@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/blobs/opfsBlobStore.js

@@ -0,0 +1,126 @@
+import { blobByteSourceInputLength, createBlobByteSource, readBlobByteSource, } from "../blobContracts.js";
+const OPFS_WRITE_CHUNK_SIZE = 5 * 1024 * 1024;
+class OpfsBlobStore {
+    namespace;
+    directoryPromise = null;
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    async deleteBytes(storageKey) {
+        const directory = await this.getDirectory();
+        try {
+            await directory.removeEntry(this.getFileName(storageKey));
+        }
+        catch (error) {
+            if (error instanceof DOMException && error.name === "NotFoundError") {
+                return;
+            }
+            throw error;
+        }
+    }
+    async readBytes(storageKey) {
+        const source = await this.openByteSource(storageKey);
+        return source ? readBlobByteSource(source) : null;
+    }
+    async openByteSource(storageKey) {
+        const directory = await this.getDirectory();
+        try {
+            const fileHandle = await directory.getFileHandle(this.getFileName(storageKey));
+            const file = await fileHandle.getFile();
+            return createBlobByteSource(file);
+        }
+        catch (error) {
+            if (error instanceof DOMException && error.name === "NotFoundError") {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async writeByteSource(storageKey, source) {
+        const sourceByteLength = blobByteSourceInputLength(source);
+        const directory = await this.getDirectory();
+        const fileHandle = await directory.getFileHandle(this.getFileName(storageKey), { create: true });
+        const writable = await fileHandle.createWritable();
+        try {
+            for (let offset = 0; offset < sourceByteLength;) {
+                const byteLength = Math.min(OPFS_WRITE_CHUNK_SIZE, sourceByteLength - offset);
+                const chunk = await source.read(offset, byteLength);
+                if (chunk.byteLength !== byteLength) {
+                    throw new Error("Blob byte source returned an incomplete read.");
+                }
+                await writable.write(chunk);
+                offset += byteLength;
+            }
+            await writable.close();
+        }
+        catch (error) {
+            await writable.abort(error).catch(() => undefined);
+            throw error;
+        }
+    }
+    async writeBytes(storageKey, bytes) {
+        await this.writeByteSource(storageKey, createBlobByteSource(bytes));
+    }
+    getFileName(storageKey) {
+        return `${encodeURIComponent(storageKey)}.blob`;
+    }
+    async getDirectory() {
+        if (!this.directoryPromise) {
+            this.directoryPromise = this.createDirectory().catch((error) => {
+                this.directoryPromise = null;
+                throw error;
+            });
+        }
+        return this.directoryPromise;
+    }
+    async createDirectory() {
+        const rootDirectory = await navigator.storage.getDirectory();
+        const appDirectory = await rootDirectory.getDirectoryHandle("tearleads", {
+            create: true,
+        });
+        return appDirectory.getDirectoryHandle(this.namespace, { create: true });
+    }
+}
+function hasStorageDirectory(storage) {
+    return (storage !== undefined &&
+        "getDirectory" in storage &&
+        typeof storage.getDirectory === "function");
+}
+export function isOpfsBlobStoreSupported() {
+    return (typeof navigator === "object" && hasStorageDirectory(navigator.storage));
+}
+export function createOpfsBlobStore(namespace) {
+    return new OpfsBlobStore(namespace);
+}
+/**
+ * Permanently remove the OPFS directory backing a namespace's blob store
+ * (`tearleads/<namespace>`), discarding every stored blob for that namespace.
+ * Used to forget local data on logout. No-op when OPFS is unavailable or the
+ * directory was never created; never throws on a missing directory.
+ */
+export async function purgeOpfsBlobStore(namespace) {
+    if (!isOpfsBlobStoreSupported()) {
+        return;
+    }
+    const rootDirectory = await navigator.storage.getDirectory();
+    let appDirectory;
+    try {
+        appDirectory = await rootDirectory.getDirectoryHandle("tearleads");
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === "NotFoundError") {
+            return;
+        }
+        throw error;
+    }
+    try {
+        await appDirectory.removeEntry(namespace, { recursive: true });
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === "NotFoundError") {
+            return;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=opfsBlobStore.js.map

package/data/blobs/opfsBlobStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opfsBlobStore.js","sourceRoot":"","sources":["opfsBlobStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,aAAa;IAGY;IAFrB,gBAAgB,GAA8C,IAAI,CAAC;IAE3E,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,CAC9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAC7B,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,MAAsB;QAC9D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,CAC9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAC5B,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;QAEnD,IAAI,CAAC;YACH,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAI,CAAC;gBACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,qBAAqB,EACrB,gBAAgB,GAAG,MAAM,CAC1B,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACpD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM,IAAI,UAAU,CAAC;YACvB,CAAC;YACD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,KAAgB;QACnD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACtE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,WAAW,EAAE;YACvE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,OAAmC;IAEnC,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,cAAc,IAAI,OAAO;QACzB,OAAO,OAAO,CAAC,YAAY,KAAK,UAAU,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ,IAAI,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7D,IAAI,YAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  type BlobByteSource,\n  type BlobBytes,\n  type BlobStore,\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  readBlobByteSource,\n} from \"../blobContracts\";\n\ninterface StorageDirectoryProvider {\n  getDirectory: () => Promise<FileSystemDirectoryHandle>;\n}\n\nconst OPFS_WRITE_CHUNK_SIZE = 5 * 1024 * 1024;\n\nclass OpfsBlobStore implements BlobStore {\n  private directoryPromise: Promise<FileSystemDirectoryHandle> | null = null;\n\n  constructor(private readonly namespace: string) {}\n\n  async deleteBytes(storageKey: string) {\n    const directory = await this.getDirectory();\n\n    try {\n      await directory.removeEntry(this.getFileName(storageKey));\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"NotFoundError\") {\n        return;\n      }\n\n      throw error;\n    }\n  }\n\n  async readBytes(storageKey: string) {\n    const source = await this.openByteSource(storageKey);\n    return source ? readBlobByteSource(source) : null;\n  }\n\n  async openByteSource(storageKey: string) {\n    const directory = await this.getDirectory();\n\n    try {\n      const fileHandle = await directory.getFileHandle(\n        this.getFileName(storageKey),\n      );\n      const file = await fileHandle.getFile();\n      return createBlobByteSource(file);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"NotFoundError\") {\n        return null;\n      }\n\n      throw error;\n    }\n  }\n\n  async writeByteSource(storageKey: string, source: BlobByteSource) {\n    const sourceByteLength = blobByteSourceInputLength(source);\n    const directory = await this.getDirectory();\n    const fileHandle = await directory.getFileHandle(\n      this.getFileName(storageKey),\n      { create: true },\n    );\n    const writable = await fileHandle.createWritable();\n\n    try {\n      for (let offset = 0; offset < sourceByteLength; ) {\n        const byteLength = Math.min(\n          OPFS_WRITE_CHUNK_SIZE,\n          sourceByteLength - offset,\n        );\n        const chunk = await source.read(offset, byteLength);\n        if (chunk.byteLength !== byteLength) {\n          throw new Error(\"Blob byte source returned an incomplete read.\");\n        }\n        await writable.write(chunk);\n        offset += byteLength;\n      }\n      await writable.close();\n    } catch (error) {\n      await writable.abort(error).catch(() => undefined);\n      throw error;\n    }\n  }\n\n  async writeBytes(storageKey: string, bytes: BlobBytes) {\n    await this.writeByteSource(storageKey, createBlobByteSource(bytes));\n  }\n\n  private getFileName(storageKey: string): string {\n    return `${encodeURIComponent(storageKey)}.blob`;\n  }\n\n  private async getDirectory() {\n    if (!this.directoryPromise) {\n      this.directoryPromise = this.createDirectory().catch((error: unknown) => {\n        this.directoryPromise = null;\n        throw error;\n      });\n    }\n\n    return this.directoryPromise;\n  }\n\n  private async createDirectory() {\n    const rootDirectory = await navigator.storage.getDirectory();\n    const appDirectory = await rootDirectory.getDirectoryHandle(\"tearleads\", {\n      create: true,\n    });\n\n    return appDirectory.getDirectoryHandle(this.namespace, { create: true });\n  }\n}\n\nfunction hasStorageDirectory(\n  storage: StorageManager | undefined,\n): storage is StorageManager & StorageDirectoryProvider {\n  return (\n    storage !== undefined &&\n    \"getDirectory\" in storage &&\n    typeof storage.getDirectory === \"function\"\n  );\n}\n\nexport function isOpfsBlobStoreSupported(): boolean {\n  return (\n    typeof navigator === \"object\" && hasStorageDirectory(navigator.storage)\n  );\n}\n\nexport function createOpfsBlobStore(namespace: string): BlobStore {\n  return new OpfsBlobStore(namespace);\n}\n\n/**\n * Permanently remove the OPFS directory backing a namespace's blob store\n * (`tearleads/<namespace>`), discarding every stored blob for that namespace.\n * Used to forget local data on logout. No-op when OPFS is unavailable or the\n * directory was never created; never throws on a missing directory.\n */\nexport async function purgeOpfsBlobStore(namespace: string): Promise<void> {\n  if (!isOpfsBlobStoreSupported()) {\n    return;\n  }\n\n  const rootDirectory = await navigator.storage.getDirectory();\n  let appDirectory: FileSystemDirectoryHandle;\n  try {\n    appDirectory = await rootDirectory.getDirectoryHandle(\"tearleads\");\n  } catch (error) {\n    if (error instanceof DOMException && error.name === \"NotFoundError\") {\n      return;\n    }\n    throw error;\n  }\n\n  try {\n    await appDirectory.removeEntry(namespace, { recursive: true });\n  } catch (error) {\n    if (error instanceof DOMException && error.name === \"NotFoundError\") {\n      return;\n    }\n    throw error;\n  }\n}\n"]}

package/data/containers/containerBinding.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The identity this device holds for a folder: its organization and the
+ * metadata document its signed `container.create` names. Both are immutable in
+ * every signed successor. Purged-organization recovery may reuse a container
+ * id. Its owner follows their own signed create; a re-shared member additionally
+ * requires replacement authorization from the original organization's pinned
+ * founder. Other changes of organization or metadata target are refused. An
+ * empty organization (a pre-login local folder) or a null metadata document (a
+ * folder not yet created remotely) is not yet bound and accepts its first
+ * binding.
+ */
+export interface HeldContainerBinding {
+    readonly organizationId: string;
+    readonly metadataDocumentId: string | null;
+    /**
+     * A live, bound ordinary folder: its binding came from a verified signed
+     * manifest or this device's own signed create, so a listing that repeats it
+     * needs no second proof. Greenfield contract: rows written by earlier
+     * clients, which trusted listing ids, are unsupported; environments reset.
+     */
+    readonly ordinary?: true | undefined;
+}
+export declare function heldContainerBinding(input: {
+    readonly container: {
+        readonly organizationId: string;
+        readonly metadataDocumentId: string | null;
+        readonly parentId: string | null;
+        readonly systemSlot?: string | null | undefined;
+    };
+    readonly record: {
+        readonly documentId: string | null;
+    } | null;
+}): HeldContainerBinding;
+/** Whether a verified binding moves a held folder to another organization or target. */
+export declare function rebindsHeldContainer(held: HeldContainerBinding | null, verified: {
+    readonly metadataDocumentId: string;
+    readonly organizationId: string;
+}): boolean;
+/** Whether a listing repeats a held ordinary binding exactly. */
+export declare function listingRepeatsHeldOrdinaryBinding(held: HeldContainerBinding | null, listed: {
+    readonly metadataDocumentId: string;
+    readonly organizationId: string;
+    readonly parentId: string | null;
+    readonly systemSlot?: string | null | undefined;
+}): boolean;
+/**
+ * Refuse a listing, response or persisted mutation that would move a held
+ * folder into another organization or retarget its metadata document. The
+ * refusal leaves the held row, its private content and its pending updates in
+ * place.
+ */
+export declare function assertHeldContainerBinding(held: HeldContainerBinding | null, incoming: {
+    readonly organizationId: string;
+    readonly metadataDocumentIds?: ReadonlyArray<string | null> | undefined;
+}): void;

package/data/containers/containerBinding.js

@@ -0,0 +1,51 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+export function heldContainerBinding(input) {
+    const { container } = input;
+    const metadataDocumentId = container.metadataDocumentId ?? input.record?.documentId ?? null;
+    const ordinary = container.organizationId !== "" &&
+        metadataDocumentId !== null &&
+        container.parentId !== null &&
+        (container.systemSlot ?? null) === null;
+    return {
+        organizationId: container.organizationId,
+        metadataDocumentId,
+        ...(ordinary ? { ordinary: true } : {}),
+    };
+}
+/** Whether a verified binding moves a held folder to another organization or target. */
+export function rebindsHeldContainer(held, verified) {
+    if (!held)
+        return false;
+    return ((held.organizationId !== "" &&
+        held.organizationId !== verified.organizationId) ||
+        (held.metadataDocumentId !== null &&
+            held.metadataDocumentId !== verified.metadataDocumentId));
+}
+/** Whether a listing repeats a held ordinary binding exactly. */
+export function listingRepeatsHeldOrdinaryBinding(held, listed) {
+    return (held?.ordinary === true &&
+        held.organizationId === listed.organizationId &&
+        held.metadataDocumentId === listed.metadataDocumentId &&
+        listed.parentId !== null &&
+        (listed.systemSlot ?? null) === null);
+}
+/**
+ * Refuse a listing, response or persisted mutation that would move a held
+ * folder into another organization or retarget its metadata document. The
+ * refusal leaves the held row, its private content and its pending updates in
+ * place.
+ */
+export function assertHeldContainerBinding(held, incoming) {
+    if (!held)
+        return;
+    if (held.organizationId !== "" &&
+        incoming.organizationId !== held.organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "container organization conflicts with its held binding");
+    }
+    const heldDocumentId = held.metadataDocumentId;
+    if (heldDocumentId !== null &&
+        incoming.metadataDocumentIds?.some((documentId) => documentId !== heldDocumentId)) {
+        throw new KeyingVerificationError("object_mismatch", "container metadata document conflicts with its held binding");
+    }
+}
+//# sourceMappingURL=containerBinding.js.map

package/data/containers/containerBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerBinding.js","sourceRoot":"","sources":["containerBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAyB5D,MAAM,UAAU,oBAAoB,CAAC,KAQpC;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,kBAAkB,GACtB,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;IACnE,MAAM,QAAQ,GACZ,SAAS,CAAC,cAAc,KAAK,EAAE;QAC/B,kBAAkB,KAAK,IAAI;QAC3B,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;IAC1C,OAAO;QACL,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,kBAAkB;QAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAClC,IAAiC,EACjC,QAGC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,IAAI,CAAC,cAAc,KAAK,EAAE;QACzB,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC;QAClD,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI;YAC/B,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iCAAiC,CAC/C,IAAiC,EACjC,MAKC;IAED,OAAO,CACL,IAAI,EAAE,QAAQ,KAAK,IAAI;QACvB,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QACrD,MAAM,CAAC,QAAQ,KAAK,IAAI;QACxB,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI,CACrC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAiC,EACjC,QAGC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IACE,IAAI,CAAC,cAAc,KAAK,EAAE;QAC1B,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAC/C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC/C,IACE,cAAc,KAAK,IAAI;QACvB,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAChC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,cAAc,CAC9C,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\n\n/**\n * The identity this device holds for a folder: its organization and the\n * metadata document its signed `container.create` names. Both are immutable in\n * every signed successor. Purged-organization recovery may reuse a container\n * id. Its owner follows their own signed create; a re-shared member additionally\n * requires replacement authorization from the original organization's pinned\n * founder. Other changes of organization or metadata target are refused. An\n * empty organization (a pre-login local folder) or a null metadata document (a\n * folder not yet created remotely) is not yet bound and accepts its first\n * binding.\n */\nexport interface HeldContainerBinding {\n  readonly organizationId: string;\n  readonly metadataDocumentId: string | null;\n  /**\n   * A live, bound ordinary folder: its binding came from a verified signed\n   * manifest or this device's own signed create, so a listing that repeats it\n   * needs no second proof. Greenfield contract: rows written by earlier\n   * clients, which trusted listing ids, are unsupported; environments reset.\n   */\n  readonly ordinary?: true | undefined;\n}\n\nexport function heldContainerBinding(input: {\n  readonly container: {\n    readonly organizationId: string;\n    readonly metadataDocumentId: string | null;\n    readonly parentId: string | null;\n    readonly systemSlot?: string | null | undefined;\n  };\n  readonly record: { readonly documentId: string | null } | null;\n}): HeldContainerBinding {\n  const { container } = input;\n  const metadataDocumentId =\n    container.metadataDocumentId ?? input.record?.documentId ?? null;\n  const ordinary =\n    container.organizationId !== \"\" &&\n    metadataDocumentId !== null &&\n    container.parentId !== null &&\n    (container.systemSlot ?? null) === null;\n  return {\n    organizationId: container.organizationId,\n    metadataDocumentId,\n    ...(ordinary ? { ordinary: true as const } : {}),\n  };\n}\n\n/** Whether a verified binding moves a held folder to another organization or target. */\nexport function rebindsHeldContainer(\n  held: HeldContainerBinding | null,\n  verified: {\n    readonly metadataDocumentId: string;\n    readonly organizationId: string;\n  },\n): boolean {\n  if (!held) return false;\n  return (\n    (held.organizationId !== \"\" &&\n      held.organizationId !== verified.organizationId) ||\n    (held.metadataDocumentId !== null &&\n      held.metadataDocumentId !== verified.metadataDocumentId)\n  );\n}\n\n/** Whether a listing repeats a held ordinary binding exactly. */\nexport function listingRepeatsHeldOrdinaryBinding(\n  held: HeldContainerBinding | null,\n  listed: {\n    readonly metadataDocumentId: string;\n    readonly organizationId: string;\n    readonly parentId: string | null;\n    readonly systemSlot?: string | null | undefined;\n  },\n): boolean {\n  return (\n    held?.ordinary === true &&\n    held.organizationId === listed.organizationId &&\n    held.metadataDocumentId === listed.metadataDocumentId &&\n    listed.parentId !== null &&\n    (listed.systemSlot ?? null) === null\n  );\n}\n\n/**\n * Refuse a listing, response or persisted mutation that would move a held\n * folder into another organization or retarget its metadata document. The\n * refusal leaves the held row, its private content and its pending updates in\n * place.\n */\nexport function assertHeldContainerBinding(\n  held: HeldContainerBinding | null,\n  incoming: {\n    readonly organizationId: string;\n    readonly metadataDocumentIds?: ReadonlyArray<string | null> | undefined;\n  },\n): void {\n  if (!held) return;\n  if (\n    held.organizationId !== \"\" &&\n    incoming.organizationId !== held.organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container organization conflicts with its held binding\",\n    );\n  }\n  const heldDocumentId = held.metadataDocumentId;\n  if (\n    heldDocumentId !== null &&\n    incoming.metadataDocumentIds?.some(\n      (documentId) => documentId !== heldDocumentId,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"container metadata document conflicts with its held binding\",\n    );\n  }\n}\n"]}

package/data/containers/containerMetadataDocument.d.ts

@@ -0,0 +1,15 @@
+import { createDocument } from "../../internal/loro/index.js";
+interface ContainerMetadataValue {
+    icon: string | null;
+    name: string;
+}
+export type ContainerMetadataDocument = Awaited<ReturnType<typeof createDocument>>;
+export declare function getDefaultContainerName(parentId: string | null): string;
+export declare function createContainerMetadataDocument(_containerId: string): Promise<ContainerMetadataDocument>;
+export declare function createInitializedContainerMetadataDocument(containerId: string, value: ContainerMetadataValue): Promise<{
+    doc: ContainerMetadataDocument;
+    initialUpdate: Uint8Array;
+}>;
+export declare function readContainerMetadataValue(doc: ContainerMetadataDocument, defaultName: string): ContainerMetadataValue;
+export declare function writeContainerMetadataValue(doc: ContainerMetadataDocument, value: ContainerMetadataValue): void;
+export {};

package/data/containers/containerMetadataDocument.js

@@ -0,0 +1,43 @@
+import { createDocument, exportAllUpdates } from "../../internal/loro/index.js";
+import { getScopedPeerSeed } from "../crdtPeerSeed.js";
+export function getDefaultContainerName(parentId) {
+    return parentId === null ? "/" : "Untitled";
+}
+export async function createContainerMetadataDocument(_containerId) {
+    // A single static scope for all container-metadata docs: they are separate
+    // CRDTs, so they can share one device peer, and a per-container scope would
+    // hold a distinct device-peer lock (and cache entry) per container for the
+    // tab's lifetime, accumulating without bound as containers are browsed.
+    return createDocument(await getScopedPeerSeed("container-metadata"));
+}
+export async function createInitializedContainerMetadataDocument(containerId, value) {
+    const doc = await createContainerMetadataDocument(containerId);
+    writeContainerMetadataValue(doc, value);
+    return {
+        doc,
+        initialUpdate: exportAllUpdates(doc),
+    };
+}
+export function readContainerMetadataValue(doc, defaultName) {
+    const metadata = doc.getMap("container");
+    const storedName = metadata.get("name");
+    const storedIcon = metadata.get("icon");
+    return {
+        icon: typeof storedIcon === "string" && storedIcon.length > 0
+            ? storedIcon
+            : null,
+        name: typeof storedName === "string" && storedName.trim().length > 0
+            ? storedName
+            : defaultName,
+    };
+}
+export function writeContainerMetadataValue(doc, value) {
+    const metadata = doc.getMap("container");
+    metadata.set("name", value.name);
+    if (value.icon) {
+        metadata.set("icon", value.icon);
+        return;
+    }
+    metadata.delete("icon");
+}
+//# sourceMappingURL=containerMetadataDocument.js.map

package/data/containers/containerMetadataDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerMetadataDocument.js","sourceRoot":"","sources":["containerMetadataDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAWpD,MAAM,UAAU,uBAAuB,CAAC,QAAuB;IAC7D,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,YAAoB;IAEpB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,cAAc,CAAC,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,WAAmB,EACnB,KAA6B;IAK7B,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,CAAC;IAC/D,2BAA2B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,GAAG;QACH,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAA8B,EAC9B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,IAAI,EACF,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI;QACV,IAAI,EACF,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC5D,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAA8B,EAC9B,KAA6B;IAE7B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import { createDocument, exportAllUpdates } from \"@tearleads/loro\";\nimport { getScopedPeerSeed } from \"../crdtPeerSeed\";\n\ninterface ContainerMetadataValue {\n  icon: string | null;\n  name: string;\n}\n\nexport type ContainerMetadataDocument = Awaited<\n  ReturnType<typeof createDocument>\n>;\n\nexport function getDefaultContainerName(parentId: string | null): string {\n  return parentId === null ? \"/\" : \"Untitled\";\n}\n\nexport async function createContainerMetadataDocument(\n  _containerId: string,\n): Promise<ContainerMetadataDocument> {\n  // A single static scope for all container-metadata docs: they are separate\n  // CRDTs, so they can share one device peer, and a per-container scope would\n  // hold a distinct device-peer lock (and cache entry) per container for the\n  // tab's lifetime, accumulating without bound as containers are browsed.\n  return createDocument(await getScopedPeerSeed(\"container-metadata\"));\n}\n\nexport async function createInitializedContainerMetadataDocument(\n  containerId: string,\n  value: ContainerMetadataValue,\n): Promise<{\n  doc: ContainerMetadataDocument;\n  initialUpdate: Uint8Array;\n}> {\n  const doc = await createContainerMetadataDocument(containerId);\n  writeContainerMetadataValue(doc, value);\n\n  return {\n    doc,\n    initialUpdate: exportAllUpdates(doc),\n  };\n}\n\nexport function readContainerMetadataValue(\n  doc: ContainerMetadataDocument,\n  defaultName: string,\n): ContainerMetadataValue {\n  const metadata = doc.getMap(\"container\");\n  const storedName = metadata.get(\"name\");\n  const storedIcon = metadata.get(\"icon\");\n\n  return {\n    icon:\n      typeof storedIcon === \"string\" && storedIcon.length > 0\n        ? storedIcon\n        : null,\n    name:\n      typeof storedName === \"string\" && storedName.trim().length > 0\n        ? storedName\n        : defaultName,\n  };\n}\n\nexport function writeContainerMetadataValue(\n  doc: ContainerMetadataDocument,\n  value: ContainerMetadataValue,\n): void {\n  const metadata = doc.getMap(\"container\");\n\n  metadata.set(\"name\", value.name);\n\n  if (value.icon) {\n    metadata.set(\"icon\", value.icon);\n    return;\n  }\n\n  metadata.delete(\"icon\");\n}\n"]}

package/data/containers/shared/authorAccess.d.ts

@@ -0,0 +1,15 @@
+import { type AnyVerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor } from "./types.js";
+export declare class ContainerAuthorAccessError extends Error {
+    readonly code = "unauthorized";
+    readonly status = 403;
+    constructor(message: string);
+}
+/** Call after verifying the path; readable keys alone do not authorize signing. */
+export declare function assertContainerAuthorAccess(input: {
+    author: ContainerMutationAuthor;
+    minimumAccess: "write" | "admin";
+    principalPolicies: readonly AnyVerifiedPrincipalPolicy[];
+    projection: ContainerWriterProjectionResponse;
+}): void;

package/data/containers/shared/authorAccess.js

@@ -0,0 +1,25 @@
+import { KeyingVerificationError, resolveContainerStatePathUserAccessLevel, } from "../../../internal/crypto/index.js";
+import { readContainerState } from "./projection.js";
+export class ContainerAuthorAccessError extends Error {
+    code = "unauthorized";
+    status = 403;
+    constructor(message) {
+        super(message);
+        this.name = "ContainerAuthorAccessError";
+    }
+}
+/** Call after verifying the path; readable keys alone do not authorize signing. */
+export function assertContainerAuthorAccess(input) {
+    const states = input.projection.path.map(readContainerState);
+    if (states.some((state) => state.organizationId !== input.author.organizationId))
+        throw new KeyingVerificationError("object_mismatch", "Container author organization differs from the verified path");
+    const access = resolveContainerStatePathUserAccessLevel({
+        states,
+        principalPolicies: input.principalPolicies,
+        userId: input.author.signerUserId,
+    });
+    if (access !== "admin" &&
+        !(input.minimumAccess === "write" && access === "write"))
+        throw new ContainerAuthorAccessError(`Container signer lacks ${input.minimumAccess} access on the verified path`);
+}
+//# sourceMappingURL=authorAccess.js.map

package/data/containers/shared/authorAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorAccess.js","sourceRoot":"","sources":["authorAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,EACvB,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC;IAEtB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,KAK3C;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IACE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAE5E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,MAAM,MAAM,GAAG,wCAAwC,CAAC;QACtD,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IACE,MAAM,KAAK,OAAO;QAClB,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC;QAExD,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,KAAK,CAAC,aAAa,8BAA8B,CAC5E,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readContainerState } from \"./projection\";\nimport type { ContainerMutationAuthor } from \"./types\";\n\nexport class ContainerAuthorAccessError extends Error {\n  readonly code = \"unauthorized\";\n  readonly status = 403;\n\n  constructor(message: string) {\n    super(message);\n    this.name = \"ContainerAuthorAccessError\";\n  }\n}\n\n/** Call after verifying the path; readable keys alone do not authorize signing. */\nexport function assertContainerAuthorAccess(input: {\n  author: ContainerMutationAuthor;\n  minimumAccess: \"write\" | \"admin\";\n  principalPolicies: readonly AnyVerifiedPrincipalPolicy[];\n  projection: ContainerWriterProjectionResponse;\n}): void {\n  const states = input.projection.path.map(readContainerState);\n  if (\n    states.some((state) => state.organizationId !== input.author.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Container author organization differs from the verified path\",\n    );\n  const access = resolveContainerStatePathUserAccessLevel({\n    states,\n    principalPolicies: input.principalPolicies,\n    userId: input.author.signerUserId,\n  });\n  if (\n    access !== \"admin\" &&\n    !(input.minimumAccess === \"write\" && access === \"write\")\n  )\n    throw new ContainerAuthorAccessError(\n      `Container signer lacks ${input.minimumAccess} access on the verified path`,\n    );\n}\n"]}

package/data/containers/shared/containerPathLimits.d.ts

@@ -0,0 +1,14 @@
+export declare const CONTAINER_PATH_TOO_DEEP_MESSAGE = "Container path exceeds maximum depth";
+/**
+ * A create or move would leave a path longer than readers accept. The same
+ * request never succeeds: a queued move is abandoned, and a queued create
+ * waits for a local move to re-arm it.
+ */
+export declare class ContainerPathTooDeepError extends Error {
+    readonly code: "container_path_too_deep";
+    constructor();
+}
+/** Refuse a container path of more than `MAX_CONTAINER_PATH_LENGTH` entries. */
+export declare function assertContainerPathLengthFits(pathLength: number): void;
+/** The API also checks descendants that this client may not be able to see. */
+export declare function assertContainerChildPathFits(parentPath: readonly unknown[]): void;

package/data/containers/shared/containerPathLimits.js

@@ -0,0 +1,25 @@
+import { CONTAINER_MUTATION_ERROR_CODES } from "../../../internal/validators/response/index.js";
+import { MAX_CONTAINER_PATH_LENGTH } from "../../../internal/validators/util/index.js";
+export const CONTAINER_PATH_TOO_DEEP_MESSAGE = "Container path exceeds maximum depth";
+/**
+ * A create or move would leave a path longer than readers accept. The same
+ * request never succeeds: a queued move is abandoned, and a queued create
+ * waits for a local move to re-arm it.
+ */
+export class ContainerPathTooDeepError extends Error {
+    code = CONTAINER_MUTATION_ERROR_CODES.pathTooDeep;
+    constructor() {
+        super(CONTAINER_PATH_TOO_DEEP_MESSAGE);
+        this.name = "ContainerPathTooDeepError";
+    }
+}
+/** Refuse a container path of more than `MAX_CONTAINER_PATH_LENGTH` entries. */
+export function assertContainerPathLengthFits(pathLength) {
+    if (pathLength > MAX_CONTAINER_PATH_LENGTH)
+        throw new ContainerPathTooDeepError();
+}
+/** The API also checks descendants that this client may not be able to see. */
+export function assertContainerChildPathFits(parentPath) {
+    assertContainerPathLengthFits(parentPath.length + 1);
+}
+//# sourceMappingURL=containerPathLimits.js.map

package/data/containers/shared/containerPathLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerPathLimits.js","sourceRoot":"","sources":["containerPathLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,sCAAsC,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,8BAA8B,CAAC,WAAW,CAAC;IAE3D;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,UAAU,GAAG,yBAAyB;QACxC,MAAM,IAAI,yBAAyB,EAAE,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B,CAC1C,UAA8B;IAE9B,6BAA6B,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { CONTAINER_MUTATION_ERROR_CODES } from \"@tearleads/validators/response\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\n\nexport const CONTAINER_PATH_TOO_DEEP_MESSAGE =\n  \"Container path exceeds maximum depth\";\n\n/**\n * A create or move would leave a path longer than readers accept. The same\n * request never succeeds: a queued move is abandoned, and a queued create\n * waits for a local move to re-arm it.\n */\nexport class ContainerPathTooDeepError extends Error {\n  readonly code = CONTAINER_MUTATION_ERROR_CODES.pathTooDeep;\n\n  constructor() {\n    super(CONTAINER_PATH_TOO_DEEP_MESSAGE);\n    this.name = \"ContainerPathTooDeepError\";\n  }\n}\n\n/** Refuse a container path of more than `MAX_CONTAINER_PATH_LENGTH` entries. */\nexport function assertContainerPathLengthFits(pathLength: number): void {\n  if (pathLength > MAX_CONTAINER_PATH_LENGTH)\n    throw new ContainerPathTooDeepError();\n}\n\n/** The API also checks descendants that this client may not be able to see. */\nexport function assertContainerChildPathFits(\n  parentPath: readonly unknown[],\n): void {\n  assertContainerPathLengthFits(parentPath.length + 1);\n}\n"]}

package/data/containers/shared/events.js

@@ -0,0 +1,123 @@
+import { computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeContainerKekMaterialId, deriveContainerAccessManifest, signAccessEvent, } from "../../../internal/crypto/index.js";
+import { readCanonicalJson } from "../../keyingCanonicalJson.js";
+import { uniqueSortedManifestHashes } from "./projection.js";
+export function buildContainerCreateBody(input) {
+    return {
+        systemSlot: input.systemSlot ?? null,
+        eventType: "container.create",
+        parentContainerId: input.parentContainerId,
+        parentManifestHash: input.parentManifestHash,
+        metadataDocumentId: input.metadataDocumentId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+        directGrants: [],
+        referencedPrincipalHeads: [],
+    };
+}
+export async function signContainerCreateEvent(input) {
+    const bodyHash = await computeAccessEventBodyHash(readCanonicalJson(input.body, "Container create body"));
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId,
+        eventType: "container.create",
+        objectKind: "container",
+        objectId: input.containerId,
+        organizationId: input.organizationId,
+        previousManifestHash: null,
+        dependencyManifestHashes: uniqueSortedManifestHashes(input.parentPath),
+        bodyHash,
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt,
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    return {
+        event,
+        eventHash: await computeAccessEventHash(event),
+    };
+}
+export async function signContainerMutationEvent(input) {
+    const bodyHash = await computeAccessEventBodyHash(readCanonicalJson(input.body, "Container mutation body"));
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId,
+        eventType: input.body.eventType,
+        objectKind: "container",
+        objectId: input.containerId,
+        organizationId: input.author.organizationId,
+        previousManifestHash: input.previousManifestHash,
+        dependencyManifestHashes: [
+            ...new Set(input.dependencyManifestHashes),
+        ].sort(),
+        bodyHash,
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt,
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    return {
+        event,
+        eventHash: await computeAccessEventHash(event),
+    };
+}
+export async function deriveContainerCreateManifest(input) {
+    const state = {
+        systemSlot: input.systemSlot ?? null,
+        version: 1,
+        containerId: input.containerId,
+        organizationId: input.organizationId,
+        epoch: 1,
+        previousManifestHash: null,
+        eventHash: input.eventHash,
+        parentContainerId: input.parentContainerId,
+        parentManifestHash: input.parentManifestHash,
+        metadataDocumentId: input.metadataDocumentId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+        directGrants: input.directGrants ? [...input.directGrants] : [],
+        referencedPrincipalHeads: input.referencedPrincipalHeads
+            ? [...input.referencedPrincipalHeads]
+            : [],
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    return {
+        manifest,
+        manifestHash: await computeAccessManifestHash(manifest),
+        state,
+    };
+}
+export function buildContainerCreateKeyEpoch(input) {
+    return {
+        id: input.containerKeyEpochId,
+        containerId: input.containerId,
+        keyEpoch: input.keyEpoch ?? 1,
+        accessManifestHash: input.manifestHash,
+        parentContainerKeyEpochId: input.parentContainerKeyEpochId,
+        createdByEventHash: input.eventHash,
+        createdByManifestHash: input.manifestHash,
+    };
+}
+export function buildParentRecipientTargets(parentKek) {
+    return [
+        {
+            recipientKind: "container",
+            recipientId: parentKek.containerId,
+            recipientKeyEpochId: parentKek.containerKeyEpochId,
+            recipientKeyFingerprint: parentKek.keyEpochHash,
+        },
+    ];
+}
+export async function resolveContainerKekEpochId(input) {
+    const materialId = await computeContainerKekMaterialId({
+        containerId: input.containerId,
+        keyEpoch: input.keyEpoch,
+        keyMaterial: input.keyMaterial,
+    });
+    if (input.override !== undefined && input.override !== materialId) {
+        throw new Error("Container key epoch id does not match the committed KEK material");
+    }
+    return materialId;
+}
+//# sourceMappingURL=events.js.map

package/data/containers/shared/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["events.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAS1D,MAAM,UAAU,wBAAwB,CAAC,KAOxC;IACC,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,SAAS,EAAE,kBAAkB;QAC7B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAa9C;IACC,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CACvD,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,kBAAkB;QAC7B,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;QACtE,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,MAAM,sBAAsB,CAAC,KAAK,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAahD;IAMC,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CACzD,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC/B,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE;YACxB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC;SAC3C,CAAC,IAAI,EAAE;QACR,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,MAAM,sBAAsB,CAAC,KAAK,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAqBnD;IACC,MAAM,KAAK,GAAiC;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACtD,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;YACrC,CAAC,CAAC,EAAE;KACP,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,mBAAmB;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC7B,kBAAkB,EAAE,KAAK,CAAC,YAAY;QACtC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,kBAAkB,EAAE,KAAK,CAAC,SAAS;QACnC,qBAAqB,EAAE,KAAK,CAAC,YAAY;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAA+B;IAE/B,OAAO;QACL;YACE,aAAa,EAAE,WAAW;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,uBAAuB,EAAE,SAAS,CAAC,YAAY;SAChD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  type ContainerCreateAccessEventBody,\n  type ContainerGrantAccessEventBody,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerMoveAccessEventBody,\n  type ContainerReciteAccessEventBody,\n  type ContainerRekeyAccessEventBody,\n  type ContainerRevokeAccessEventBody,\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeContainerKekMaterialId,\n  deriveContainerAccessManifest,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { readCanonicalJson } from \"../../keyingCanonicalJson\";\nimport { uniqueSortedManifestHashes } from \"./projection\";\nimport type {\n  ContainerCreatePlan,\n  ContainerMovePlan,\n  ContainerMutationAuthor,\n  ContainerRevokePlan,\n  ContainerSharePlan,\n} from \"./types\";\n\nexport function buildContainerCreateBody(input: {\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string;\n  metadataDocumentId: string;\n  systemSlot?: string | null | undefined;\n  parentContainerId: string | null;\n  parentManifestHash: string | null;\n}): ContainerCreateAccessEventBody {\n  return {\n    systemSlot: input.systemSlot ?? null,\n    eventType: \"container.create\",\n    parentContainerId: input.parentContainerId,\n    parentManifestHash: input.parentManifestHash,\n    metadataDocumentId: input.metadataDocumentId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    directGrants: [],\n    referencedPrincipalHeads: [],\n  };\n}\n\nexport async function signContainerCreateEvent(input: {\n  author: ContainerMutationAuthor;\n  body: ContainerCreateAccessEventBody;\n  containerId: string;\n  eventId: string;\n  // The organization the new container belongs to — always the parent\n  // container's org, NOT the author's. A member writing under another org's\n  // shared root creates a container owned by that org; only the signer identity\n  // comes from the author. The server trusts this signed field, so it is the\n  // load-bearing org for the create.\n  organizationId: string;\n  parentPath: ContainerWriterProjectionResponse[\"path\"];\n  signedAt: string;\n}): Promise<Pick<ContainerCreatePlan, \"event\" | \"eventHash\">> {\n  const bodyHash = await computeAccessEventBodyHash(\n    readCanonicalJson(input.body, \"Container create body\"),\n  );\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId,\n    eventType: \"container.create\",\n    objectKind: \"container\",\n    objectId: input.containerId,\n    organizationId: input.organizationId,\n    previousManifestHash: null,\n    dependencyManifestHashes: uniqueSortedManifestHashes(input.parentPath),\n    bodyHash,\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt,\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    event,\n    eventHash: await computeAccessEventHash(event),\n  };\n}\n\nexport async function signContainerMutationEvent(input: {\n  author: ContainerMutationAuthor;\n  body:\n    | ContainerGrantAccessEventBody\n    | ContainerMoveAccessEventBody\n    | ContainerRekeyAccessEventBody\n    | ContainerReciteAccessEventBody\n    | ContainerRevokeAccessEventBody;\n  containerId: string;\n  dependencyManifestHashes: readonly string[];\n  eventId: string;\n  previousManifestHash: string;\n  signedAt: string;\n}): Promise<\n  Pick<\n    ContainerSharePlan | ContainerMovePlan | ContainerRevokePlan,\n    \"event\" | \"eventHash\"\n  >\n> {\n  const bodyHash = await computeAccessEventBodyHash(\n    readCanonicalJson(input.body, \"Container mutation body\"),\n  );\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId,\n    eventType: input.body.eventType,\n    objectKind: \"container\",\n    objectId: input.containerId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.previousManifestHash,\n    dependencyManifestHashes: [\n      ...new Set(input.dependencyManifestHashes),\n    ].sort(),\n    bodyHash,\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt,\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    event,\n    eventHash: await computeAccessEventHash(event),\n  };\n}\n\nexport async function deriveContainerCreateManifest(input: {\n  containerId: string;\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string;\n  // Grants baked into the create manifest. Defaults to none. A child container\n  // born with a managed-principal (group/organization) grant — e.g. the org\n  // public metadata container granted to the Members group — supplies both the\n  // grant and its referenced principal head here so the manifest hash reconciles\n  // with the signed event body and the server can derive the KEK recipient target.\n  directGrants?: ContainerCreateAccessEventBody[\"directGrants\"] | undefined;\n  eventHash: string;\n  metadataDocumentId: string;\n  systemSlot?: string | null | undefined;\n  // The parent container's org (see signContainerCreateEvent). Must match the\n  // signed event's org or the manifest hash will not reconcile server-side.\n  organizationId: string;\n  parentContainerId: string | null;\n  parentManifestHash: string | null;\n  referencedPrincipalHeads?:\n    | ContainerCreateAccessEventBody[\"referencedPrincipalHeads\"]\n    | undefined;\n}): Promise<Pick<ContainerCreatePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const state: ContainerAccessManifestState = {\n    systemSlot: input.systemSlot ?? null,\n    version: 1,\n    containerId: input.containerId,\n    organizationId: input.organizationId,\n    epoch: 1,\n    previousManifestHash: null,\n    eventHash: input.eventHash,\n    parentContainerId: input.parentContainerId,\n    parentManifestHash: input.parentManifestHash,\n    metadataDocumentId: input.metadataDocumentId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    directGrants: input.directGrants ? [...input.directGrants] : [],\n    referencedPrincipalHeads: input.referencedPrincipalHeads\n      ? [...input.referencedPrincipalHeads]\n      : [],\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nexport function buildContainerCreateKeyEpoch(input: {\n  containerId: string;\n  containerKeyEpochId: string;\n  eventHash: string;\n  /** Defaults to the creation epoch; rotations pass their next epoch. */\n  keyEpoch?: number | undefined;\n  manifestHash: string;\n  parentContainerKeyEpochId: string | null;\n}): ContainerKeyEpoch {\n  return {\n    id: input.containerKeyEpochId,\n    containerId: input.containerId,\n    keyEpoch: input.keyEpoch ?? 1,\n    accessManifestHash: input.manifestHash,\n    parentContainerKeyEpochId: input.parentContainerKeyEpochId,\n    createdByEventHash: input.eventHash,\n    createdByManifestHash: input.manifestHash,\n  };\n}\n\nexport function buildParentRecipientTargets(\n  parentKek: ContainerKekResponse,\n): ContainerKekRecipientTarget[] {\n  return [\n    {\n      recipientKind: \"container\",\n      recipientId: parentKek.containerId,\n      recipientKeyEpochId: parentKek.containerKeyEpochId,\n      recipientKeyFingerprint: parentKek.keyEpochHash,\n    },\n  ];\n}\n\nexport async function resolveContainerKekEpochId(input: {\n  containerId: string;\n  keyEpoch: number;\n  keyMaterial: Uint8Array;\n  override?: string | undefined;\n}): Promise<string> {\n  const materialId = await computeContainerKekMaterialId({\n    containerId: input.containerId,\n    keyEpoch: input.keyEpoch,\n    keyMaterial: input.keyMaterial,\n  });\n  if (input.override !== undefined && input.override !== materialId) {\n    throw new Error(\n      \"Container key epoch id does not match the committed KEK material\",\n    );\n  }\n\n  return materialId;\n}\n"]}