n  for (const path of input.paths) {\n    const manifest = path.at(-1);\n    if (\n      !manifest ||\n      !linkedContainerIds.has(manifest.state.containerId) ||\n      manifest.state.organizationId !==\n        input.documentManifest.state.organizationId ||\n      targetHashByContainerId.get(manifest.state.containerId) !==\n        manifest.manifestHash\n    ) {\n      continue;\n    }\n\n    const resolveAccess =\n      input.authorizationMembership === \"referenced\"\n        ? resolveHistoricalContainerPathUserAccessLevel\n        : resolveContainerPathUserAccessLevel;\n    const accessLevel = resolveAccess({\n      path,\n      principalPolicies: input.principalPolicies,\n      userId: input.userId,\n    });\n\n    if (\n      accessLevel !== null &&\n      containerAccessLevelRank(accessLevel) >= containerAccessLevelRank(\"write\")\n    ) {\n      return;\n    }\n  }\n\n  throwVerification(\n    \"unauthorized\",\n    `${input.label} signer lacks write access through a committed linked container target`,\n  );\n}\n\nexport function requireWriteAccessThroughCommittedBlobTarget(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\";\n  readonly blobKekTargets: VerifiedBlobKekTargets;\n  readonly header: WriteHeader;\n  readonly label: string;\n  readonly paths: readonly (readonly VerifiedContainerAccessManifest[])[];\n  readonly principalPolicies: readonly Policy[];\n}): void {\n  assertDocumentCitationScope({\n    label: input.label,\n    linkedContainerIds: input.blobKekTargets.targets.map(\n      (target) => target.containerId,\n    ),\n    leafManifestHashes: new Set(\n      input.blobKekTargets.targets.map(\n        (target) => target.containerManifestHash,\n      ),\n    ),\n    organizationId: input.header.organizationId,\n    paths: input.paths,\n  });\n  const targetManifestHashesByContainerId = new Map<string, Set<string>>();\n\n  for (const target of input.blobKekTargets.targets) {\n    const manifestHashes =\n      targetManifestHashesByContainerId.get(target.containerId) ?? new Set();\n    manifestHashes.add(target.containerManifestHash);\n    targetManifestHashesByContainerId.set(target.containerId, manifestHashes);\n  }\n\n  for (const path of input.paths) {\n    const manifest = path.at(-1);\n    if (\n      !manifest ||\n      manifest.state.organizationId !== input.header.organizationId ||\n      !targetManifestHashesByContainerId\n        .get(manifest.state.containerId)\n        ?.has(manifest.manifestHash)\n    ) {\n      continue;\n    }\n\n    const resolveAccess =\n      input.authorizationMembership === \"referenced\"\n        ? resolveHistoricalContainerPathUserAccessLevel\n        : resolveContainerPathUserAccessLevel;\n    const accessLevel = resolveAccess({\n      path,\n      principalPolicies: input.principalPolicies,\n      userId: input.header.writerUserId,\n    });\n\n    if (\n      accessLevel !== null &&\n      containerAccessLevelRank(accessLevel) >= containerAccessLevelRank(\"write\")\n    ) {\n      return;\n    }\n  }\n\n  throwVerification(\n    \"unauthorized\",\n    `${input.label} signer lacks write access through a committed blob target`,\n  );\n}\n"]}

package/internal/crypto/keying/documentPurge.d.ts

@@ -0,0 +1,17 @@
+import type { KeyingCanonicalJson, KeyingVerificationResult, PrincipalPolicyAuthorization, VerifiedAccessEvent, VerifiedContainerAccessManifest, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot } from "./types.js";
+export interface DocumentPurgeAccessEventBody {
+    eventType: "document.purge";
+    authorizingContainerManifestHashes: string[];
+    containerId: string;
+    containerManifestHash: string;
+    documentManifestHash: string;
+}
+export interface VerifyDocumentPurgeEventInput {
+    readonly event: VerifiedAccessEvent;
+    readonly documentManifest: VerifiedDocumentLinkSetManifest | VerifiedDocumentLinkSetSnapshot;
+    readonly authorizingContainerPath: readonly VerifiedContainerAccessManifest[];
+    readonly principalPolicies?: readonly PrincipalPolicyAuthorization[];
+    readonly expectedDocumentId?: string;
+}
+export declare function normalizeDocumentPurgeAccessEventBody(value: KeyingCanonicalJson): DocumentPurgeAccessEventBody;
+export declare function verifyDocumentPurgeEvent(input: VerifyDocumentPurgeEventInput): Promise<KeyingVerificationResult<VerifiedAccessEvent>>;

package/internal/crypto/keying/documentPurge.js

@@ -0,0 +1,124 @@
+import { containerAccessLevelRank, requireContainerPathLast, resolveHistoricalContainerPathUserAccessLevel, } from "./containerAccess.js";
+import { assertExactKeys, readHashArray, readHashString, readString, runVerifier, throwVerification, } from "./shared.js";
+export function normalizeDocumentPurgeAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "authorizingContainerManifestHashes",
+        "containerId",
+        "containerManifestHash",
+        "documentManifestHash",
+        "eventType",
+    ], "document.purge event body");
+    const authorizingContainerManifestHashes = readHashArray(record.authorizingContainerManifestHashes, "document.purge event body.authorizingContainerManifestHashes");
+    if (authorizingContainerManifestHashes.length === 0) {
+        throwVerification("missing_dependency", "document purge authorization path hashes are required");
+    }
+    if (new Set(authorizingContainerManifestHashes).size !==
+        authorizingContainerManifestHashes.length) {
+        throwVerification("duplicate_entry", "document purge authorization path hashes contain a duplicate");
+    }
+    if (record.eventType !== "document.purge") {
+        throwVerification("invalid_domain", "document purge event body must use document.purge");
+    }
+    return {
+        authorizingContainerManifestHashes,
+        containerId: readString(record, "containerId", "document.purge event body"),
+        containerManifestHash: readHashString(record, "containerManifestHash", "document.purge event body"),
+        documentManifestHash: readHashString(record, "documentManifestHash", "document.purge event body"),
+        eventType: "document.purge",
+    };
+}
+function assertPurgeEventIdentity(input, body) {
+    const event = input.event.event;
+    const documentState = input.documentManifest.state;
+    if (event.eventType !== "document.purge" || event.objectKind !== "document") {
+        throwVerification("invalid_domain", "document purge event must target a document");
+    }
+    if (input.expectedDocumentId !== undefined &&
+        event.objectId !== input.expectedDocumentId) {
+        throwVerification("object_mismatch", "document purge event targets the wrong document");
+    }
+    if (event.objectId !== documentState.documentId ||
+        event.organizationId !== documentState.organizationId) {
+        throwVerification("object_mismatch", "document purge event does not match the document manifest");
+    }
+    if (event.previousManifestHash !== input.documentManifest.manifestHash ||
+        body.documentManifestHash !== input.documentManifest.manifestHash) {
+        throwVerification("stale_predecessor", "document purge event does not bind the supplied document head");
+    }
+}
+function assertPurgeDependencies(input, body) {
+    const event = input.event.event;
+    const linkedContainerIds = input.documentManifest.state.linkedContainerIds;
+    if (linkedContainerIds.length !== 1 ||
+        linkedContainerIds[0] !== body.containerId) {
+        throwVerification("missing_dependency", "document purge requires exactly one linked container");
+    }
+    if (body.authorizingContainerManifestHashes.at(-1) !==
+        body.containerManifestHash) {
+        throwVerification("missing_dependency", "document purge authorization path does not end at its container head");
+    }
+    const expectedDependencies = [
+        ...body.authorizingContainerManifestHashes,
+    ].sort();
+    if (event.dependencyManifestHashes.length !== expectedDependencies.length ||
+        event.dependencyManifestHashes.some((hash, index) => hash !== expectedDependencies[index])) {
+        throwVerification("missing_dependency", "document purge event must bind exactly its authorizing container path");
+    }
+}
+function assertPurgeAuthorizationPath(input, body) {
+    const root = input.authorizingContainerPath[0];
+    if (!root ||
+        root.state.parentContainerId !== null ||
+        root.state.parentManifestHash !== null) {
+        throwVerification("missing_dependency", "document purge authorization path must start at a root container");
+    }
+    for (const [index, manifest] of input.authorizingContainerPath.entries()) {
+        if (body.authorizingContainerManifestHashes[index] !== manifest.manifestHash) {
+            throwVerification("missing_dependency", "document purge authorization path does not match the signed path");
+        }
+        if (manifest.state.organizationId !==
+            input.documentManifest.state.organizationId) {
+            throwVerification("object_mismatch", "document purge authorization path crosses organizations");
+        }
+        const parent = input.authorizingContainerPath[index - 1];
+        if (parent &&
+            manifest.state.parentContainerId !== parent.state.containerId) {
+            throwVerification("missing_dependency", "document purge authorization path is not contiguous");
+        }
+    }
+    if (body.authorizingContainerManifestHashes.length !==
+        input.authorizingContainerPath.length) {
+        throwVerification("missing_dependency", "document purge authorization path does not match the signed path");
+    }
+}
+function requirePurgeAuthorization(input, body) {
+    const containerManifest = requireContainerPathLast(input.authorizingContainerPath, "document.purge authorization");
+    assertPurgeAuthorizationPath(input, body);
+    if (containerManifest.state.containerId !== body.containerId ||
+        containerManifest.manifestHash !== body.containerManifestHash) {
+        throwVerification("missing_dependency", "document.purge authorization path does not end at the signed container manifest");
+    }
+    if (containerManifest.state.organizationId !==
+        input.documentManifest.state.organizationId) {
+        throwVerification("object_mismatch", "document.purge authorization container belongs to the wrong organization");
+    }
+    const accessLevel = resolveHistoricalContainerPathUserAccessLevel({
+        path: input.authorizingContainerPath,
+        principalPolicies: input.principalPolicies ?? [],
+        userId: input.event.event.signerUserId,
+    });
+    if (accessLevel === null ||
+        containerAccessLevelRank(accessLevel) < containerAccessLevelRank("write")) {
+        throwVerification("unauthorized", "document.purge authorization signer lacks write access");
+    }
+}
+export async function verifyDocumentPurgeEvent(input) {
+    return runVerifier(async () => {
+        const body = normalizeDocumentPurgeAccessEventBody(input.event.body);
+        assertPurgeEventIdentity(input, body);
+        assertPurgeDependencies(input, body);
+        requirePurgeAuthorization(input, body);
+        return input.event;
+    });
+}
+//# sourceMappingURL=documentPurge.js.map