@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/client/securityIncidents.js

@@ -0,0 +1,287 @@
+import { compareCanonicalStrings, isKeyingVerificationCode, } from "../internal/crypto/index.js";
+import { isKeyingVerificationError } from "../data/keyingProjectionVerification/error.js";
+import { appendSecurityIncident, listSecurityIncidents, } from "../data/persistence/securityIncidentPersistence.js";
+import { createListenerSet } from "./listenerSet.js";
+const MAX_BUFFERED_SECURITY_INCIDENTS = 100;
+const MAX_EVIDENCE_HASH_COUNT = 32;
+const MAX_EVIDENCE_HASH_KEY_LENGTH = 64;
+const MAX_EVIDENCE_HASH_VALUE_LENGTH = 256;
+const MAX_INCIDENT_IDENTIFIER_LENGTH = 256;
+const MAX_INCIDENT_OPERATION_LENGTH = 128;
+const SECURITY_INCIDENT_RETRY_DELAY_MS = 250;
+const SECURITY_INCIDENT_MAX_RETRY_DELAY_MS = 30_000;
+function verificationCode(error) {
+    if (!isKeyingVerificationError(error))
+        return null;
+    const code = Reflect.get(error, "code");
+    return isKeyingVerificationCode(code)
+        ? code
+        : "unrecognized_verification_code";
+}
+function boundIncidentText(value, maxLength) {
+    return value.slice(0, maxLength);
+}
+function boundNullableIncidentText(value) {
+    return value === null
+        ? null
+        : boundIncidentText(value, MAX_INCIDENT_IDENTIFIER_LENGTH);
+}
+function redactIncidentContext(context) {
+    return {
+        evidenceHashes: Object.fromEntries(Object.entries(context.evidenceHashes ?? {})
+            .filter(([key, value]) => key.length > 0 &&
+            key.length <= MAX_EVIDENCE_HASH_KEY_LENGTH &&
+            value.length <= MAX_EVIDENCE_HASH_VALUE_LENGTH)
+            // Code-unit order: the retained keys feed the incident id hash, so
+            // truncation must pick the same keys on every runtime and locale.
+            .sort(([left], [right]) => compareCanonicalStrings(left, right))
+            .slice(0, MAX_EVIDENCE_HASH_COUNT)),
+        objectId: boundNullableIncidentText(context.objectId),
+        objectKind: context.objectKind,
+        operation: boundIncidentText(context.operation, MAX_INCIDENT_OPERATION_LENGTH),
+        organizationId: boundNullableIncidentText(context.organizationId ?? null),
+    };
+}
+function redactedIncidentKey(incident) {
+    return JSON.stringify([
+        incident.code,
+        incident.context.operation,
+        incident.context.objectKind,
+        incident.context.objectId,
+        incident.context.organizationId ?? null,
+        incident.context.evidenceHashes,
+    ]);
+}
+class SecurityIncidentSink {
+    options;
+    listeners;
+    bufferedIncidents = new Map();
+    flushPromise = null;
+    retryDelayMs = SECURITY_INCIDENT_RETRY_DELAY_MS;
+    retryTimeout = null;
+    unsubscribeDatabase;
+    disposed = false;
+    constructor(options, listeners) {
+        this.options = options;
+        this.listeners = listeners;
+        this.unsubscribeDatabase = options.database.subscribe(() => {
+            void this.flush();
+        });
+    }
+    dispose() {
+        this.disposed = true;
+        this.unsubscribeDatabase();
+        if (this.retryTimeout)
+            clearTimeout(this.retryTimeout);
+        this.retryTimeout = null;
+        this.bufferedIncidents.clear();
+    }
+    async persist(code, context) {
+        if (this.disposed)
+            return "failed";
+        const detectedAt = new Date().toISOString();
+        const incident = {
+            code,
+            context: redactIncidentContext(context),
+            detectedAt,
+            lastDetectedAt: detectedAt,
+            occurrenceCount: 1,
+        };
+        const execSql = this.options.database.execSql;
+        if (this.options.database.status !== "ready" || !execSql) {
+            return this.bufferStatus(incident);
+        }
+        try {
+            const persisted = await this.append(execSql, incident);
+            if (this.bufferedIncidents.size === 0)
+                this.resetFlushRetry();
+            if (!persisted) {
+                this.options.logError("Security incident was dropped by the local retention limit");
+                return "failed";
+            }
+            this.notify(persisted);
+            return "recorded";
+        }
+        catch (persistenceError) {
+            const status = this.bufferStatus(incident);
+            if (status === "buffered")
+                this.scheduleFlushRetry();
+            this.options.logError("Security incident could not be persisted", persistenceError);
+            return status;
+        }
+    }
+    bufferStatus(incident) {
+        return this.buffer(incident) ? "buffered" : "failed";
+    }
+    async flush() {
+        if (this.disposed)
+            return;
+        for (;;) {
+            const activeFlush = this.flushPromise ?? this.startFlushBatch();
+            if (!activeFlush)
+                return;
+            const succeeded = await activeFlush;
+            if (succeeded)
+                this.resetFlushRetry();
+            if (this.flushPromise && this.flushPromise !== activeFlush)
+                continue;
+            if (this.flushPromise === activeFlush)
+                this.flushPromise = null;
+            if (!succeeded ||
+                this.bufferedIncidents.size === 0 ||
+                this.options.database.status !== "ready") {
+                return;
+            }
+        }
+    }
+    startFlushBatch() {
+        const execSql = this.options.database.execSql;
+        if (this.options.database.status !== "ready" || !execSql)
+            return null;
+        const pending = [...this.bufferedIncidents.values()];
+        if (pending.length === 0)
+            return null;
+        this.bufferedIncidents.clear();
+        const flush = this.flushPending(execSql, pending);
+        this.flushPromise = flush;
+        return flush;
+    }
+    append(execSql, incident) {
+        return appendSecurityIncident(execSql, {
+            code: incident.code,
+            detectedAt: incident.detectedAt,
+            evidenceHashes: incident.context.evidenceHashes,
+            lastDetectedAt: incident.lastDetectedAt,
+            objectId: incident.context.objectId,
+            objectKind: incident.context.objectKind,
+            occurrenceCount: incident.occurrenceCount,
+            operation: incident.context.operation,
+            organizationId: incident.context.organizationId,
+            trustDomain: this.options.trustDomain,
+        });
+    }
+    buffer(incident) {
+        if (this.disposed)
+            return false;
+        const key = redactedIncidentKey(incident);
+        const existing = this.bufferedIncidents.get(key);
+        if (existing) {
+            this.bufferedIncidents.set(key, {
+                ...existing,
+                lastDetectedAt: incident.lastDetectedAt,
+                occurrenceCount: existing.occurrenceCount + incident.occurrenceCount,
+            });
+            return true;
+        }
+        if (this.bufferedIncidents.size >= MAX_BUFFERED_SECURITY_INCIDENTS) {
+            this.options.logError("Security incident could not be buffered because the startup buffer is full");
+            return false;
+        }
+        this.bufferedIncidents.set(key, incident);
+        return true;
+    }
+    async flushPending(execSql, pending) {
+        let succeeded = true;
+        for (const incident of pending) {
+            try {
+                const persisted = await this.append(execSql, incident);
+                if (persisted)
+                    this.notify(persisted);
+            }
+            catch (persistenceError) {
+                succeeded = false;
+                if (this.buffer(incident))
+                    this.scheduleFlushRetry();
+                this.options.logError("Buffered security incident could not be persisted", persistenceError);
+            }
+        }
+        return succeeded;
+    }
+    notify(incident) {
+        if (this.disposed)
+            return;
+        this.listeners.notify(incident);
+        try {
+            this.options.onIncident?.(incident);
+        }
+        catch (callbackError) {
+            this.options.logError("Security incident callback failed", callbackError);
+        }
+    }
+    scheduleFlushRetry() {
+        if (this.disposed || this.retryTimeout)
+            return;
+        const retryDelayMs = this.retryDelayMs;
+        this.retryDelayMs = Math.min(this.retryDelayMs * 2, SECURITY_INCIDENT_MAX_RETRY_DELAY_MS);
+        this.retryTimeout = setTimeout(() => {
+            this.retryTimeout = null;
+            if (this.disposed)
+                return;
+            void this.flush();
+        }, retryDelayMs);
+    }
+    resetFlushRetry() {
+        this.retryDelayMs = SECURITY_INCIDENT_RETRY_DELAY_MS;
+        if (!this.retryTimeout)
+            return;
+        clearTimeout(this.retryTimeout);
+        this.retryTimeout = null;
+    }
+}
+export function createSecurityIncidentService(options) {
+    const listeners = createListenerSet();
+    const recordedErrors = new WeakMap();
+    const incidentReports = new WeakMap();
+    const sink = new SecurityIncidentSink(options, listeners);
+    const persistIncident = async (error, context) => {
+        const code = verificationCode(error);
+        if (!code) {
+            return "failed";
+        }
+        if (code === "unrecognized_verification_code") {
+            options.logError("Security incident used the fallback code because its verification code is unrecognized");
+        }
+        return sink.persist(code, context);
+    };
+    const record = async (error, context) => {
+        if (typeof error !== "object" || error === null) {
+            return "failed";
+        }
+        const recorded = recordedErrors.get(error);
+        if (recorded)
+            return recorded;
+        const inFlight = incidentReports.get(error);
+        if (inFlight)
+            return inFlight;
+        const pending = persistIncident(error, context)
+            .then((status) => {
+            if (status !== "failed")
+                recordedErrors.set(error, status);
+            return status;
+        })
+            .finally(() => {
+            incidentReports.delete(error);
+        });
+        incidentReports.set(error, pending);
+        return pending;
+    };
+    const report = async (error, context) => {
+        await record(error, context);
+    };
+    return {
+        dispose: () => sink.dispose(),
+        incidents: {
+            async list() {
+                await sink.flush();
+                const execSql = options.database.execSql;
+                return options.database.status === "ready" && execSql
+                    ? listSecurityIncidents(execSql, options.trustDomain)
+                    : null;
+            },
+            record,
+            subscribe: listeners.subscribe,
+        },
+        report,
+    };
+}
+//# sourceMappingURL=securityIncidents.js.map

package/client/securityIncidents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityIncidents.js","sourceRoot":"","sources":["securityIncidents.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAQzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAclD,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAC5C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAC3C,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAC3C,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAC1C,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAgCpD,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,wBAAwB,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC;AACvC,CAAC;AAUD,SAAS,iBAAiB,CAAC,KAAa,EAAE,SAAiB;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAoB;IACrD,OAAO,KAAK,KAAK,IAAI;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAgC;IAEhC,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;aACzC,MAAM,CACL,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,MAAM,GAAG,CAAC;YACd,GAAG,CAAC,MAAM,IAAI,4BAA4B;YAC1C,KAAK,CAAC,MAAM,IAAI,8BAA8B,CACjD;YACD,mEAAmE;YACnE,kEAAkE;aACjE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CACrC;QACD,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,iBAAiB,CAC1B,OAAO,CAAC,SAAS,EACjB,6BAA6B,CAC9B;QACD,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA0B;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,OAAO,CAAC,SAAS;QAC1B,QAAQ,CAAC,OAAO,CAAC,UAAU;QAC3B,QAAQ,CAAC,OAAO,CAAC,QAAQ;QACzB,QAAQ,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI;QACvC,QAAQ,CAAC,OAAO,CAAC,cAAc;KAChC,CAAC,CAAC;AACL,CAAC;AAMD,MAAM,oBAAoB;IASL;IACA;IATF,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjE,YAAY,GAA4B,IAAI,CAAC;IAC7C,YAAY,GAAG,gCAAgC,CAAC;IAChD,YAAY,GAAyC,IAAI,CAAC;IACjD,mBAAmB,CAAa;IACzC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACmB,OAAuC,EACvC,SAAoC;QADpC,YAAO,GAAP,OAAO,CAAgC;QACvC,cAAS,GAAT,SAAS,CAA2B;QAErD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;YACzD,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAA8B,EAC9B,OAAgC;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAqB;YACjC,IAAI;YACJ,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACvC,UAAU;YACV,cAAc,EAAE,UAAU;YAC1B,eAAe,EAAE,CAAC;SACnB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,QAAQ,CACnB,4DAA4D,CAC7D,CAAC;gBACF,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,gBAAgB,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,UAAU;gBAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,CACnB,0CAA0C,EAC1C,gBAAgB,CACjB,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,QAA0B;QAE1B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,SAAS,CAAC;YACR,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChE,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;YACpC,IAAI,SAAS;gBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW;gBAAE,SAAS;YACrE,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAChE,IACE,CAAC,SAAS;gBACV,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EACxC,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CACZ,OAAyC,EACzC,QAA0B;QAE1B,OAAO,sBAAsB,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc;YAC/C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;YACnC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;YACvC,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;YACrC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc;YAC/C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,QAA0B;QACvC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC9B,GAAG,QAAQ;gBACX,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe;aACrE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,+BAA+B,EAAE,CAAC;YACnE,IAAI,CAAC,OAAO,CAAC,QAAQ,CACnB,4EAA4E,CAC7E,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAyC,EACzC,OAAwC;QAExC,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACvD,IAAI,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,gBAAgB,EAAE,CAAC;gBAC1B,SAAS,GAAG,KAAK,CAAC;gBAClB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,CACnB,mDAAmD,EACnD,gBAAgB,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,QAA0B;QACvC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,EAAE,aAAa,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAC1B,IAAI,CAAC,YAAY,GAAG,CAAC,EACrB,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,YAAY,CAAC,CAAC;IACnB,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,YAAY,GAAG,gCAAgC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAC/B,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,SAAS,GAAG,iBAAiB,EAAsB,CAAC;IAC1D,MAAM,cAAc,GAAG,IAAI,OAAO,EAA2C,CAAC;IAC9E,MAAM,eAAe,GAAG,IAAI,OAAO,EAGhC,CAAC;IACJ,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE1D,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAc,EACd,OAAgC,EACU,EAAE;QAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;YAC9C,OAAO,CAAC,QAAQ,CACd,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAc,EACd,OAAgC,EACU,EAAE;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC;aAC5C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,MAAM,KAAK,QAAQ;gBAAE,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACL,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,MAAM,GAA6B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;QAC7B,SAAS,EAAE;YACT,KAAK,CAAC,IAAI;gBACR,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO;oBACnD,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC;oBACrD,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;YACD,MAAM;YACN,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B;QACD,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  isKeyingVerificationCode,\n  type KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport { isKeyingVerificationError } from \"../data/keyingProjectionVerification/error\";\nimport {\n  appendSecurityIncident,\n  listSecurityIncidents,\n} from \"../data/persistence/securityIncidentPersistence\";\nimport type {\n  SecurityIncident,\n  SecurityIncidentContext,\n  SecurityIncidentObjectKind,\n  SecurityIncidentReporter,\n} from \"../data/securityIncidents\";\nimport type { Database } from \"./database\";\nimport { createListenerSet } from \"./listenerSet\";\n\nexport type { SecurityIncident, SecurityIncidentObjectKind };\n\nexport type SecurityIncidentListener = (incident: SecurityIncident) => void;\n\n/**\n * Where a reported incident ended up: `recorded` rows are durable in the local\n * ledger, `buffered` ones wait in memory for a retried write, and `failed`\n * ones were dropped, so only `recorded` justifies telling a user it was kept.\n * Hosts name it as `Awaited<ReturnType<SecurityIncidents[\"record\"]>>`.\n */\ntype SecurityIncidentRecordingStatus = \"buffered\" | \"failed\" | \"recorded\";\n\nconst MAX_BUFFERED_SECURITY_INCIDENTS = 100;\nconst MAX_EVIDENCE_HASH_COUNT = 32;\nconst MAX_EVIDENCE_HASH_KEY_LENGTH = 64;\nconst MAX_EVIDENCE_HASH_VALUE_LENGTH = 256;\nconst MAX_INCIDENT_IDENTIFIER_LENGTH = 256;\nconst MAX_INCIDENT_OPERATION_LENGTH = 128;\nconst SECURITY_INCIDENT_RETRY_DELAY_MS = 250;\nconst SECURITY_INCIDENT_MAX_RETRY_DELAY_MS = 30_000;\n\nexport interface SecurityIncidents {\n  /** Returns null while the local database is unavailable. */\n  list(): Promise<ReadonlyArray<SecurityIncident> | null>;\n  /**\n   * Durably record a terminal verification failure the host detected itself,\n   * such as conflicting purge proofs found while merging a local backup. The\n   * report is redacted, coalesced, retained, and buffered exactly like an\n   * SDK-detected incident; one error instance is recorded at most once, and\n   * repeats of it resolve with the status of the first report.\n   */\n  record(\n    error: KeyingVerificationError,\n    context: SecurityIncidentContext,\n  ): Promise<SecurityIncidentRecordingStatus>;\n  subscribe(listener: SecurityIncidentListener): () => void;\n}\n\ninterface SecurityIncidentServiceOptions {\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly onIncident?: SecurityIncidentListener | undefined;\n  readonly trustDomain: string | null;\n}\n\ninterface SecurityIncidentServiceResult {\n  readonly dispose: () => void;\n  readonly incidents: SecurityIncidents;\n  readonly report: SecurityIncidentReporter;\n}\n\nfunction verificationCode(error: unknown): SecurityIncident[\"code\"] | null {\n  if (!isKeyingVerificationError(error)) return null;\n  const code = Reflect.get(error, \"code\");\n  return isKeyingVerificationCode(code)\n    ? code\n    : \"unrecognized_verification_code\";\n}\n\ninterface RedactedIncident {\n  readonly code: SecurityIncident[\"code\"];\n  readonly context: SecurityIncidentContext;\n  readonly detectedAt: string;\n  readonly lastDetectedAt: string;\n  readonly occurrenceCount: number;\n}\n\nfunction boundIncidentText(value: string, maxLength: number): string {\n  return value.slice(0, maxLength);\n}\n\nfunction boundNullableIncidentText(value: string | null): string | null {\n  return value === null\n    ? null\n    : boundIncidentText(value, MAX_INCIDENT_IDENTIFIER_LENGTH);\n}\n\nfunction redactIncidentContext(\n  context: SecurityIncidentContext,\n): SecurityIncidentContext {\n  return {\n    evidenceHashes: Object.fromEntries(\n      Object.entries(context.evidenceHashes ?? {})\n        .filter(\n          ([key, value]) =>\n            key.length > 0 &&\n            key.length <= MAX_EVIDENCE_HASH_KEY_LENGTH &&\n            value.length <= MAX_EVIDENCE_HASH_VALUE_LENGTH,\n        )\n        // Code-unit order: the retained keys feed the incident id hash, so\n        // truncation must pick the same keys on every runtime and locale.\n        .sort(([left], [right]) => compareCanonicalStrings(left, right))\n        .slice(0, MAX_EVIDENCE_HASH_COUNT),\n    ),\n    objectId: boundNullableIncidentText(context.objectId),\n    objectKind: context.objectKind,\n    operation: boundIncidentText(\n      context.operation,\n      MAX_INCIDENT_OPERATION_LENGTH,\n    ),\n    organizationId: boundNullableIncidentText(context.organizationId ?? null),\n  };\n}\n\nfunction redactedIncidentKey(incident: RedactedIncident): string {\n  return JSON.stringify([\n    incident.code,\n    incident.context.operation,\n    incident.context.objectKind,\n    incident.context.objectId,\n    incident.context.organizationId ?? null,\n    incident.context.evidenceHashes,\n  ]);\n}\n\ntype SecurityIncidentListeners = ReturnType<\n  typeof createListenerSet<[SecurityIncident]>\n>;\n\nclass SecurityIncidentSink {\n  private readonly bufferedIncidents = new Map<string, RedactedIncident>();\n  private flushPromise: Promise<boolean> | null = null;\n  private retryDelayMs = SECURITY_INCIDENT_RETRY_DELAY_MS;\n  private retryTimeout: ReturnType<typeof setTimeout> | null = null;\n  private readonly unsubscribeDatabase: () => void;\n  private disposed = false;\n\n  constructor(\n    private readonly options: SecurityIncidentServiceOptions,\n    private readonly listeners: SecurityIncidentListeners,\n  ) {\n    this.unsubscribeDatabase = options.database.subscribe(() => {\n      void this.flush();\n    });\n  }\n\n  dispose(): void {\n    this.disposed = true;\n    this.unsubscribeDatabase();\n    if (this.retryTimeout) clearTimeout(this.retryTimeout);\n    this.retryTimeout = null;\n    this.bufferedIncidents.clear();\n  }\n\n  async persist(\n    code: SecurityIncident[\"code\"],\n    context: SecurityIncidentContext,\n  ): Promise<SecurityIncidentRecordingStatus> {\n    if (this.disposed) return \"failed\";\n    const detectedAt = new Date().toISOString();\n    const incident: RedactedIncident = {\n      code,\n      context: redactIncidentContext(context),\n      detectedAt,\n      lastDetectedAt: detectedAt,\n      occurrenceCount: 1,\n    };\n    const execSql = this.options.database.execSql;\n    if (this.options.database.status !== \"ready\" || !execSql) {\n      return this.bufferStatus(incident);\n    }\n\n    try {\n      const persisted = await this.append(execSql, incident);\n      if (this.bufferedIncidents.size === 0) this.resetFlushRetry();\n      if (!persisted) {\n        this.options.logError(\n          \"Security incident was dropped by the local retention limit\",\n        );\n        return \"failed\";\n      }\n      this.notify(persisted);\n      return \"recorded\";\n    } catch (persistenceError) {\n      const status = this.bufferStatus(incident);\n      if (status === \"buffered\") this.scheduleFlushRetry();\n      this.options.logError(\n        \"Security incident could not be persisted\",\n        persistenceError,\n      );\n      return status;\n    }\n  }\n\n  private bufferStatus(\n    incident: RedactedIncident,\n  ): SecurityIncidentRecordingStatus {\n    return this.buffer(incident) ? \"buffered\" : \"failed\";\n  }\n\n  async flush(): Promise<void> {\n    if (this.disposed) return;\n    for (;;) {\n      const activeFlush = this.flushPromise ?? this.startFlushBatch();\n      if (!activeFlush) return;\n      const succeeded = await activeFlush;\n      if (succeeded) this.resetFlushRetry();\n      if (this.flushPromise && this.flushPromise !== activeFlush) continue;\n      if (this.flushPromise === activeFlush) this.flushPromise = null;\n      if (\n        !succeeded ||\n        this.bufferedIncidents.size === 0 ||\n        this.options.database.status !== \"ready\"\n      ) {\n        return;\n      }\n    }\n  }\n\n  private startFlushBatch(): Promise<boolean> | null {\n    const execSql = this.options.database.execSql;\n    if (this.options.database.status !== \"ready\" || !execSql) return null;\n\n    const pending = [...this.bufferedIncidents.values()];\n    if (pending.length === 0) return null;\n    this.bufferedIncidents.clear();\n    const flush = this.flushPending(execSql, pending);\n    this.flushPromise = flush;\n    return flush;\n  }\n\n  private append(\n    execSql: NonNullable<Database[\"execSql\"]>,\n    incident: RedactedIncident,\n  ): Promise<SecurityIncident | null> {\n    return appendSecurityIncident(execSql, {\n      code: incident.code,\n      detectedAt: incident.detectedAt,\n      evidenceHashes: incident.context.evidenceHashes,\n      lastDetectedAt: incident.lastDetectedAt,\n      objectId: incident.context.objectId,\n      objectKind: incident.context.objectKind,\n      occurrenceCount: incident.occurrenceCount,\n      operation: incident.context.operation,\n      organizationId: incident.context.organizationId,\n      trustDomain: this.options.trustDomain,\n    });\n  }\n\n  private buffer(incident: RedactedIncident): boolean {\n    if (this.disposed) return false;\n    const key = redactedIncidentKey(incident);\n    const existing = this.bufferedIncidents.get(key);\n    if (existing) {\n      this.bufferedIncidents.set(key, {\n        ...existing,\n        lastDetectedAt: incident.lastDetectedAt,\n        occurrenceCount: existing.occurrenceCount + incident.occurrenceCount,\n      });\n      return true;\n    }\n    if (this.bufferedIncidents.size >= MAX_BUFFERED_SECURITY_INCIDENTS) {\n      this.options.logError(\n        \"Security incident could not be buffered because the startup buffer is full\",\n      );\n      return false;\n    }\n    this.bufferedIncidents.set(key, incident);\n    return true;\n  }\n\n  private async flushPending(\n    execSql: NonNullable<Database[\"execSql\"]>,\n    pending: ReadonlyArray<RedactedIncident>,\n  ): Promise<boolean> {\n    let succeeded = true;\n    for (const incident of pending) {\n      try {\n        const persisted = await this.append(execSql, incident);\n        if (persisted) this.notify(persisted);\n      } catch (persistenceError) {\n        succeeded = false;\n        if (this.buffer(incident)) this.scheduleFlushRetry();\n        this.options.logError(\n          \"Buffered security incident could not be persisted\",\n          persistenceError,\n        );\n      }\n    }\n    return succeeded;\n  }\n\n  private notify(incident: SecurityIncident): void {\n    if (this.disposed) return;\n    this.listeners.notify(incident);\n    try {\n      this.options.onIncident?.(incident);\n    } catch (callbackError) {\n      this.options.logError(\"Security incident callback failed\", callbackError);\n    }\n  }\n\n  private scheduleFlushRetry(): void {\n    if (this.disposed || this.retryTimeout) return;\n    const retryDelayMs = this.retryDelayMs;\n    this.retryDelayMs = Math.min(\n      this.retryDelayMs * 2,\n      SECURITY_INCIDENT_MAX_RETRY_DELAY_MS,\n    );\n    this.retryTimeout = setTimeout(() => {\n      this.retryTimeout = null;\n      if (this.disposed) return;\n      void this.flush();\n    }, retryDelayMs);\n  }\n\n  private resetFlushRetry(): void {\n    this.retryDelayMs = SECURITY_INCIDENT_RETRY_DELAY_MS;\n    if (!this.retryTimeout) return;\n    clearTimeout(this.retryTimeout);\n    this.retryTimeout = null;\n  }\n}\n\nexport function createSecurityIncidentService(\n  options: SecurityIncidentServiceOptions,\n): SecurityIncidentServiceResult {\n  const listeners = createListenerSet<[SecurityIncident]>();\n  const recordedErrors = new WeakMap<object, SecurityIncidentRecordingStatus>();\n  const incidentReports = new WeakMap<\n    object,\n    Promise<SecurityIncidentRecordingStatus>\n  >();\n  const sink = new SecurityIncidentSink(options, listeners);\n\n  const persistIncident = async (\n    error: unknown,\n    context: SecurityIncidentContext,\n  ): Promise<SecurityIncidentRecordingStatus> => {\n    const code = verificationCode(error);\n    if (!code) {\n      return \"failed\";\n    }\n    if (code === \"unrecognized_verification_code\") {\n      options.logError(\n        \"Security incident used the fallback code because its verification code is unrecognized\",\n      );\n    }\n\n    return sink.persist(code, context);\n  };\n\n  const record = async (\n    error: unknown,\n    context: SecurityIncidentContext,\n  ): Promise<SecurityIncidentRecordingStatus> => {\n    if (typeof error !== \"object\" || error === null) {\n      return \"failed\";\n    }\n    const recorded = recordedErrors.get(error);\n    if (recorded) return recorded;\n    const inFlight = incidentReports.get(error);\n    if (inFlight) return inFlight;\n    const pending = persistIncident(error, context)\n      .then((status) => {\n        if (status !== \"failed\") recordedErrors.set(error, status);\n        return status;\n      })\n      .finally(() => {\n        incidentReports.delete(error);\n      });\n    incidentReports.set(error, pending);\n    return pending;\n  };\n  const report: SecurityIncidentReporter = async (error, context) => {\n    await record(error, context);\n  };\n\n  return {\n    dispose: () => sink.dispose(),\n    incidents: {\n      async list() {\n        await sink.flush();\n        const execSql = options.database.execSql;\n        return options.database.status === \"ready\" && execSql\n          ? listSecurityIncidents(execSql, options.trustDomain)\n          : null;\n      },\n      record,\n      subscribe: listeners.subscribe,\n    },\n    report,\n  };\n}\n"]}

package/client/session/index.js

@@ -0,0 +1,340 @@
+import { removeNativeSubscriptionRestoreProvisioningAttempt } from "../../workflows/organizations/createOrganization.js";
+import { bootstrapRootContainer, registerIdentity as registerIdentityWorkflow, } from "../../workflows/registration/index.js";
+import { createListenerSet } from "../listenerSet.js";
+import { emptySessionSnapshot, mergeSessionContext, sessionSnapshotsEqual, } from "./sessionContext.js";
+import { registrationKeyAlreadyBound, requireRegistrationIdentityPinner, requireUserIdentityAvailable, SessionIdentityAcknowledgments, } from "./sessionIdentityTrust.js";
+import { userSessionsFromResponse } from "./sessionListing.js";
+import { refuseSessionLogin } from "./sessionLoginRefusal.js";
+import { createSessionOrganization } from "./sessionOrganizationCreation.js";
+import { clearSessionRemoteSyncState, recoverPurgedSessionOrganization, } from "./sessionPurgeRecovery.js";
+import { acknowledgedSessionRoot, commitSessionRootAcknowledgment, } from "./sessionRootAuthority.js";
+export function createSession(dependencies) {
+    return new SessionService(dependencies);
+}
+class SessionService {
+    dependencies;
+    identityAcknowledgments = new SessionIdentityAcknowledgments();
+    listeners = createListenerSet();
+    syncEnabledValue = true;
+    snapshotValue = emptySessionSnapshot();
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    get authToken() {
+        return this.snapshotValue.authToken;
+    }
+    get containerId() {
+        return this.snapshotValue.containerId;
+    }
+    get defaultOrganizationId() {
+        return this.snapshotValue.defaultOrganizationId;
+    }
+    get isAuthenticated() {
+        return this.snapshotValue.isAuthenticated;
+    }
+    get isRoot() {
+        return this.snapshotValue.isRoot;
+    }
+    get organizationId() {
+        return this.snapshotValue.organizationId;
+    }
+    get snapshot() {
+        return this.snapshotValue;
+    }
+    get syncEnabled() {
+        return this.syncEnabledValue;
+    }
+    get userId() {
+        return this.snapshotValue.userId;
+    }
+    get userIdAcknowledged() {
+        return this.identityAcknowledgments.isAcknowledged(this.snapshotValue.userId, this.dependencies.identity.snapshot.signingFingerprint);
+    }
+    async bootstrapLocalRootContainer() {
+        // Recovery can request local bootstrap after login. Preserve the root
+        // acknowledged by that session instead of replacing it with a local id.
+        const acknowledgedRoot = acknowledgedSessionRoot(this, this.dependencies.identity.snapshot.signingFingerprint);
+        if (this.isAuthenticated && acknowledgedRoot) {
+            return { containerId: acknowledgedRoot, created: false };
+        }
+        const result = await bootstrapRootContainer(this.dependencies.database.requireExecSql("bootstrapLocalRootContainer"));
+        this.setContainerId(result.containerId);
+        if (result.created) {
+            this.dependencies.log("Root container created");
+        }
+        return result;
+    }
+    async listSessions() {
+        return userSessionsFromResponse(await this.dependencies.api.listSessions());
+    }
+    async clearRemoteSyncState(organizationId) {
+        return clearSessionRemoteSyncState(this.dependencies, this, organizationId);
+    }
+    async destroySession(sessionId) {
+        const response = await this.dependencies.api.destroySession(sessionId);
+        return response?.message === "ok";
+    }
+    async login(challengeHex) {
+        const signingKeyPair = this.dependencies.identity.requireSigningKeyPair("login");
+        const fingerprint = (await this.dependencies.identity.refreshSigningFingerprint()) ?? null;
+        if (!fingerprint) {
+            return false;
+        }
+        // A refusal below clears the session it is evidence against; a session
+        // another login committed meanwhile is not that session and stays.
+        const snapshotAtStart = this.snapshotValue;
+        const identitySnapshot = this.dependencies.identity.snapshot;
+        const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;
+        if (!encapsulationKeyPair) {
+            return false;
+        }
+        if (identitySnapshot.signingKeyPair !== signingKeyPair) {
+            return false;
+        }
+        const pinLocalUserIdentity = requireUserIdentityAvailable(this.dependencies.onUserIdentityAvailable, "Login");
+        this.dependencies.log(challengeHex ? "Authenticating with challenge..." : "Authenticating...");
+        const authentication = challengeHex
+            ? await this.dependencies.api.authenticateWithChallenge(fingerprint, signingKeyPair.signingPrivateKey, challengeHex)
+            : await this.dependencies.api.authenticate(fingerprint, signingKeyPair.signingPrivateKey);
+        if (this.dependencies.identity.snapshot !== identitySnapshot) {
+            return false;
+        }
+        if (!authentication) {
+            this.logout();
+            this.dependencies.log("Authentication failed");
+            return false;
+        }
+        try {
+            this.identityAcknowledgments.assertMatches(authentication.userId, fingerprint);
+            await pinLocalUserIdentity(authentication.userId, {
+                encapsulationPublicKey: encapsulationKeyPair.publicKey,
+                signingKeyFingerprint: fingerprint,
+                signingPublicKey: signingKeyPair.signingPublicKey,
+            });
+            if (this.dependencies.identity.snapshot !== identitySnapshot)
+                return false;
+            this.identityAcknowledgments.remember(authentication.userId, fingerprint);
+        }
+        catch (error) {
+            return refuseSessionLogin(error, authentication.userId, {
+                clear: () => this.logout(),
+                report: this.dependencies.reportSecurityIncident,
+            });
+        }
+        // A changed root for this identity+org is refused before the token is
+        // usable. Decision and commit are one synchronous step against the live
+        // snapshot (no await in between); the refusal clears the prior session in
+        // that same step and then reports its own incident.
+        await commitSessionRootAcknowledgment({
+            context: {
+                authToken: authentication.token,
+                defaultOrganizationId: authentication.organizationId,
+                isAuthenticated: true,
+                isRoot: authentication.isRoot,
+                organizationId: authentication.organizationId,
+                userId: authentication.userId,
+            },
+            onRefused: () => {
+                if (this.snapshotValue === snapshotAtStart)
+                    this.logout();
+            },
+            reporter: this.dependencies.reportSecurityIncident,
+            root: authentication,
+            session: this,
+            signingFingerprint: fingerprint,
+        });
+        this.dependencies.log("Authentication successful");
+        return true;
+    }
+    logout() {
+        this.setContext({ authToken: null, isAuthenticated: false, isRoot: false });
+    }
+    async logoutRemote() {
+        const identitySnapshot = this.dependencies.identity.snapshot;
+        try {
+            if (!this.authToken) {
+                return true;
+            }
+            const response = await this.dependencies.api.logout();
+            return response?.message === "ok";
+        }
+        finally {
+            if (this.dependencies.identity.snapshot === identitySnapshot) {
+                this.logout();
+            }
+        }
+    }
+    async registerIdentity(options) {
+        const containerId = this.containerId;
+        if (!containerId) {
+            this.dependencies.log("Registration skipped: container id is unavailable");
+            return null;
+        }
+        const identitySnapshot = this.dependencies.identity.snapshot;
+        const signingKeyPair = identitySnapshot.signingKeyPair;
+        if (!signingKeyPair) {
+            this.dependencies.log("Registration skipped: signing key is unavailable");
+            return null;
+        }
+        const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;
+        if (!encapsulationKeyPair) {
+            this.dependencies.log("Registration skipped: encapsulation key is unavailable");
+            return null;
+        }
+        const dbClient = this.dependencies.database.client;
+        if (!dbClient) {
+            this.dependencies.log("Registration skipped: database client is unavailable");
+            return null;
+        }
+        const pinLocalUserIdentity = requireRegistrationIdentityPinner({
+            identity: this.dependencies.identity,
+            identitySnapshot,
+            onUserIdentityAvailable: this.dependencies.onUserIdentityAvailable,
+        });
+        const keyBound = await registrationKeyAlreadyBound(this.dependencies, identitySnapshot.signingFingerprint);
+        if (this.dependencies.identity.snapshot !== identitySnapshot)
+            return null;
+        if (keyBound)
+            return keyBound;
+        let response;
+        try {
+            response = await registerIdentityWorkflow({
+                apiClient: this.dependencies.api,
+                containerId,
+                dbClient,
+                documentProjectors: this.dependencies.documentProjectors,
+                encapsulationKeyPair,
+                isIdentityCurrent: () => this.dependencies.identity.snapshot === identitySnapshot,
+                log: this.dependencies.log,
+                logError: this.dependencies.logError,
+                organizationProfileName: options?.organizationProfileName,
+                pinLocalUserIdentity,
+                provisionedSystemContainers: this.dependencies.provisionedSystemContainers,
+                rosterProfileNickname: options?.rosterProfileNickname,
+                signingKeyFingerprint: identitySnapshot.signingFingerprint,
+                signingKeyPair,
+            });
+        }
+        catch (error) {
+            this.dependencies.logError("Identity registration failed", error);
+            throw error;
+        }
+        if (this.dependencies.identity.snapshot !== identitySnapshot) {
+            return null;
+        }
+        if (!response) {
+            this.dependencies.log("Registration failed");
+            return null;
+        }
+        // The workflow pinned `response.userId` once the server confirmed it,
+        // under the same currency check as above.
+        await commitSessionRootAcknowledgment({
+            context: {
+                containerId: response.rootContainerId,
+                defaultOrganizationId: response.organizationId,
+                organizationId: response.organizationId,
+                userId: response.userId,
+            },
+            reporter: this.dependencies.reportSecurityIncident,
+            root: response,
+            session: this,
+            signingFingerprint: identitySnapshot.signingFingerprint,
+        });
+        return {
+            challenge: response.challenge,
+            containerId: response.rootContainerId,
+            organizationId: response.organizationId,
+            userId: response.userId,
+        };
+    }
+    async createOrganization(options, replacesOrganizationId, nativeSubscriptionRestore) {
+        const identitySnapshot = this.dependencies.identity.snapshot;
+        const userId = this.userId;
+        const response = await createSessionOrganization(this.dependencies, {
+            nativeSubscriptionRestore,
+            options,
+            replacesOrganizationId,
+            userId,
+        });
+        if (!response ||
+            !userId ||
+            this.userId !== userId ||
+            this.dependencies.identity.snapshot !== identitySnapshot)
+            return null;
+        await commitSessionRootAcknowledgment({
+            reporter: this.dependencies.reportSecurityIncident,
+            root: {
+                userId,
+                organizationId: response.organizationId,
+                rootContainerId: response.containerId,
+            },
+            session: this,
+            signingFingerprint: identitySnapshot.signingFingerprint,
+        });
+        return response;
+    }
+    prepareNativeSubscriptionRestoreOrganization(options) {
+        return this.createOrganization(options, undefined, true);
+    }
+    async completeNativeSubscriptionRestoreOrganization(organizationId) {
+        const userId = this.userId;
+        const dbClient = this.dependencies.database.client;
+        const identitySnapshot = this.dependencies.identity.snapshot;
+        if (!userId || !dbClient)
+            return false;
+        return removeNativeSubscriptionRestoreProvisioningAttempt({
+            canCommit: () => this.userId === userId &&
+                this.dependencies.identity.snapshot === identitySnapshot,
+            dbClient,
+            organizationId,
+            userId,
+        });
+    }
+    async recoverPurgedOrganization(organizationId, options) {
+        return recoverPurgedSessionOrganization(this.dependencies, this, organizationId, options);
+    }
+    setAuthToken(authToken) {
+        this.setSnapshot({ ...this.snapshotValue, authToken });
+    }
+    setContainerId(containerId) {
+        this.setSnapshot({ ...this.snapshotValue, containerId });
+    }
+    setContext(context) {
+        const wasAcknowledged = this.userIdAcknowledged;
+        this.identityAcknowledgments.remember(context.userId, this.dependencies.identity.snapshot.signingFingerprint);
+        const previous = this.snapshotValue;
+        this.setSnapshot(mergeSessionContext(previous, context, this.dependencies.identity.snapshot.signingFingerprint));
+        // Acknowledging an already-held userId changes `userIdAcknowledged` without
+        // changing the snapshot; persistence subscribers must still observe it.
+        if (this.snapshotValue === previous &&
+            wasAcknowledged !== this.userIdAcknowledged) {
+            this.listeners.notify();
+        }
+    }
+    setOrganizationId(organizationId) {
+        this.setSnapshot({ ...this.snapshotValue, organizationId });
+    }
+    setSyncEnabled(enabled) {
+        if (this.syncEnabledValue === enabled) {
+            return;
+        }
+        this.syncEnabledValue = enabled;
+        this.listeners.notify();
+    }
+    setUserId(userId) {
+        this.setSnapshot(mergeSessionContext(this.snapshotValue, { userId }, this.dependencies.identity.snapshot.signingFingerprint));
+    }
+    subscribe = (listener) => this.listeners.subscribe(listener);
+    setSnapshot(next) {
+        const previous = this.snapshotValue;
+        if (previous.authToken !== next.authToken) {
+            this.dependencies.api.setAuthToken(next.authToken);
+        }
+        if (sessionSnapshotsEqual(previous, next)) {
+            return;
+        }
+        this.snapshotValue = next;
+        this.listeners.notify();
+    }
+}
+//# sourceMappingURL=index.js.map