@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/documents/shared/documentSyncUpdateDecryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncUpdateDecryption.js","sourceRoot":"","sources":["documentSyncUpdateDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,qCAAqC,EACrC,8BAA8B,GAE/B,MAAM,SAAS,CAAC;AAIjB,SAAS,4BAA4B,CACnC,aAAqB;IAErB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,oBAAoB,CAClB,KAAK,EACL,8BAA8B,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,2BAA2B,CAAC;QAC9D,qCAAqC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CACvC,KAAK,EACL,SAAS,EACT,2BAA2B,CAC5B,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,yBAAyB,CACtE,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,2BAA2B,CAAC;QACvE,+BAA+B,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CACtB,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAC3D,CAAC;IACF,cAAc,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;IAC9D,OAAO;QACL,UAAU,EAAE,aAAa,CACvB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,2BAA2B,CAAC,CACnE;QACD,eAAe,EAAE,yBAAyB,CACxC,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,YAAY,EAAE,gBAAgB,CAC5B,KAAK,EACL,cAAc,EACd,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,EAAE;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAOzD;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,qBAAqB,GACzB,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,qBAAqB,KAAK,SAAS;QAC1C,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC;IAC3C,IACE,qBAAqB;QACrB,CAAC,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC1C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB;YACxD,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,mBAAmB,CAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,uBAAuB,CAC/B,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,SAAS,CAAC,eAAe;QACzB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,YAAY,KAAK,YAAY;QACvC,SAAS,CAAC,YAAY;YACpB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IACE,SAAS,CAAC,eAAe,KAAK,eAAe;QAC7C,SAAS,CAAC,eAAe;YACvB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,0CAA0C,CAAC;YAC/C,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,MAA0B;IAE1B,IAAI,eAAuB,CAAC;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,MAAM;YACtB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,2BAA2B,CAAC;QAChC,eAAe;QACf,UAAU;QACV,cAAc;QACd,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAO7B;IACC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;YAChD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,8BAA8B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACjE,8BAA8B,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,cAAc,EAAE,gCAAgC,CAAC;gBAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;gBAC1C,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAC7C,CACF,CAAC;QACF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iCAAiC,CACrC,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import {\n  assertAesGcmIv,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport { versionVectorsEqual } from \"@tearleads/loro\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { contentRecordAdditionalDataBytes } from \"./contentRecordAdditionalData\";\nimport {\n  deriveDocumentContentRecordKey,\n  deriveDocumentPlaintextHashKey,\n} from \"./contentRecordKeys\";\nimport { isolateDocumentSyncUpdateError } from \"./documentSyncUpdateIsolation\";\nimport { assertDecryptedDocumentUpdateMetadata } from \"./documentUpdateIntegrity\";\nimport { assertDocumentUpdatePlaintextHash } from \"./plaintextHash\";\nimport {\n  assertOnlyRecordKeys,\n  asWebCryptoBytes,\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n} from \"./readers\";\nimport {\n  type DecryptedDocumentSyncUpdate,\n  DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n  DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n  type ParsedDocumentEncryptedUpdate,\n} from \"./types\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\n\nfunction parseDocumentEncryptedUpdate(\n  encryptedData: string,\n): ParsedDocumentEncryptedUpdate {\n  let value: unknown;\n  try {\n    value = JSON.parse(encryptedData);\n  } catch {\n    throw new Error(\"Document encrypted update is invalid JSON\");\n  }\n  if (!isPlainRecord(value)) {\n    throw new Error(\"Document encrypted update must be an object\");\n  }\n  assertOnlyRecordKeys(\n    value,\n    DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n    \"Document encrypted update\",\n  );\n  if (\n    readRecordString(value, \"format\", \"Document encrypted update\") !==\n    DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT\n  ) {\n    throw new Error(\"Document encrypted update format is invalid\");\n  }\n  const version = readRecordPositiveInteger(\n    value,\n    \"version\",\n    \"Document encrypted update\",\n  );\n  if (version !== 1) {\n    throw new Error(\n      `Document encrypted update version ${version} is invalid; expected 1`,\n    );\n  }\n  if (\n    readRecordString(value, \"encryptionSuite\", \"Document encrypted update\") !==\n    CONTENT_RECORD_ENCRYPTION_SUITE\n  ) {\n    throw new Error(\"Document encrypted update suite is invalid\");\n  }\n\n  const iv = base64ToBytes(\n    readRecordString(value, \"iv\", \"Document encrypted update\"),\n  );\n  assertAesGcmIv(iv, \"Document encrypted update IV is invalid\");\n  return {\n    ciphertext: base64ToBytes(\n      readRecordString(value, \"ciphertext\", \"Document encrypted update\"),\n    ),\n    contentKeyEpoch: readRecordPositiveInteger(\n      value,\n      \"contentKeyEpoch\",\n      \"Document encrypted update\",\n    ),\n    contentRecordId: readRecordString(\n      value,\n      \"contentRecordId\",\n      \"Document encrypted update\",\n    ),\n    metadataHash: readRecordString(\n      value,\n      \"metadataHash\",\n      \"Document encrypted update\",\n    ),\n    nonceDomainHash: readRecordString(\n      value,\n      \"nonceDomainHash\",\n      \"Document encrypted update\",\n    ),\n    iv,\n  };\n}\n\nasync function assertDocumentEncryptedUpdateMatchesHeader(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  encryptedData: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<void> {\n  const { encrypted, update } = input;\n  const hasCheckpointMetadata =\n    update.checkpointKind !== undefined ||\n    update.checkpointPayloadKind !== undefined ||\n    update.sourceVersionVector !== undefined;\n  if (\n    hasCheckpointMetadata &&\n    (update.checkpointKind !== \"rotate_baseline\" ||\n      update.checkpointPayloadKind !== \"full_history_snapshot\" ||\n      !update.sourceVersionVector ||\n      !versionVectorsEqual(\n        update.sourceVersionVector,\n        update.partialEndVersionVector,\n      ))\n  ) {\n    throw new Error(\"Document rotation checkpoint metadata mismatch\");\n  }\n  if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {\n    throw new Error(\"Document encrypted update content-key epoch mismatch\");\n  }\n  if (update.documentId !== input.documentId) {\n    throw new Error(\"Document encrypted update document id mismatch\");\n  }\n  if (\n    encrypted.contentRecordId !==\n    readRecordString(update.writeHeader, \"contentRecordId\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update content record mismatch\");\n  }\n\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: input.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    encrypted.metadataHash !== metadataHash ||\n    encrypted.metadataHash !==\n      readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update metadata hash mismatch\");\n  }\n\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (\n    encrypted.nonceDomainHash !== nonceDomainHash ||\n    encrypted.nonceDomainHash !==\n      readRecordString(update.writeHeader, \"nonceDomainHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update nonce domain mismatch\");\n  }\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    input.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update ciphertext hash mismatch\");\n  }\n}\n\nasync function verifiedEncryptedSyncUpdate(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<ParsedDocumentEncryptedUpdate> {\n  try {\n    const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);\n    await assertDocumentEncryptedUpdateMatchesHeader({\n      encrypted,\n      encryptedData: input.update.encryptedData,\n      ...input,\n    });\n    return encrypted;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"encrypted_record\",\n      updateId: input.update.id,\n    });\n  }\n}\n\n/** Verifies the encrypted record's structure and every binding to its header. */\nexport async function assertDocumentSyncUpdateEncryptedRecord(\n  update: SyncResponseUpdate,\n): Promise<void> {\n  let contentKeyEpoch: number;\n  let documentId: string;\n  let organizationId: string;\n  try {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (header.objectKind !== \"document\") {\n      throw new Error(\"Document sync response write header kind mismatch\");\n    }\n    contentKeyEpoch = header.contentKeyEpoch;\n    documentId = header.objectId;\n    organizationId = header.organizationId;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: update,\n      stage: \"write_header\",\n      updateId: update.id,\n    });\n  }\n  await verifiedEncryptedSyncUpdate({\n    contentKeyEpoch,\n    documentId,\n    organizationId,\n    update,\n  });\n}\n\nasync function decryptPayload(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<{ plaintextHashKey: CryptoKey; updateData: Uint8Array }> {\n  try {\n    const keyInput = {\n      contentKeyMaterial: input.contentKeyMaterial,\n      contentKeyEpoch: input.contentKeyEpoch,\n      contentRecordId: input.encrypted.contentRecordId,\n      documentId: input.documentId,\n      organizationId: input.organizationId,\n    };\n    const [recordKey, plaintextHashKey] = await Promise.all([\n      deriveDocumentContentRecordKey({ ...keyInput, usage: \"decrypt\" }),\n      deriveDocumentPlaintextHashKey(keyInput),\n    ]);\n    const updateData = new Uint8Array(\n      await crypto.subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: asWebCryptoBytes(input.encrypted.iv),\n          additionalData: contentRecordAdditionalDataBytes({\n            contentKeyEpoch: input.contentKeyEpoch,\n            contentRecordId: input.encrypted.contentRecordId,\n            documentId: input.documentId,\n            metadataHash: input.encrypted.metadataHash,\n            nonceDomainHash: input.encrypted.nonceDomainHash,\n            organizationId: input.organizationId,\n          }),\n        },\n        recordKey,\n        asWebCryptoBytes(input.encrypted.ciphertext),\n      ),\n    );\n    return { plaintextHashKey, updateData };\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"decrypt\",\n      updateId: input.update.id,\n    });\n  }\n}\n\nexport async function decryptDocumentSyncUpdate(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<DecryptedDocumentSyncUpdate> {\n  const encrypted = await verifiedEncryptedSyncUpdate(input);\n  const { plaintextHashKey, updateData } = await decryptPayload({\n    ...input,\n    encrypted,\n  });\n  try {\n    await assertDocumentUpdatePlaintextHash(\n      updateData,\n      input.update.plaintextHash,\n      plaintextHashKey,\n    );\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"plaintext_integrity\",\n      updateId: input.update.id,\n    });\n  }\n  try {\n    assertDecryptedDocumentUpdateMetadata(updateData, input.update);\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"loro_metadata\",\n      updateId: input.update.id,\n    });\n  }\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    updateData,\n  };\n}\n"]}

package/data/documents/shared/documentSyncUpdateIsolation.d.ts

@@ -0,0 +1,55 @@
+import { createDocument } from "../../../internal/loro/index.js";
+import type { DocumentSyncResponse } from "../../../internal/validators/response/index.js";
+import type { DecryptedDocumentSyncUpdate, SyncRemoteDocumentResult } from "./types.js";
+type DocumentSyncUpdateIsolationStage = "content_key" | "decrypt" | "encrypted_record" | "loro_import" | "loro_metadata" | "plaintext_integrity" | "write_header";
+type SyncResponseUpdate = DocumentSyncResponse["updates"][number];
+type SyncDocument = Awaited<ReturnType<typeof createDocument>>;
+export type IncomingDocumentSyncUpdateValidator = (result: Pick<SyncRemoteDocumentResult, "decryptedUpdates" | "response">) => void | Promise<void>;
+export declare class DocumentSyncUpdateIsolationError extends Error {
+    readonly attribution: "batch" | "update";
+    readonly authorFingerprint: string | null;
+    readonly batchUpdateIds: readonly string[];
+    readonly checkpointKind: "rotate_baseline" | null;
+    readonly ciphertextHash: string | null;
+    readonly contentKeyEpoch: number | null;
+    readonly documentId: string | null;
+    readonly metadataHash: string | null;
+    readonly stage: DocumentSyncUpdateIsolationStage;
+    readonly updateId: string | null;
+    readonly writerUserId: string | null;
+    constructor(input: {
+        batchUpdateIds?: readonly string[] | undefined;
+        cause: unknown;
+        responseUpdate?: SyncResponseUpdate | undefined;
+        stage: DocumentSyncUpdateIsolationStage;
+        updateId: string | null;
+    });
+}
+export declare function isolateDocumentSyncBatchError(input: {
+    cause: unknown;
+    stage: DocumentSyncUpdateIsolationStage;
+    updateIds: readonly string[];
+}): DocumentSyncUpdateIsolationError;
+export declare function isolateDocumentSyncUpdateError(input: {
+    cause: unknown;
+    responseUpdate?: SyncResponseUpdate | undefined;
+    stage: DocumentSyncUpdateIsolationStage;
+    updateId: string;
+}): DocumentSyncUpdateIsolationError;
+export declare function isDocumentSyncUpdateIsolationError(error: unknown): error is DocumentSyncUpdateIsolationError;
+/** Applies checkpoints with the snapshot API before batching ordinary deltas. */
+export declare function importDecryptedDocumentSyncUpdates(document: SyncDocument, updates: readonly DecryptedDocumentSyncUpdate[]): void;
+/** @internal Exported only to exercise the bounded exact-attribution policy. */
+export declare function findUniqueRepairingCandidate<T>(candidates: readonly T[], repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>): Promise<T | null>;
+/**
+ * Proves that a decrypted response can be imported before the live document or
+ * any durable sync frontier is mutated. On failure, retries the page without
+ * each candidate so valid sibling dependencies remain in the same batch while
+ * the update whose removal repairs the batch is attributed exactly.
+ */
+export declare function validateDocumentSyncUpdateImports(input: {
+    currentDocument: Awaited<ReturnType<typeof createDocument>>;
+    decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];
+    responseUpdates?: readonly SyncResponseUpdate[] | undefined;
+}): Promise<void>;
+export {};

package/data/documents/shared/documentSyncUpdateIsolation.js

@@ -0,0 +1,298 @@
+import { createDocument, exportFullHistorySnapshot, importSnapshot, importUpdates, LoroImportUnresolvedDependenciesError, updateMatchesDocumentHistory, } from "../../../internal/loro/index.js";
+const MAX_EXACT_ISOLATION_CANDIDATES = 8;
+const MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function optionalHeaderField(update, field) {
+    const header = update?.writeHeader;
+    return header && typeof header === "object"
+        ? Reflect.get(header, field)
+        : undefined;
+}
+function optionalHeaderString(update, field) {
+    const value = optionalHeaderField(update, field);
+    return typeof value === "string" ? value : null;
+}
+function optionalHeaderEpoch(update) {
+    const value = optionalHeaderField(update, "contentKeyEpoch");
+    return typeof value === "number" && Number.isSafeInteger(value)
+        ? value
+        : null;
+}
+export class DocumentSyncUpdateIsolationError extends Error {
+    attribution;
+    authorFingerprint;
+    batchUpdateIds;
+    checkpointKind;
+    ciphertextHash;
+    contentKeyEpoch;
+    documentId;
+    metadataHash;
+    stage;
+    updateId;
+    writerUserId;
+    constructor(input) {
+        const causeMessage = errorMessage(input.cause);
+        const writerUserId = optionalHeaderString(input.responseUpdate, "writerUserId");
+        const author = writerUserId ?? input.responseUpdate?.authorFingerprint ?? "unknown";
+        const fingerprint = input.responseUpdate?.authorFingerprint ?? "unknown";
+        const epoch = optionalHeaderEpoch(input.responseUpdate) ?? "unknown";
+        const batchUpdateIds = input.updateId === null ? (input.batchUpdateIds ?? []) : [];
+        const subject = input.updateId === null
+            ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`
+            : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;
+        super(`Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`, { cause: input.cause });
+        this.name = "DocumentSyncUpdateIsolationError";
+        this.attribution = input.updateId === null ? "batch" : "update";
+        this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;
+        this.batchUpdateIds = [...batchUpdateIds];
+        this.checkpointKind =
+            input.responseUpdate?.checkpointKind === "rotate_baseline"
+                ? "rotate_baseline"
+                : null;
+        this.ciphertextHash = optionalHeaderString(input.responseUpdate, "ciphertextHash");
+        this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);
+        this.documentId = input.responseUpdate?.documentId ?? null;
+        this.metadataHash = optionalHeaderString(input.responseUpdate, "metadataHash");
+        this.stage = input.stage;
+        this.updateId = input.updateId;
+        this.writerUserId = writerUserId;
+    }
+}
+export function isolateDocumentSyncBatchError(input) {
+    return new DocumentSyncUpdateIsolationError({
+        batchUpdateIds: input.updateIds,
+        cause: input.cause,
+        stage: input.stage,
+        updateId: null,
+    });
+}
+export function isolateDocumentSyncUpdateError(input) {
+    return input.cause instanceof DocumentSyncUpdateIsolationError
+        ? input.cause
+        : new DocumentSyncUpdateIsolationError(input);
+}
+export function isDocumentSyncUpdateIsolationError(error) {
+    return error instanceof DocumentSyncUpdateIsolationError;
+}
+function responseUpdatesById(updates) {
+    return new Map((updates ?? []).map((update) => [update.id, update]));
+}
+function firstDuplicateUpdateId(updates) {
+    const seen = new Set();
+    for (const update of updates) {
+        if (seen.has(update.id))
+            return update.id;
+        seen.add(update.id);
+    }
+    return null;
+}
+function assertImportedUpdatesMatchValidatedHistory(input) {
+    const collisions = input.updates.filter((update) => !updateMatchesDocumentHistory(input.document, update.updateData));
+    if (collisions.length === 0)
+        return;
+    const cause = new Error("incoming Loro update reuses an already-covered frontier with different operations");
+    const [collision] = collisions;
+    if (input.updates.length === 1 && collision) {
+        throw isolateDocumentSyncUpdateError({
+            cause,
+            responseUpdate: input.responseById.get(collision.id),
+            stage: "loro_import",
+            updateId: collision.id,
+        });
+    }
+    throw isolateDocumentSyncBatchError({
+        cause,
+        stage: "loro_import",
+        updateIds: input.updates.map((update) => update.id),
+    });
+}
+async function createValidationDocument(snapshot) {
+    const document = await createDocument(crypto.randomUUID());
+    try {
+        importSnapshot(document, snapshot);
+        return document;
+    }
+    catch (error) {
+        document.free();
+        throw error;
+    }
+}
+function splitDocumentSyncUpdates(updates) {
+    const checkpoints = [];
+    const ordinaryUpdates = [];
+    for (const update of updates) {
+        if (update.checkpointKind === "rotate_baseline" &&
+            update.checkpointPayloadKind === "full_history_snapshot") {
+            checkpoints.push(update);
+        }
+        else {
+            ordinaryUpdates.push(update);
+        }
+    }
+    return { checkpoints, ordinaryUpdates };
+}
+/** Applies checkpoints with the snapshot API before batching ordinary deltas. */
+export function importDecryptedDocumentSyncUpdates(document, updates) {
+    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);
+    for (const checkpoint of checkpoints) {
+        importSnapshot(document, checkpoint.updateData);
+    }
+    if (ordinaryUpdates.length > 0) {
+        importUpdates(document, ordinaryUpdates.map((update) => update.updateData));
+    }
+}
+async function validateDecryptedUpdateBatch(input) {
+    const document = await createValidationDocument(input.currentSnapshot);
+    try {
+        const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(input.updates);
+        for (const checkpoint of checkpoints) {
+            importSnapshot(document, checkpoint.updateData);
+        }
+        if (ordinaryUpdates.length > 0) {
+            importUpdates(document, ordinaryUpdates.map((update) => update.updateData));
+        }
+        if (input.responseById) {
+            // Validate against the completed scratch history, not only the live
+            // pre-page frontier. If two updates in this page reuse one peer/counter
+            // with different operations, Loro accepts one and treats the other as a
+            // no-op; only the accepted history can match both when they are equal.
+            assertImportedUpdatesMatchValidatedHistory({
+                document,
+                responseById: input.responseById,
+                updates: input.updates,
+            });
+        }
+    }
+    finally {
+        document.free();
+    }
+}
+function exactIsolationRetryExceedsBudget(input) {
+    if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES)
+        return true;
+    let retryBytes = 0;
+    for (const candidateIndex of input.candidates.keys()) {
+        if (input.currentSnapshot.byteLength >
+            MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes) {
+            return true;
+        }
+        retryBytes += input.currentSnapshot.byteLength;
+        for (const [updateIndex, update] of input.candidates.entries()) {
+            if (updateIndex === candidateIndex)
+                continue;
+            if (update.updateData.byteLength >
+                MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes) {
+                return true;
+            }
+            retryBytes += update.updateData.byteLength;
+        }
+    }
+    return false;
+}
+/** @internal Exported only to exercise the bounded exact-attribution policy. */
+export async function findUniqueRepairingCandidate(candidates, repairsBatch) {
+    let repairingCandidate = null;
+    let repairingCandidateCount = 0;
+    for (const [candidateIndex, candidate] of candidates.entries()) {
+        if (await repairsBatch(candidate, candidateIndex)) {
+            repairingCandidate = candidate;
+            repairingCandidateCount += 1;
+        }
+    }
+    return repairingCandidateCount === 1 ? repairingCandidate : null;
+}
+/**
+ * Proves that a decrypted response can be imported before the live document or
+ * any durable sync frontier is mutated. On failure, retries the page without
+ * each candidate so valid sibling dependencies remain in the same batch while
+ * the update whose removal repairs the batch is attributed exactly.
+ */
+export async function validateDocumentSyncUpdateImports(input) {
+    if (input.decryptedUpdates.length === 0)
+        return;
+    const duplicateUpdateId = firstDuplicateUpdateId(input.decryptedUpdates) ??
+        firstDuplicateUpdateId(input.responseUpdates ?? []);
+    if (duplicateUpdateId !== null) {
+        throw isolateDocumentSyncBatchError({
+            cause: new Error(`Document sync response update id is duplicated: ${duplicateUpdateId}`),
+            stage: "encrypted_record",
+            updateIds: (input.responseUpdates ?? input.decryptedUpdates).map((update) => update.id),
+        });
+    }
+    const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);
+    const responseById = responseUpdatesById(input.responseUpdates);
+    let batchError;
+    try {
+        await validateDecryptedUpdateBatch({
+            currentSnapshot,
+            responseById,
+            updates: input.decryptedUpdates,
+        });
+        return;
+    }
+    catch (error) {
+        if (isDocumentSyncUpdateIsolationError(error))
+            throw error;
+        batchError = error;
+    }
+    // A delta can be valid but depend on a parent omitted from this response
+    // page. Removing that delta would make an empty retry succeed and falsely
+    // identify its authenticated writer as poison, so dependency gaps remain
+    // anonymous at batch scope.
+    if (batchError instanceof LoroImportUnresolvedDependenciesError) {
+        throw isolateDocumentSyncBatchError({
+            cause: batchError,
+            stage: "loro_import",
+            updateIds: input.decryptedUpdates.map((update) => update.id),
+        });
+    }
+    if (exactIsolationRetryExceedsBudget({
+        candidates: input.decryptedUpdates,
+        currentSnapshot,
+    })) {
+        throw isolateDocumentSyncBatchError({
+            cause: batchError,
+            stage: "loro_import",
+            updateIds: input.decryptedUpdates.map((update) => update.id),
+        });
+    }
+    // Rebuild from the same immutable snapshot for every candidate: a failed
+    // import may partially mutate its scratch document. Checkpoints participate
+    // alongside ordinary updates so an incompatibility between the two kinds
+    // cannot falsely blame the ordinary writer. Keeping every other update in
+    // one batch also preserves out-of-order sibling dependencies.
+    const isolatedUpdate = await findUniqueRepairingCandidate(input.decryptedUpdates, async (_update, candidateIndex) => {
+        const withoutCandidate = input.decryptedUpdates.filter((_, updateIndex) => updateIndex !== candidateIndex);
+        try {
+            await validateDecryptedUpdateBatch({
+                currentSnapshot,
+                updates: withoutCandidate,
+            });
+            return true;
+        }
+        catch {
+            // This candidate is either valid and required by a sibling, or another
+            // poison update remains. Continue without attributing it.
+            return false;
+        }
+    });
+    if (isolatedUpdate) {
+        throw isolateDocumentSyncUpdateError({
+            cause: batchError,
+            responseUpdate: responseById.get(isolatedUpdate.id),
+            stage: "loro_import",
+            updateId: isolatedUpdate.id,
+        });
+    }
+    // Multiple bad updates or a batch-level incompatibility may have zero or
+    // multiple removals that repair the page. Fail closed without falsely naming
+    // a valid writer; no live or durable state has changed.
+    throw isolateDocumentSyncBatchError({
+        cause: batchError,
+        stage: "loro_import",
+        updateIds: input.decryptedUpdates.map((update) => update.id),
+    });
+}
+//# sourceMappingURL=documentSyncUpdateIsolation.js.map

package/data/documents/shared/documentSyncUpdateIsolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncUpdateIsolation.js","sourceRoot":"","sources":["documentSyncUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAMxD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsC,EACtC,KAAa;IAEb,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC;IAEtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,WAAW,CAAqB;IAChC,iBAAiB,CAAgB;IACjC,cAAc,CAAoB;IAClC,cAAc,CAA2B;IACzC,cAAc,CAAgB;IAC9B,eAAe,CAAgB;IAC/B,UAAU,CAAgB;IAC1B,YAAY,CAAgB;IAC5B,KAAK,CAAmC;IACxC,QAAQ,CAAgB;IACxB,YAAY,CAAgB;IAErC,YAAY,KAMX;QACC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,oBAAoB,CACvC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,MAAM,MAAM,GACV,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,6BAA6B,cAAc,CAAC,MAAM,2CAA2C;YAC/F,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,gBAAgB,MAAM,iBAAiB,WAAW,WAAW,KAAK,GAAG,CAAC;QACpG,KAAK,CACH,6BAA6B,OAAO,WAAW,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc;YACjB,KAAK,CAAC,cAAc,EAAE,cAAc,KAAK,iBAAiB;gBACxD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc,GAAG,oBAAoB,CACxC,KAAK,CAAC,cAAc,EACpB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,oBAAoB,CACtC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,IAAI,gCAAgC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,OAAO,KAAK,CAAC,KAAK,YAAY,gCAAgC;QAC5D,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,OAAO,KAAK,YAAY,gCAAgC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkD;IAElD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CACnE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mFAAmF,CACpF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,8BAA8B,CAAC;YACnC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA+C;IAK/C,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC3C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB,EACxD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAAsB,EACtB,OAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAC/D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,0CAA0C,CAAC;gBACzC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,IACE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChC,+BAA+B,GAAG,UAAU,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,WAAW,KAAK,cAAc;gBAAE,SAAS;YAC7C,IACE,MAAM,CAAC,UAAU,CAAC,UAAU;gBAC5B,+BAA+B,GAAG,UAAU,EAC5C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwB,EACxB,YAAwE;IAExE,IAAI,kBAAkB,GAAa,IAAI,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;YAClD,kBAAkB,GAAG,SAAS,CAAC;YAC/B,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhD,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C,sBAAsB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CACd,mDAAmD,iBAAiB,EAAE,CACvE;YACD,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,eAAe;YACf,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,gBAAgB;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kCAAkC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,UAAU,YAAY,qCAAqC,EAAE,CAAC;QAChE,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IACE,gCAAgC,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,eAAe;KAChB,CAAC,EACF,CAAC;QACD,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,KAAK,CAAC,gBAAgB,EACtB,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc,CACnD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,4BAA4B,CAAC;gBACjC,eAAe;gBACf,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,cAAc,CAAC,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createDocument,\n  exportFullHistorySnapshot,\n  importSnapshot,\n  importUpdates,\n  LoroImportUnresolvedDependenciesError,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type {\n  DecryptedDocumentSyncUpdate,\n  SyncRemoteDocumentResult,\n} from \"./types\";\n\ntype DocumentSyncUpdateIsolationStage =\n  | \"content_key\"\n  | \"decrypt\"\n  | \"encrypted_record\"\n  | \"loro_import\"\n  | \"loro_metadata\"\n  | \"plaintext_integrity\"\n  | \"write_header\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype SyncDocument = Awaited<ReturnType<typeof createDocument>>;\n\nconst MAX_EXACT_ISOLATION_CANDIDATES = 8;\nconst MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;\n\nexport type IncomingDocumentSyncUpdateValidator = (\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n) => void | Promise<void>;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction optionalHeaderField(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): unknown {\n  const header = update?.writeHeader;\n  return header && typeof header === \"object\"\n    ? Reflect.get(header, field)\n    : undefined;\n}\n\nfunction optionalHeaderString(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): string | null {\n  const value = optionalHeaderField(update, field);\n  return typeof value === \"string\" ? value : null;\n}\n\nfunction optionalHeaderEpoch(\n  update: SyncResponseUpdate | undefined,\n): number | null {\n  const value = optionalHeaderField(update, \"contentKeyEpoch\");\n  return typeof value === \"number\" && Number.isSafeInteger(value)\n    ? value\n    : null;\n}\n\nexport class DocumentSyncUpdateIsolationError extends Error {\n  readonly attribution: \"batch\" | \"update\";\n  readonly authorFingerprint: string | null;\n  readonly batchUpdateIds: readonly string[];\n  readonly checkpointKind: \"rotate_baseline\" | null;\n  readonly ciphertextHash: string | null;\n  readonly contentKeyEpoch: number | null;\n  readonly documentId: string | null;\n  readonly metadataHash: string | null;\n  readonly stage: DocumentSyncUpdateIsolationStage;\n  readonly updateId: string | null;\n  readonly writerUserId: string | null;\n\n  constructor(input: {\n    batchUpdateIds?: readonly string[] | undefined;\n    cause: unknown;\n    responseUpdate?: SyncResponseUpdate | undefined;\n    stage: DocumentSyncUpdateIsolationStage;\n    updateId: string | null;\n  }) {\n    const causeMessage = errorMessage(input.cause);\n    const writerUserId = optionalHeaderString(\n      input.responseUpdate,\n      \"writerUserId\",\n    );\n    const author =\n      writerUserId ?? input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const fingerprint = input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const epoch = optionalHeaderEpoch(input.responseUpdate) ?? \"unknown\";\n    const batchUpdateIds =\n      input.updateId === null ? (input.batchUpdateIds ?? []) : [];\n    const subject =\n      input.updateId === null\n        ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`\n        : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;\n    super(\n      `Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`,\n      { cause: input.cause },\n    );\n    this.name = \"DocumentSyncUpdateIsolationError\";\n    this.attribution = input.updateId === null ? \"batch\" : \"update\";\n    this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;\n    this.batchUpdateIds = [...batchUpdateIds];\n    this.checkpointKind =\n      input.responseUpdate?.checkpointKind === \"rotate_baseline\"\n        ? \"rotate_baseline\"\n        : null;\n    this.ciphertextHash = optionalHeaderString(\n      input.responseUpdate,\n      \"ciphertextHash\",\n    );\n    this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);\n    this.documentId = input.responseUpdate?.documentId ?? null;\n    this.metadataHash = optionalHeaderString(\n      input.responseUpdate,\n      \"metadataHash\",\n    );\n    this.stage = input.stage;\n    this.updateId = input.updateId;\n    this.writerUserId = writerUserId;\n  }\n}\n\nexport function isolateDocumentSyncBatchError(input: {\n  cause: unknown;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateIds: readonly string[];\n}): DocumentSyncUpdateIsolationError {\n  return new DocumentSyncUpdateIsolationError({\n    batchUpdateIds: input.updateIds,\n    cause: input.cause,\n    stage: input.stage,\n    updateId: null,\n  });\n}\n\nexport function isolateDocumentSyncUpdateError(input: {\n  cause: unknown;\n  responseUpdate?: SyncResponseUpdate | undefined;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateId: string;\n}): DocumentSyncUpdateIsolationError {\n  return input.cause instanceof DocumentSyncUpdateIsolationError\n    ? input.cause\n    : new DocumentSyncUpdateIsolationError(input);\n}\n\nexport function isDocumentSyncUpdateIsolationError(\n  error: unknown,\n): error is DocumentSyncUpdateIsolationError {\n  return error instanceof DocumentSyncUpdateIsolationError;\n}\n\nfunction responseUpdatesById(\n  updates: readonly SyncResponseUpdate[] | undefined,\n): ReadonlyMap<string, SyncResponseUpdate> {\n  return new Map((updates ?? []).map((update) => [update.id, update]));\n}\n\nfunction firstDuplicateUpdateId(\n  updates: readonly { readonly id: string }[],\n): string | null {\n  const seen = new Set<string>();\n  for (const update of updates) {\n    if (seen.has(update.id)) return update.id;\n    seen.add(update.id);\n  }\n  return null;\n}\n\nfunction assertImportedUpdatesMatchValidatedHistory(input: {\n  document: SyncDocument;\n  responseById: ReadonlyMap<string, SyncResponseUpdate>;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): void {\n  const collisions = input.updates.filter(\n    (update) =>\n      !updateMatchesDocumentHistory(input.document, update.updateData),\n  );\n  if (collisions.length === 0) return;\n  const cause = new Error(\n    \"incoming Loro update reuses an already-covered frontier with different operations\",\n  );\n  const [collision] = collisions;\n  if (input.updates.length === 1 && collision) {\n    throw isolateDocumentSyncUpdateError({\n      cause,\n      responseUpdate: input.responseById.get(collision.id),\n      stage: \"loro_import\",\n      updateId: collision.id,\n    });\n  }\n  throw isolateDocumentSyncBatchError({\n    cause,\n    stage: \"loro_import\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nasync function createValidationDocument(snapshot: Uint8Array) {\n  const document = await createDocument(crypto.randomUUID());\n  try {\n    importSnapshot(document, snapshot);\n    return document;\n  } catch (error) {\n    document.free();\n    throw error;\n  }\n}\n\nfunction splitDocumentSyncUpdates(\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): {\n  checkpoints: DecryptedDocumentSyncUpdate[];\n  ordinaryUpdates: DecryptedDocumentSyncUpdate[];\n} {\n  const checkpoints: DecryptedDocumentSyncUpdate[] = [];\n  const ordinaryUpdates: DecryptedDocumentSyncUpdate[] = [];\n  for (const update of updates) {\n    if (\n      update.checkpointKind === \"rotate_baseline\" &&\n      update.checkpointPayloadKind === \"full_history_snapshot\"\n    ) {\n      checkpoints.push(update);\n    } else {\n      ordinaryUpdates.push(update);\n    }\n  }\n  return { checkpoints, ordinaryUpdates };\n}\n\n/** Applies checkpoints with the snapshot API before batching ordinary deltas. */\nexport function importDecryptedDocumentSyncUpdates(\n  document: SyncDocument,\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): void {\n  const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);\n  for (const checkpoint of checkpoints) {\n    importSnapshot(document, checkpoint.updateData);\n  }\n  if (ordinaryUpdates.length > 0) {\n    importUpdates(\n      document,\n      ordinaryUpdates.map((update) => update.updateData),\n    );\n  }\n}\n\nasync function validateDecryptedUpdateBatch(input: {\n  currentSnapshot: Uint8Array;\n  responseById?: ReadonlyMap<string, SyncResponseUpdate> | undefined;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): Promise<void> {\n  const document = await createValidationDocument(input.currentSnapshot);\n  try {\n    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(\n      input.updates,\n    );\n    for (const checkpoint of checkpoints) {\n      importSnapshot(document, checkpoint.updateData);\n    }\n    if (ordinaryUpdates.length > 0) {\n      importUpdates(\n        document,\n        ordinaryUpdates.map((update) => update.updateData),\n      );\n    }\n    if (input.responseById) {\n      // Validate against the completed scratch history, not only the live\n      // pre-page frontier. If two updates in this page reuse one peer/counter\n      // with different operations, Loro accepts one and treats the other as a\n      // no-op; only the accepted history can match both when they are equal.\n      assertImportedUpdatesMatchValidatedHistory({\n        document,\n        responseById: input.responseById,\n        updates: input.updates,\n      });\n    }\n  } finally {\n    document.free();\n  }\n}\n\nfunction exactIsolationRetryExceedsBudget(input: {\n  candidates: readonly DecryptedDocumentSyncUpdate[];\n  currentSnapshot: Uint8Array;\n}): boolean {\n  if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES) return true;\n\n  let retryBytes = 0;\n  for (const candidateIndex of input.candidates.keys()) {\n    if (\n      input.currentSnapshot.byteLength >\n      MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n    ) {\n      return true;\n    }\n    retryBytes += input.currentSnapshot.byteLength;\n    for (const [updateIndex, update] of input.candidates.entries()) {\n      if (updateIndex === candidateIndex) continue;\n      if (\n        update.updateData.byteLength >\n        MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n      ) {\n        return true;\n      }\n      retryBytes += update.updateData.byteLength;\n    }\n  }\n  return false;\n}\n\n/** @internal Exported only to exercise the bounded exact-attribution policy. */\nexport async function findUniqueRepairingCandidate<T>(\n  candidates: readonly T[],\n  repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>,\n): Promise<T | null> {\n  let repairingCandidate: T | null = null;\n  let repairingCandidateCount = 0;\n  for (const [candidateIndex, candidate] of candidates.entries()) {\n    if (await repairsBatch(candidate, candidateIndex)) {\n      repairingCandidate = candidate;\n      repairingCandidateCount += 1;\n    }\n  }\n  return repairingCandidateCount === 1 ? repairingCandidate : null;\n}\n\n/**\n * Proves that a decrypted response can be imported before the live document or\n * any durable sync frontier is mutated. On failure, retries the page without\n * each candidate so valid sibling dependencies remain in the same batch while\n * the update whose removal repairs the batch is attributed exactly.\n */\nexport async function validateDocumentSyncUpdateImports(input: {\n  currentDocument: Awaited<ReturnType<typeof createDocument>>;\n  decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];\n  responseUpdates?: readonly SyncResponseUpdate[] | undefined;\n}): Promise<void> {\n  if (input.decryptedUpdates.length === 0) return;\n\n  const duplicateUpdateId =\n    firstDuplicateUpdateId(input.decryptedUpdates) ??\n    firstDuplicateUpdateId(input.responseUpdates ?? []);\n  if (duplicateUpdateId !== null) {\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\n        `Document sync response update id is duplicated: ${duplicateUpdateId}`,\n      ),\n      stage: \"encrypted_record\",\n      updateIds: (input.responseUpdates ?? input.decryptedUpdates).map(\n        (update) => update.id,\n      ),\n    });\n  }\n\n  const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);\n  const responseById = responseUpdatesById(input.responseUpdates);\n  let batchError: unknown;\n  try {\n    await validateDecryptedUpdateBatch({\n      currentSnapshot,\n      responseById,\n      updates: input.decryptedUpdates,\n    });\n    return;\n  } catch (error) {\n    if (isDocumentSyncUpdateIsolationError(error)) throw error;\n    batchError = error;\n  }\n\n  // A delta can be valid but depend on a parent omitted from this response\n  // page. Removing that delta would make an empty retry succeed and falsely\n  // identify its authenticated writer as poison, so dependency gaps remain\n  // anonymous at batch scope.\n  if (batchError instanceof LoroImportUnresolvedDependenciesError) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  if (\n    exactIsolationRetryExceedsBudget({\n      candidates: input.decryptedUpdates,\n      currentSnapshot,\n    })\n  ) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  // Rebuild from the same immutable snapshot for every candidate: a failed\n  // import may partially mutate its scratch document. Checkpoints participate\n  // alongside ordinary updates so an incompatibility between the two kinds\n  // cannot falsely blame the ordinary writer. Keeping every other update in\n  // one batch also preserves out-of-order sibling dependencies.\n  const isolatedUpdate = await findUniqueRepairingCandidate(\n    input.decryptedUpdates,\n    async (_update, candidateIndex) => {\n      const withoutCandidate = input.decryptedUpdates.filter(\n        (_, updateIndex) => updateIndex !== candidateIndex,\n      );\n      try {\n        await validateDecryptedUpdateBatch({\n          currentSnapshot,\n          updates: withoutCandidate,\n        });\n        return true;\n      } catch {\n        // This candidate is either valid and required by a sibling, or another\n        // poison update remains. Continue without attributing it.\n        return false;\n      }\n    },\n  );\n  if (isolatedUpdate) {\n    throw isolateDocumentSyncUpdateError({\n      cause: batchError,\n      responseUpdate: responseById.get(isolatedUpdate.id),\n      stage: \"loro_import\",\n      updateId: isolatedUpdate.id,\n    });\n  }\n\n  // Multiple bad updates or a batch-level incompatibility may have zero or\n  // multiple removals that repair the page. Fail closed without falsely naming\n  // a valid writer; no live or durable state has changed.\n  throw isolateDocumentSyncBatchError({\n    cause: batchError,\n    stage: \"loro_import\",\n    updateIds: input.decryptedUpdates.map((update) => update.id),\n  });\n}\n"]}

package/data/documents/shared/documentUpdateIntegrity.js

@@ -0,0 +1,18 @@
+import { emptyVersionVector, getImportBlobMetadata, versionVectorsEqual, } from "../../../internal/loro/index.js";
+export function assertDecryptedDocumentUpdateMetadata(updateData, update) {
+    const decodedMetadata = getImportBlobMetadata(updateData);
+    if (!versionVectorsEqual(decodedMetadata.partialStartVersionVector, update.partialStartVersionVector) ||
+        !versionVectorsEqual(decodedMetadata.partialEndVersionVector, update.partialEndVersionVector)) {
+        throw new Error("Document decrypted update version-vector mismatch");
+    }
+    if (update.checkpointKind === "rotate_baseline" &&
+        (decodedMetadata.mode !== "snapshot" ||
+            !versionVectorsEqual(decodedMetadata.partialStartVersionVector, emptyVersionVector()))) {
+        throw new Error("Document rotation baseline is not a full-history snapshot");
+    }
+    if (update.checkpointKind === undefined &&
+        decodedMetadata.mode !== "update") {
+        throw new Error("Document ordinary update payload is not an update blob");
+    }
+}
+//# sourceMappingURL=documentUpdateIntegrity.js.map

package/data/documents/shared/documentUpdateIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentUpdateIntegrity.js","sourceRoot":"","sources":["documentUpdateIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,UAAU,qCAAqC,CACnD,UAAsB,EACtB,MAA+C;IAE/C,MAAM,eAAe,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC1D,IACE,CAAC,mBAAmB,CAClB,eAAe,CAAC,yBAAyB,EACzC,MAAM,CAAC,yBAAyB,CACjC;QACD,CAAC,mBAAmB,CAClB,eAAe,CAAC,uBAAuB,EACvC,MAAM,CAAC,uBAAuB,CAC/B,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;QAC3C,CAAC,eAAe,CAAC,IAAI,KAAK,UAAU;YAClC,CAAC,mBAAmB,CAClB,eAAe,CAAC,yBAAyB,EACzC,kBAAkB,EAAE,CACrB,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,eAAe,CAAC,IAAI,KAAK,QAAQ,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC","sourcesContent":["import {\n  emptyVersionVector,\n  getImportBlobMetadata,\n  versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\n\nexport function assertDecryptedDocumentUpdateMetadata(\n  updateData: Uint8Array,\n  update: DocumentSyncResponse[\"updates\"][number],\n): void {\n  const decodedMetadata = getImportBlobMetadata(updateData);\n  if (\n    !versionVectorsEqual(\n      decodedMetadata.partialStartVersionVector,\n      update.partialStartVersionVector,\n    ) ||\n    !versionVectorsEqual(\n      decodedMetadata.partialEndVersionVector,\n      update.partialEndVersionVector,\n    )\n  ) {\n    throw new Error(\"Document decrypted update version-vector mismatch\");\n  }\n  if (\n    update.checkpointKind === \"rotate_baseline\" &&\n    (decodedMetadata.mode !== \"snapshot\" ||\n      !versionVectorsEqual(\n        decodedMetadata.partialStartVersionVector,\n        emptyVersionVector(),\n      ))\n  ) {\n    throw new Error(\n      \"Document rotation baseline is not a full-history snapshot\",\n    );\n  }\n  if (\n    update.checkpointKind === undefined &&\n    decodedMetadata.mode !== \"update\"\n  ) {\n    throw new Error(\"Document ordinary update payload is not an update blob\");\n  }\n}\n"]}

package/data/documents/shared/events.js

@@ -0,0 +1,121 @@
+import { computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeDocumentContentKeyTargetHash, deriveDocumentLinkSetManifest, signAccessEvent, } from "../../../internal/crypto/index.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../keyingCanonicalJson.js";
+import { authorizingContainerPathRefsForLinkSet, containerPathRefs, deriveDocumentCreateTargets, mergeTargetEnvelopes, } from "./projection.js";
+import { sortDocumentTargets, uniqueSortedStrings } from "./readers.js";
+export async function buildDocumentCreatePlan({ author, containerProjection, contentKeyEpoch = 1, documentId = crypto.randomUUID(), eventId = crypto.randomUUID(), signedAt = new Date().toISOString(), targetEnvelopes, }) {
+    // The document belongs to its container's organization, not the author's. A
+    // member authoring a document under another org's shared container creates a
+    // document owned by that org; the author supplies only the signer identity.
+    const organizationId = containerProjection.organizationId;
+    const targets = deriveDocumentCreateTargets(containerProjection);
+    const targetEnvelopesForRequest = mergeTargetEnvelopes(targets, targetEnvelopes);
+    const targetContainerManifestHash = targets[0]?.containerManifestHash;
+    const targetContainerId = targets[0]?.containerId;
+    if (!targetContainerManifestHash || !targetContainerId) {
+        throw new Error("Document create target is unavailable");
+    }
+    const body = {
+        blobRewraps: [],
+        eventType: "document.link",
+        containerId: targetContainerId,
+        containerManifestHash: targetContainerManifestHash,
+    };
+    const bodyHash = await computeAccessEventBodyHash(readCanonicalJson(body, "Document create body"));
+    const unsignedEvent = {
+        version: 1,
+        eventId,
+        eventType: "document.link",
+        objectKind: "document",
+        objectId: documentId,
+        organizationId,
+        previousManifestHash: null,
+        dependencyManifestHashes: uniqueSortedStrings(containerProjection.path.map((bundle) => bundle.manifestHash)),
+        bodyHash,
+        signerUserId: author.signerUserId,
+        signerDeviceId: author.signerDeviceId,
+        signerKeyFingerprint: author.signerKeyFingerprint,
+        signedAt,
+    };
+    const event = await signAccessEvent(unsignedEvent, author.signerPrivateKey);
+    const eventHash = await computeAccessEventHash(event);
+    const state = {
+        version: 1,
+        documentId,
+        organizationId,
+        epoch: 1,
+        previousManifestHash: null,
+        eventHash,
+        linkedContainerIds: [targetContainerId],
+    };
+    const manifest = await deriveDocumentLinkSetManifest(state);
+    const manifestHash = await computeAccessManifestHash(manifest);
+    const targetHash = await computeDocumentContentKeyTargetHash(targets);
+    return {
+        body,
+        documentId,
+        event,
+        eventHash,
+        manifest,
+        manifestHash,
+        request: {
+            event: readCanonicalRecord(event, "Document create event"),
+            body: readCanonicalRecord(body, "Document create body"),
+            expectedManifestHash: manifestHash,
+            manifest: readCanonicalRecord(manifest, "Document create manifest"),
+            previousManifest: null,
+            targetContainerPathRefs: containerPathRefs(containerProjection.path),
+            contentKeyBundle: {
+                contentKeyEpoch,
+                linkSetManifestHash: manifestHash,
+                targetHash,
+                targets: targetEnvelopesForRequest,
+            },
+        },
+        state,
+        targetHash,
+        targets: sortDocumentTargets(targets),
+    };
+}
+export async function buildDocumentLinkSetEventPlan(input) {
+    const eventType = input.operation === "link" ? "document.link" : "document.unlink";
+    const body = {
+        blobRewraps: input.blobRewraps,
+        eventType,
+        containerId: input.targetState.target.containerId,
+        containerManifestHash: input.targetState.target.containerManifestHash,
+    };
+    const bodyHash = await computeAccessEventBodyHash(readCanonicalJson(body, "Document link-set body"));
+    const authorizingContainerPathRefs = authorizingContainerPathRefsForLinkSet({
+        operation: input.operation,
+        targetContainerId: input.targetState.target.containerId,
+        writerProjection: input.writerProjection,
+    });
+    const dependencyManifestHashes = uniqueSortedStrings([
+        ...input.targetContainerPathRefs,
+        ...authorizingContainerPathRefs.flat(),
+    ].map((ref) => ref.manifestHash));
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId,
+        eventType,
+        objectKind: "document",
+        objectId: input.writerProjection.documentId,
+        organizationId: input.organizationId,
+        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
+        dependencyManifestHashes,
+        bodyHash,
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt,
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    const eventHash = await computeAccessEventHash(event);
+    return {
+        authorizingContainerPathRefs,
+        body,
+        event,
+        eventHash,
+    };
+}
+//# sourceMappingURL=events.js.map

package/data/documents/shared/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["events.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,mCAAmC,EAGnC,6BAA6B,EAC7B,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAWrE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,MAAM,EACN,mBAAmB,EACnB,eAAe,GAAG,CAAC,EACnB,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,EAChC,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,eAAe,GACc;IAC7B,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC;IAE1D,MAAM,OAAO,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,yBAAyB,GAAG,oBAAoB,CACpD,OAAO,EACP,eAAe,CAChB,CAAC;IACF,MAAM,2BAA2B,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;IAClD,IAAI,CAAC,2BAA2B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,IAAI,GAAgC;QACxC,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,eAAe;QAC1B,WAAW,EAAE,iBAAiB;QAC9B,qBAAqB,EAAE,2BAA2B;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAChD,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO;QACP,SAAS,EAAE,eAAe;QAC1B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,UAAU;QACpB,cAAc;QACd,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,mBAAmB,CAC3C,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAC9D;QACD,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,QAAQ;KACT,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,KAAK,GAAiC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU;QACV,cAAc;QACd,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,IAAI;QAC1B,SAAS;QACT,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;KACxC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAEtE,OAAO;QACL,IAAI;QACJ,UAAU;QACV,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,OAAO,EAAE;YACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,CAAC;YAC1D,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,sBAAsB,CAAC;YACvD,oBAAoB,EAAE,YAAY;YAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,CAAC;YACnE,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACpE,gBAAgB,EAAE;gBAChB,eAAe;gBACf,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,OAAO,EAAE,yBAAyB;aACnC;SACF;QACD,KAAK;QACL,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAanD;IACC,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACnE,MAAM,IAAI,GAAgC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW;QACjD,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,qBAAqB;KACtE,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAClD,CAAC;IACF,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;QAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW;QACvD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,wBAAwB,GAAG,mBAAmB,CAClD;QACE,GAAG,KAAK,CAAC,uBAAuB;QAChC,GAAG,4BAA4B,CAAC,IAAI,EAAE;KACvC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACjC,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB;QACxB,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAEtD,OAAO;QACL,4BAA4B;QAC5B,IAAI;QACJ,KAAK;QACL,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeDocumentContentKeyTargetHash,\n  type DocumentLinkAccessEventBody,\n  type DocumentLinkSetManifestState,\n  deriveDocumentLinkSetManifest,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { ContainerManifestRef } from \"@tearleads/validators/request\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../keyingCanonicalJson\";\nimport {\n  authorizingContainerPathRefsForLinkSet,\n  containerPathRefs,\n  deriveDocumentCreateTargets,\n  mergeTargetEnvelopes,\n} from \"./projection\";\nimport { sortDocumentTargets, uniqueSortedStrings } from \"./readers\";\nimport type {\n  BuildDocumentCreatePlanInput,\n  DocumentCreateAuthor,\n  DocumentCreatePlan,\n  DocumentLinkSetEventPlan,\n  DocumentLinkSetMutationBody,\n  DocumentLinkSetMutationOperation,\n  DocumentLinkSetTargetState,\n} from \"./types\";\n\nexport async function buildDocumentCreatePlan({\n  author,\n  containerProjection,\n  contentKeyEpoch = 1,\n  documentId = crypto.randomUUID(),\n  eventId = crypto.randomUUID(),\n  signedAt = new Date().toISOString(),\n  targetEnvelopes,\n}: BuildDocumentCreatePlanInput): Promise<DocumentCreatePlan> {\n  // The document belongs to its container's organization, not the author's. A\n  // member authoring a document under another org's shared container creates a\n  // document owned by that org; the author supplies only the signer identity.\n  const organizationId = containerProjection.organizationId;\n\n  const targets = deriveDocumentCreateTargets(containerProjection);\n  const targetEnvelopesForRequest = mergeTargetEnvelopes(\n    targets,\n    targetEnvelopes,\n  );\n  const targetContainerManifestHash = targets[0]?.containerManifestHash;\n  const targetContainerId = targets[0]?.containerId;\n  if (!targetContainerManifestHash || !targetContainerId) {\n    throw new Error(\"Document create target is unavailable\");\n  }\n\n  const body: DocumentLinkAccessEventBody = {\n    blobRewraps: [],\n    eventType: \"document.link\",\n    containerId: targetContainerId,\n    containerManifestHash: targetContainerManifestHash,\n  };\n  const bodyHash = await computeAccessEventBodyHash(\n    readCanonicalJson(body, \"Document create body\"),\n  );\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId,\n    eventType: \"document.link\",\n    objectKind: \"document\",\n    objectId: documentId,\n    organizationId,\n    previousManifestHash: null,\n    dependencyManifestHashes: uniqueSortedStrings(\n      containerProjection.path.map((bundle) => bundle.manifestHash),\n    ),\n    bodyHash,\n    signerUserId: author.signerUserId,\n    signerDeviceId: author.signerDeviceId,\n    signerKeyFingerprint: author.signerKeyFingerprint,\n    signedAt,\n  };\n  const event = await signAccessEvent(unsignedEvent, author.signerPrivateKey);\n  const eventHash = await computeAccessEventHash(event);\n  const state: DocumentLinkSetManifestState = {\n    version: 1,\n    documentId,\n    organizationId,\n    epoch: 1,\n    previousManifestHash: null,\n    eventHash,\n    linkedContainerIds: [targetContainerId],\n  };\n  const manifest = await deriveDocumentLinkSetManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const targetHash = await computeDocumentContentKeyTargetHash(targets);\n\n  return {\n    body,\n    documentId,\n    event,\n    eventHash,\n    manifest,\n    manifestHash,\n    request: {\n      event: readCanonicalRecord(event, \"Document create event\"),\n      body: readCanonicalRecord(body, \"Document create body\"),\n      expectedManifestHash: manifestHash,\n      manifest: readCanonicalRecord(manifest, \"Document create manifest\"),\n      previousManifest: null,\n      targetContainerPathRefs: containerPathRefs(containerProjection.path),\n      contentKeyBundle: {\n        contentKeyEpoch,\n        linkSetManifestHash: manifestHash,\n        targetHash,\n        targets: targetEnvelopesForRequest,\n      },\n    },\n    state,\n    targetHash,\n    targets: sortDocumentTargets(targets),\n  };\n}\n\nexport async function buildDocumentLinkSetEventPlan(input: {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  eventId: string;\n  operation: DocumentLinkSetMutationOperation;\n  // The document's existing organization (from its manifest). Link/unlink does\n  // not change ownership, so the event keeps the document's org, which is the\n  // container's org — never the acting member's personal org.\n  organizationId: string;\n  signedAt: string;\n  targetContainerPathRefs: readonly ContainerManifestRef[];\n  targetState: DocumentLinkSetTargetState;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentLinkSetEventPlan> {\n  const eventType =\n    input.operation === \"link\" ? \"document.link\" : \"document.unlink\";\n  const body: DocumentLinkSetMutationBody = {\n    blobRewraps: input.blobRewraps,\n    eventType,\n    containerId: input.targetState.target.containerId,\n    containerManifestHash: input.targetState.target.containerManifestHash,\n  };\n  const bodyHash = await computeAccessEventBodyHash(\n    readCanonicalJson(body, \"Document link-set body\"),\n  );\n  const authorizingContainerPathRefs = authorizingContainerPathRefsForLinkSet({\n    operation: input.operation,\n    targetContainerId: input.targetState.target.containerId,\n    writerProjection: input.writerProjection,\n  });\n  const dependencyManifestHashes = uniqueSortedStrings(\n    [\n      ...input.targetContainerPathRefs,\n      ...authorizingContainerPathRefs.flat(),\n    ].map((ref) => ref.manifestHash),\n  );\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId,\n    eventType,\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes,\n    bodyHash,\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt,\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n  const eventHash = await computeAccessEventHash(event);\n\n  return {\n    authorizingContainerPathRefs,\n    body,\n    event,\n    eventHash,\n  };\n}\n"]}