@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/documents/shared/types.d.ts

@@ -0,0 +1,330 @@
+import type { BlobBytesResponse } from "../../../internal/api-client/index.js";
+import type { AccessEvent, AccessManifest, DocumentContentKeyTarget, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentUnlinkAccessEventBody } from "../../../internal/crypto/index.js";
+import type { ContainerManifestRef, DocumentContentKeyTargetEnvelope, DocumentCreateRequest, DocumentLinkSetMutationRequest, DocumentOutgoingUpdate, DocumentSyncRequest } from "../../../internal/validators/request/index.js";
+import type { ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentLinkSetMutationResponse, DocumentPurgeProofResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListDocumentAttachmentsResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerRekeyApi } from "../../containers/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer, DocumentWriterProjectionAuthorization as WriterAuthorization } from "../../keyingProjectionVerification.js";
+import type { DocumentRecord } from "../../sqlite/documentPersistence.js";
+import type { ExecSql } from "../../sqlite/sqlSchema.js";
+import type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
+export type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
+export declare const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT = "tearleads.document.loro-update";
+export declare const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN = "tearleads.document.content-record-key-info";
+export declare const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN = "tearleads.document.content-record-plaintext-hash-key-info";
+export declare const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN = "tearleads.document.content-record-aad";
+export declare const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer>;
+export declare const DOCUMENT_ENCRYPTED_UPDATE_KEYS: Set<string>;
+export declare const TEXT_ENCODER: TextEncoder;
+interface ProjectionVerificationBase {
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+export type ProjectionVerificationOptions = ProjectionVerificationBase & ({
+    readonly execSql: ExecSql;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly trustedLocalProjection?: undefined;
+} | {
+    readonly execSql?: ExecSql | undefined;
+    readonly resolveProjectionUserKey?: undefined;
+    readonly trustedLocalProjection: true;
+});
+export declare function resolveProjectionVerifier(input: ProjectionVerificationOptions, label: string): ProjectionUserKeyResolver | null;
+export declare function projectionVerificationOptions(input: ProjectionVerificationOptions): ProjectionVerificationOptions;
+export type DocumentCreateAuthor = ContainerMutationAuthor;
+export interface BuildDocumentCreatePlanInput {
+    author: DocumentCreateAuthor;
+    containerProjection: ContainerWriterProjectionResponse;
+    contentKeyEpoch?: number;
+    documentId?: string;
+    eventId?: string;
+    signedAt?: string;
+    targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];
+}
+export interface DocumentCreatePlan {
+    body: DocumentLinkAccessEventBody;
+    documentId: string;
+    event: AccessEvent;
+    eventHash: string;
+    manifest: AccessManifest;
+    manifestHash: string;
+    request: DocumentCreateRequest;
+    state: DocumentLinkSetManifestState;
+    targetHash: string;
+    targets: DocumentContentKeyTarget[];
+}
+export interface MaterializedDocumentCreatePlan {
+    contentKey: Uint8Array;
+    plan: DocumentCreatePlan;
+}
+export interface DocumentCreateApi {
+    createDocumentResult(input: DocumentCreateRequest, options?: DocumentSyncRequestResultOptions | undefined): Promise<{
+        readonly data: DocumentCreateResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+    getContainerWriterProjection(containerId: string): Promise<ContainerWriterProjectionResponse | null>;
+    getContainerWriterProjectionResult(containerId: string, options?: DocumentSyncRequestResultOptions | undefined): Promise<{
+        readonly data: ContainerWriterProjectionResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+    getDocumentWriterProjection(documentId: string): Promise<DocumentWriterProjectionResponse | null>;
+    evictContainerWriterProjection(containerId: string): void;
+    primeDocumentWriterProjection(documentId: string, projection: DocumentWriterProjectionResponse): void;
+}
+export interface CreateRemoteDocumentResult {
+    contentKey: Uint8Array;
+    documentId: string;
+    persistedState: PersistedDocumentCreateState;
+    plan?: DocumentCreatePlan | undefined;
+    response?: DocumentCreateResponse | undefined;
+    writerProjection: DocumentWriterProjectionResponse;
+}
+export type DocumentLinkSetMutationOperation = "link" | "unlink";
+export type DocumentLinkSetMutationBody = DocumentLinkAccessEventBody | DocumentUnlinkAccessEventBody;
+export interface DocumentLinkSetTargetState {
+    readonly currentTargets: readonly DocumentContentKeyTarget[];
+    readonly linkedContainerIds: readonly string[];
+    readonly target: DocumentContentKeyTarget;
+    readonly targets: readonly DocumentContentKeyTarget[];
+}
+export interface BuildDocumentLinkSetMutationPlanInput {
+    blobRewraps: DocumentLinkAccessEventBody["blobRewraps"];
+    author: DocumentCreateAuthor;
+    contentKeyEpoch: number;
+    eventId?: string | undefined;
+    operation: DocumentLinkSetMutationOperation;
+    signedAt?: string | undefined;
+    targetContainerProjection: ContainerWriterProjectionResponse;
+    targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];
+    writerProjection: DocumentWriterProjectionResponse;
+}
+export interface DocumentLinkSetMutationPlan {
+    body: DocumentLinkSetMutationBody;
+    contentKeyEpoch: number;
+    documentId: string;
+    event: AccessEvent;
+    eventHash: string;
+    manifest: AccessManifest;
+    manifestHash: string;
+    operation: DocumentLinkSetMutationOperation;
+    request: DocumentLinkSetMutationRequest;
+    state: DocumentLinkSetManifestState;
+    targetHash: string;
+    targets: DocumentContentKeyTarget[];
+}
+export interface MaterializedDocumentLinkSetMutationPlan {
+    contentKey: Uint8Array;
+    contentKeyRotated: boolean;
+    plan: DocumentLinkSetMutationPlan;
+}
+export interface DocumentLinkSetEventPlan {
+    authorizingContainerPathRefs: ContainerManifestRef[][];
+    body: DocumentLinkSetMutationBody;
+    event: AccessEvent;
+    eventHash: string;
+}
+/**
+ * What a failed link-set mutation could tell the caller: the HTTP status (or
+ * null for network/local failures) and a short message. Threaded up to the
+ * move-intent queue so a permission failure reads as one, instead of the
+ * generic "rejected or unavailable".
+ */
+export type DocumentLinkSetMutationFailure = Pick<DocumentSyncSubmitFailure, "code" | "message" | "status">;
+export type DocumentLinkSetFailureHandler = (failure: DocumentLinkSetMutationFailure) => void;
+type DocumentLinkSetMutationResult = {
+    readonly data: DocumentLinkSetMutationResponse;
+    readonly ok: true;
+} | (DocumentLinkSetMutationFailure & {
+    readonly ok: false;
+});
+export interface DocumentLinkSetMutationApi {
+    getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;
+    listDocumentAttachments(documentId: string): Promise<ListDocumentAttachmentsResponse | null>;
+    getContainerWriterProjection(containerId: string): Promise<ContainerWriterProjectionResponse | null>;
+    getContainerWriterProjectionResult(containerId: string, options?: DocumentSyncRequestResultOptions | undefined): Promise<{
+        readonly data: ContainerWriterProjectionResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+    getDocumentWriterProjection(documentId: string): Promise<DocumentWriterProjectionResponse | null>;
+    getDocumentWriterProjectionResult(documentId: string, options?: DocumentSyncRequestResultOptions | undefined): Promise<{
+        readonly data: DocumentWriterProjectionResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+    primeDocumentWriterProjection(documentId: string, projection: DocumentWriterProjectionResponse): void;
+    linkDocumentResult(documentId: string, input: DocumentLinkSetMutationRequest, options?: DocumentSyncRequestResultOptions): Promise<DocumentLinkSetMutationResult>;
+    unlinkDocumentResult(documentId: string, input: DocumentLinkSetMutationRequest, options?: DocumentSyncRequestResultOptions): Promise<DocumentLinkSetMutationResult>;
+}
+export interface RelinkRemoteDocumentResult {
+    contentKey: Uint8Array;
+    contentKeyRotated: boolean;
+    documentId: string;
+    linkedContainerIds: readonly string[];
+    persistedState: PersistedDocumentCreateState;
+    plan: DocumentLinkSetMutationPlan;
+    response: DocumentLinkSetMutationResponse;
+}
+export interface DocumentSyncPreparedUpdate {
+    checkpointKind?: DocumentOutgoingUpdate["checkpointKind"] | undefined;
+    checkpointPayloadKind?: DocumentOutgoingUpdate["checkpointPayloadKind"] | undefined;
+    ciphertextHash: string;
+    contentRecordId?: string | undefined;
+    encryptedData: string;
+    id: string;
+    metadataHash: string;
+    partialEndVersionVector: string;
+    partialStartVersionVector: string;
+    plaintextHash: string;
+    signedAt?: string | undefined;
+    sourceVersionVector?: string | undefined;
+}
+export interface DocumentEncryptedPendingUpdate {
+    contentRecordId: string;
+    encryptedData: string;
+    metadataHash: string;
+    ciphertextHash: string;
+    plaintextHash: string;
+}
+export interface ParsedDocumentEncryptedUpdate {
+    ciphertext: Uint8Array;
+    contentKeyEpoch: number;
+    contentRecordId: string;
+    metadataHash: string;
+    nonceDomainHash: string;
+    iv: Uint8Array;
+}
+export interface DecryptedDocumentSyncUpdate {
+    checkpointKind?: "rotate_baseline";
+    checkpointPayloadKind?: "full_history_snapshot";
+    id: string;
+    partialEndVersionVector: string;
+    partialStartVersionVector: string;
+    sourceVersionVector?: string;
+    updateData: Uint8Array;
+}
+export interface BuildDocumentSyncPlanInput {
+    author: DocumentCreateAuthor;
+    authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];
+    containerRekeys?: DocumentSyncRequest["containerRekeys"];
+    contentKeyBundle: DocumentCreateResponse["contentKeyBundle"];
+    documentId?: string | undefined;
+    documentKekTargets: DocumentSyncResponse["documentKekTargets"];
+    documentManifest: DocumentCreateResponse["accessManifest"];
+    historyMode?: "raw" | undefined;
+    inlineRekeyCommitId?: string | undefined;
+    localVersionVector: string | null;
+    minLsn?: string | undefined;
+    outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;
+    pullCursor?: string | undefined;
+    signedAt?: string | undefined;
+}
+export interface DocumentSyncPlan {
+    contentKeyEpoch: number;
+    documentId: string;
+    documentKekTargets: DocumentSyncResponse["documentKekTargets"];
+    documentManifest: DocumentCreateResponse["accessManifest"];
+    documentWriterAuthorization?: WriterAuthorization | undefined;
+    expectedLinkSetManifestHash: string;
+    expectedTargetHash: string;
+    minLsn?: string | undefined;
+    organizationId: string;
+    request: DocumentSyncRequest;
+    sourceContentKeyBundle: DocumentCreateResponse["contentKeyBundle"];
+}
+export interface MaterializedDocumentSyncPlan {
+    contentKey: Uint8Array;
+    /**
+     * True when the plan carries a re-wrapped content-key bundle at the next
+     * epoch to heal a stale bundle (a linked container's KEK rotated under it).
+     * On submit success the caller must evict this document's cached writer
+     * projection so later passes see the healed state instead of re-healing.
+     */
+    healedStaleContentKeyBundle: boolean;
+    /**
+     * Pending-queue ids a heal deliberately did NOT submit (superseded rotation
+     * checkpoints). On heal success they are reported as settled — the
+     * committed covering baseline subsumes their content, and resubmitting them
+     * post-heal could mask it as the latest baseline at the healed epoch.
+     */
+    heldBackPendingUpdateIds: readonly string[];
+    plan: DocumentSyncPlan;
+    writerProjection: DocumentWriterProjectionResponse;
+    /** Synthetic baseline id; its ack does not settle a pending queue row. */
+    staleRecoveryBaselineUpdateId?: string;
+}
+export interface SyncRemoteDocumentResult {
+    contentKey: Uint8Array;
+    decryptedUpdates: DecryptedDocumentSyncUpdate[];
+    /**
+     * Pending updates whose persisted re-key bound is exhausted. Non-zero means
+     * a terminal failure was just recorded for them — callers must not treat
+     * the pass as clean and clear it.
+     */
+    exhaustedPendingUpdateCount: number;
+    /**
+     * True only when this bounded pass made durable progress but left pending
+     * work. Headless hosts should refresh the queue and schedule another
+     * pass. Terminal exhaustion reports false and uses the failure callback.
+     */
+    hasDeferredPendingUpdates: boolean;
+    /** Verified page progress was persisted, but remote pages remain. */
+    hasIncompletePull: boolean;
+    persistedState: PersistedDocumentSyncState;
+    plan: DocumentSyncPlan;
+    rekeyedPendingUpdateIds: readonly string[];
+    response: DocumentSyncResponse;
+    settledPendingUpdateIds: readonly string[];
+    acceptedRecoveryBaseline: boolean;
+    writerProjection?: DocumentWriterProjectionResponse | undefined;
+}
+export interface DocumentSyncRequestResultOptions {
+    readonly expectedPaymentRequiredOrganizationId?: string | undefined;
+    readonly reportErrors?: boolean | undefined;
+}
+export interface DocumentSyncApi {
+    rekeyContainer: ContainerRekeyApi["rekeyContainer"];
+    /**
+     * Optional status-bearing rekey. Present on the real client; an adapter that
+     * omits it still repairs, but a permanent refusal cannot then be told from a
+     * transient one and is reported as a plain abandon.
+     */
+    rekeyContainerResult?: ContainerRekeyApi["rekeyContainerResult"];
+    /**
+     * Optional. A repair that must carry descendant rekeys reads each one's
+     * projection; without this such a repair is refused and the pass abandons.
+     */
+    getContainerWriterProjection?: ContainerRekeyApi["getContainerWriterProjection"];
+    clearWriterProjectionCaches?(): void;
+    evictDocumentWriterProjection?(documentId: string): void;
+    getDocumentPurgeProof?(documentId: string, options?: {
+        readonly documentCheckpointManifestHash?: string;
+    }, requestOptions?: DocumentSyncRequestResultOptions): Promise<DocumentPurgeProofResponse | null>;
+    getDocumentWriterProjection(documentId: string): Promise<DocumentWriterProjectionResponse | null>;
+    getDocumentWriterProjectionResult(documentId: string, options?: DocumentSyncRequestResultOptions | undefined): Promise<{
+        readonly data: DocumentWriterProjectionResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+    syncDocumentResult(documentId: string, input: DocumentSyncRequest, options?: DocumentSyncRequestResultOptions): Promise<{
+        readonly data: DocumentSyncResponse;
+        readonly ok: true;
+    } | DocumentSyncSubmitFailure>;
+}
+export type DocumentWriterPublicKeyResolver = (input: {
+    writerSigningKeyFingerprint: string;
+    writerUserId: string;
+}) => Promise<Uint8Array | null>;
+export type PersistedDocumentCreateState = Pick<DocumentRecord, "documentId" | "contentKeyBundle" | "documentKekTargets" | "documentManifestBundle">;
+export type PersistedDocumentSyncState = PersistedDocumentCreateState;
+export interface UnwrappedContainerKek {
+    containerId: string;
+    /**
+     * Null for keyring-recovered historical keys, which carry key material and
+     * the epoch id committing to it but no epoch record to hash.
+     *
+     * Such a key still satisfies a parent wrap: the epoch-record fingerprint is
+     * a selector for choosing among envelopes, not the security boundary, so a
+     * null hash falls back to selecting on the epoch id while AEAD authenticates
+     * (see `containerKekPath.ts`). That is what lets a descendant pinned to a
+     * rotated parent be opened rather than stranded.
+     */
+    keyEpochHash: string | null;
+    keyMaterial: Uint8Array;
+}

package/data/documents/shared/types.js

@@ -0,0 +1,58 @@
+import { requireProjectionUserKeyResolver } from "../../keyingProjectionVerification.js";
+export const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT = "tearleads.document.loro-update";
+export const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN = "tearleads.document.content-record-key-info";
+export const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN = "tearleads.document.content-record-plaintext-hash-key-info";
+export const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN = "tearleads.document.content-record-aad";
+export const DOCUMENT_CONTENT_RECORD_HKDF_SALT = new TextEncoder().encode("tearleads.document.content-record-hkdf-salt");
+export const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([
+    "ciphertext",
+    "contentKeyEpoch",
+    "contentRecordId",
+    "encryptionSuite",
+    "format",
+    "iv",
+    "metadataHash",
+    "nonceDomainHash",
+    "version",
+]);
+export const TEXT_ENCODER = new TextEncoder();
+export function resolveProjectionVerifier(input, label) {
+    if (input.resolveProjectionUserKey) {
+        if (input.trustedLocalProjection === true) {
+            throw new Error(`${label} cannot combine projection key verification with local projection trust`);
+        }
+        return requireProjectionUserKeyResolver(input.resolveProjectionUserKey, label);
+    }
+    if (input.trustedLocalProjection === true) {
+        return null;
+    }
+    throw new Error(`${label} requires projection key verification or an explicitly trusted local projection`);
+}
+export function projectionVerificationOptions(input) {
+    const warm = input.warmReferencedPrincipalPolicies;
+    const shared = {
+        ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),
+        ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),
+    };
+    if (input.resolveProjectionUserKey) {
+        if (input.trustedLocalProjection === true) {
+            throw new Error("Projection use cannot combine key verification with local projection trust");
+        }
+        return {
+            execSql: input.execSql,
+            ...shared,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+        };
+    }
+    if (input.trustedLocalProjection === true) {
+        return input.execSql
+            ? {
+                execSql: input.execSql,
+                ...shared,
+                trustedLocalProjection: true,
+            }
+            : { ...shared, trustedLocalProjection: true };
+    }
+    throw new Error("Projection use requires key verification or an explicitly trusted local projection");
+}
+//# sourceMappingURL=types.js.map

package/data/documents/shared/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF,MAAM,CAAC,MAAM,qCAAqC,GAChD,gCAAgC,CAAC;AACnC,MAAM,CAAC,MAAM,uCAAuC,GAClD,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,sDAAsD,GACjE,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAC7C,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,iCAAiC,GAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAsB9C,MAAM,UAAU,yBAAyB,CACvC,KAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yEAAyE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iFAAiF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,CAAC;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,MAAM;YACT,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,MAAM;gBACT,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  DocumentContentKeyTarget,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentUnlinkAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n  DocumentCreateRequest,\n  DocumentLinkSetMutationRequest,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentPurgeProofResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n} from \"../../containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n  DocumentWriterProjectionAuthorization as WriterAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { requireProjectionUserKeyResolver } from \"../../keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT =\n  \"tearleads.document.loro-update\";\nexport const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-plaintext-hash-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.document.content-record-aad\";\nexport const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.document.content-record-hkdf-salt\");\nexport const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([\n  \"ciphertext\",\n  \"contentKeyEpoch\",\n  \"contentRecordId\",\n  \"encryptionSuite\",\n  \"format\",\n  \"iv\",\n  \"metadataHash\",\n  \"nonceDomainHash\",\n  \"version\",\n]);\nexport const TEXT_ENCODER = new TextEncoder();\ninterface ProjectionVerificationBase {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport type ProjectionVerificationOptions = ProjectionVerificationBase &\n  (\n    | {\n        readonly execSql: ExecSql;\n        readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n        readonly trustedLocalProjection?: undefined;\n      }\n    | {\n        readonly execSql?: ExecSql | undefined;\n        readonly resolveProjectionUserKey?: undefined;\n        readonly trustedLocalProjection: true;\n      }\n  );\n\nexport function resolveProjectionVerifier(\n  input: ProjectionVerificationOptions,\n  label: string,\n): ProjectionUserKeyResolver | null {\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        `${label} cannot combine projection key verification with local projection trust`,\n      );\n    }\n    return requireProjectionUserKeyResolver(\n      input.resolveProjectionUserKey,\n      label,\n    );\n  }\n  if (input.trustedLocalProjection === true) {\n    return null;\n  }\n  throw new Error(\n    `${label} requires projection key verification or an explicitly trusted local projection`,\n  );\n}\n\nexport function projectionVerificationOptions(\n  input: ProjectionVerificationOptions,\n): ProjectionVerificationOptions {\n  const warm = input.warmReferencedPrincipalPolicies;\n  const shared = {\n    ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n    ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),\n  };\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        \"Projection use cannot combine key verification with local projection trust\",\n      );\n    }\n    return {\n      execSql: input.execSql,\n      ...shared,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    };\n  }\n  if (input.trustedLocalProjection === true) {\n    return input.execSql\n      ? {\n          execSql: input.execSql,\n          ...shared,\n          trustedLocalProjection: true,\n        }\n      : { ...shared, trustedLocalProjection: true };\n  }\n\n  throw new Error(\n    \"Projection use requires key verification or an explicitly trusted local projection\",\n  );\n}\n\nexport type DocumentCreateAuthor = ContainerMutationAuthor;\n\nexport interface BuildDocumentCreatePlanInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  contentKeyEpoch?: number;\n  documentId?: string;\n  eventId?: string;\n  signedAt?: string;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n}\n\nexport interface DocumentCreatePlan {\n  body: DocumentLinkAccessEventBody;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  request: DocumentCreateRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentCreatePlan {\n  contentKey: Uint8Array;\n  plan: DocumentCreatePlan;\n}\n\nexport interface DocumentCreateApi {\n  // Lets idempotent create inspect an expected already-exists conflict.\n  createDocumentResult(\n    input: DocumentCreateRequest,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentCreateResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  // Result-returning variant used by the create path so a terminal projection\n  // fetch failure (e.g. a 402 billing block or a 403 after access revocation)\n  // can be persisted to the write queue instead of collapsing to a silent\n  // null.\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  // Needed to adopt an existing remote document on a create conflict: the\n  // committed manifest, content-key bundle and KEK targets are refetched here\n  // (the create response that carried them was lost).\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  evictContainerWriterProjection(containerId: string): void;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nexport interface CreateRemoteDocumentResult {\n  contentKey: Uint8Array;\n  documentId: string;\n  persistedState: PersistedDocumentCreateState;\n  // `plan` and `response` are absent when the result was adopted from an\n  // existing remote document on a create conflict: there is no fresh create\n  // response, and the local plan does not match the committed manifest (the\n  // first attempt used a different content key). Consumers read only\n  // documentId/writerProjection/persistedState.\n  plan?: DocumentCreatePlan | undefined;\n  response?: DocumentCreateResponse | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport type DocumentLinkSetMutationOperation = \"link\" | \"unlink\";\nexport type DocumentLinkSetMutationBody =\n  | DocumentLinkAccessEventBody\n  | DocumentUnlinkAccessEventBody;\n\nexport interface DocumentLinkSetTargetState {\n  readonly currentTargets: readonly DocumentContentKeyTarget[];\n  readonly linkedContainerIds: readonly string[];\n  readonly target: DocumentContentKeyTarget;\n  readonly targets: readonly DocumentContentKeyTarget[];\n}\n\nexport interface BuildDocumentLinkSetMutationPlanInput {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  eventId?: string | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  signedAt?: string | undefined;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DocumentLinkSetMutationPlan {\n  body: DocumentLinkSetMutationBody;\n  contentKeyEpoch: number;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentLinkSetMutationPlan {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  plan: DocumentLinkSetMutationPlan;\n}\n\nexport interface DocumentLinkSetEventPlan {\n  authorizingContainerPathRefs: ContainerManifestRef[][];\n  body: DocumentLinkSetMutationBody;\n  event: AccessEvent;\n  eventHash: string;\n}\n\n/**\n * What a failed link-set mutation could tell the caller: the HTTP status (or\n * null for network/local failures) and a short message. Threaded up to the\n * move-intent queue so a permission failure reads as one, instead of the\n * generic \"rejected or unavailable\".\n */\nexport type DocumentLinkSetMutationFailure = Pick<\n  DocumentSyncSubmitFailure,\n  \"code\" | \"message\" | \"status\"\n>;\n\nexport type DocumentLinkSetFailureHandler = (\n  failure: DocumentLinkSetMutationFailure,\n) => void;\n\ntype DocumentLinkSetMutationResult =\n  | { readonly data: DocumentLinkSetMutationResponse; readonly ok: true }\n  | (DocumentLinkSetMutationFailure & { readonly ok: false });\n\nexport interface DocumentLinkSetMutationApi {\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n  linkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n  unlinkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n}\n\nexport interface RelinkRemoteDocumentResult {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  documentId: string;\n  linkedContainerIds: readonly string[];\n  persistedState: PersistedDocumentCreateState;\n  plan: DocumentLinkSetMutationPlan;\n  response: DocumentLinkSetMutationResponse;\n}\n\nexport interface DocumentSyncPreparedUpdate {\n  checkpointKind?: DocumentOutgoingUpdate[\"checkpointKind\"] | undefined;\n  checkpointPayloadKind?:\n    | DocumentOutgoingUpdate[\"checkpointPayloadKind\"]\n    | undefined;\n  ciphertextHash: string;\n  contentRecordId?: string | undefined;\n  encryptedData: string;\n  id: string;\n  metadataHash: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  plaintextHash: string;\n  signedAt?: string | undefined;\n  sourceVersionVector?: string | undefined;\n}\n\nexport interface DocumentEncryptedPendingUpdate {\n  contentRecordId: string;\n  encryptedData: string;\n  metadataHash: string;\n  ciphertextHash: string;\n  plaintextHash: string;\n}\n\nexport interface ParsedDocumentEncryptedUpdate {\n  ciphertext: Uint8Array;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  iv: Uint8Array;\n}\n\nexport interface DecryptedDocumentSyncUpdate {\n  checkpointKind?: \"rotate_baseline\";\n  checkpointPayloadKind?: \"full_history_snapshot\";\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  sourceVersionVector?: string;\n  updateData: Uint8Array;\n}\n\nexport interface BuildDocumentSyncPlanInput {\n  author: DocumentCreateAuthor;\n  authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];\n  containerRekeys?: DocumentSyncRequest[\"containerRekeys\"];\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentId?: string | undefined;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  historyMode?: \"raw\" | undefined;\n  inlineRekeyCommitId?: string | undefined;\n  localVersionVector: string | null;\n  minLsn?: string | undefined;\n  outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;\n  pullCursor?: string | undefined;\n  signedAt?: string | undefined;\n}\n\nexport interface DocumentSyncPlan {\n  contentKeyEpoch: number;\n  documentId: string;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  documentWriterAuthorization?: WriterAuthorization | undefined;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  minLsn?: string | undefined;\n  organizationId: string;\n  request: DocumentSyncRequest;\n  sourceContentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n}\n\nexport interface MaterializedDocumentSyncPlan {\n  contentKey: Uint8Array;\n  /**\n   * True when the plan carries a re-wrapped content-key bundle at the next\n   * epoch to heal a stale bundle (a linked container's KEK rotated under it).\n   * On submit success the caller must evict this document's cached writer\n   * projection so later passes see the healed state instead of re-healing.\n   */\n  healedStaleContentKeyBundle: boolean;\n  /**\n   * Pending-queue ids a heal deliberately did NOT submit (superseded rotation\n   * checkpoints). On heal success they are reported as settled — the\n   * committed covering baseline subsumes their content, and resubmitting them\n   * post-heal could mask it as the latest baseline at the healed epoch.\n   */\n  heldBackPendingUpdateIds: readonly string[];\n  plan: DocumentSyncPlan;\n  writerProjection: DocumentWriterProjectionResponse;\n  /** Synthetic baseline id; its ack does not settle a pending queue row. */\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nexport interface SyncRemoteDocumentResult {\n  contentKey: Uint8Array;\n  decryptedUpdates: DecryptedDocumentSyncUpdate[];\n  /**\n   * Pending updates whose persisted re-key bound is exhausted. Non-zero means\n   * a terminal failure was just recorded for them — callers must not treat\n   * the pass as clean and clear it.\n   */\n  exhaustedPendingUpdateCount: number;\n  /**\n   * True only when this bounded pass made durable progress but left pending\n   * work. Headless hosts should refresh the queue and schedule another\n   * pass. Terminal exhaustion reports false and uses the failure callback.\n   */\n  hasDeferredPendingUpdates: boolean;\n  /** Verified page progress was persisted, but remote pages remain. */\n  hasIncompletePull: boolean;\n  persistedState: PersistedDocumentSyncState;\n  plan: DocumentSyncPlan;\n  rekeyedPendingUpdateIds: readonly string[];\n  response: DocumentSyncResponse;\n  settledPendingUpdateIds: readonly string[];\n  acceptedRecoveryBaseline: boolean;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DocumentSyncRequestResultOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n\nexport interface DocumentSyncApi {\n  rekeyContainer: ContainerRekeyApi[\"rekeyContainer\"];\n  /**\n   * Optional status-bearing rekey. Present on the real client; an adapter that\n   * omits it still repairs, but a permanent refusal cannot then be told from a\n   * transient one and is reported as a plain abandon.\n   */\n  rekeyContainerResult?: ContainerRekeyApi[\"rekeyContainerResult\"];\n  /**\n   * Optional. A repair that must carry descendant rekeys reads each one's\n   * projection; without this such a repair is refused and the pass abandons.\n   */\n  getContainerWriterProjection?: ContainerRekeyApi[\"getContainerWriterProjection\"];\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentPurgeProof?(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  syncDocumentResult(\n    documentId: string,\n    input: DocumentSyncRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<\n    | {\n        readonly data: DocumentSyncResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n}\n\nexport type DocumentWriterPublicKeyResolver = (input: {\n  writerSigningKeyFingerprint: string;\n  writerUserId: string;\n}) => Promise<Uint8Array | null>;\n\nexport type PersistedDocumentCreateState = Pick<\n  DocumentRecord,\n  | \"documentId\"\n  | \"contentKeyBundle\"\n  | \"documentKekTargets\"\n  | \"documentManifestBundle\"\n>;\n\nexport type PersistedDocumentSyncState = PersistedDocumentCreateState;\n\nexport interface UnwrappedContainerKek {\n  containerId: string;\n  /**\n   * Null for keyring-recovered historical keys, which carry key material and\n   * the epoch id committing to it but no epoch record to hash.\n   *\n   * Such a key still satisfies a parent wrap: the epoch-record fingerprint is\n   * a selector for choosing among envelopes, not the security boundary, so a\n   * null hash falls back to selecting on the epoch id while AEAD authenticates\n   * (see `containerKekPath.ts`). That is what lets a descendant pinned to a\n   * rotated parent be opened rather than stranded.\n   */\n  keyEpochHash: string | null;\n  keyMaterial: Uint8Array;\n}\n"]}

package/data/domainScope.d.ts

@@ -0,0 +1,6 @@
+declare const domainScopeBrand: unique symbol;
+export interface DomainScope {
+    readonly [domainScopeBrand]: true;
+}
+export declare function createDomainScope(): DomainScope;
+export {};

package/data/domainScope.js

@@ -0,0 +1,5 @@
+const domainScopeBrand = Symbol("tearleads.domainScope");
+export function createDomainScope() {
+    return { [domainScopeBrand]: true };
+}
+//# sourceMappingURL=domainScope.js.map

package/data/domainScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domainScope.js","sourceRoot":"","sources":["domainScope.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAQzD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAwB,CAAC;AAC5D,CAAC","sourcesContent":["const domainScopeBrand = Symbol(\"tearleads.domainScope\");\n\n// Identity token for in-process caches that must rotate together when the\n// active database or signing identity changes.\nexport interface DomainScope {\n  readonly [domainScopeBrand]: true;\n}\n\nexport function createDomainScope(): DomainScope {\n  return { [domainScopeBrand]: true } satisfies DomainScope;\n}\n"]}

package/data/errorMessage.js

@@ -0,0 +1,10 @@
+/**
+ * The one way this package renders an unknown thrown value for a log line or
+ * wrapped error message. Classifier code that matches known message strings
+ * (and must fail closed on non-Error throwables) should not use this — see
+ * isStaleContainerMetadataSecurityStateError and classifyHealBlockedReason.
+ */
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=errorMessage.js.map

package/data/errorMessage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorMessage.js","sourceRoot":"","sources":["errorMessage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The one way this package renders an unknown thrown value for a log line or\n * wrapped error message. Classifier code that matches known message strings\n * (and must fail closed on non-Error throwables) should not use this — see\n * isStaleContainerMetadataSecurityStateError and classifyHealBlockedReason.\n */\nexport function errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"]}

package/data/keyingCanonicalJson.js

@@ -0,0 +1,83 @@
+import { serializeKeyingCanonicalJson } from "../internal/crypto/index.js";
+import { isPlainObject } from "../internal/validators/isPlainObject.js";
+function isCanonicalJsonScalar(value) {
+    return (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value)));
+}
+function pushCanonicalJsonChildren(value, active, pending) {
+    if (Array.isArray(value)) {
+        if (active.has(value)) {
+            return false;
+        }
+        active.add(value);
+        pending.push({ leave: value });
+        for (let index = 0; index < value.length; index += 1) {
+            if (!(index in value)) {
+                return false;
+            }
+            pending.push({ value: value[index] });
+        }
+        return true;
+    }
+    if (!isPlainObject(value)) {
+        return false;
+    }
+    if (active.has(value)) {
+        return false;
+    }
+    active.add(value);
+    pending.push({ leave: value });
+    for (const key of Object.keys(value)) {
+        pending.push({ value: Reflect.get(value, key) });
+    }
+    return true;
+}
+function isCanonicalJson(value) {
+    const pending = [{ value }];
+    const active = new WeakSet();
+    while (pending.length > 0) {
+        const frame = pending.pop();
+        if (!frame) {
+            break;
+        }
+        if (frame.leave) {
+            active.delete(frame.leave);
+            continue;
+        }
+        const item = frame.value;
+        if (isCanonicalJsonScalar(item)) {
+            continue;
+        }
+        if (!pushCanonicalJsonChildren(item, active, pending)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function readCanonicalJson(value, label) {
+    if (!isCanonicalJson(value)) {
+        throw new Error(`${label} must be canonical JSON`);
+    }
+    return value;
+}
+export function readCanonicalRecord(value, label) {
+    if (!isPlainObject(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    readCanonicalJson(value, label);
+    return value;
+}
+export function readCanonicalRecords(values, label) {
+    return values.map((value, index) => readCanonicalRecord(value, `${label}[${index}]`));
+}
+/**
+ * Canonicalize-then-serialize, the one string form every keying equality
+ * check compares. Both halves are shared already; composing them per-file
+ * invited the composition itself to drift.
+ */
+export function canonicalKeyingJsonString(value, label) {
+    return serializeKeyingCanonicalJson(readCanonicalJson(value, label));
+}
+//# sourceMappingURL=keyingCanonicalJson.js.map

package/data/keyingCanonicalJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyingCanonicalJson.js","sourceRoot":"","sources":["keyingCanonicalJson.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAOpE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS;QAC1B,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,MAAuB,EACvB,OAA6B;IAE7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;IAErC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,KAAa;IAEb,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACjC,mBAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,4BAA4B,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import type { KeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\n\ninterface CanonicalJsonFrame {\n  leave?: object;\n  value?: unknown;\n}\n\nfunction isCanonicalJsonScalar(value: unknown): boolean {\n  return (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"boolean\" ||\n    (typeof value === \"number\" && Number.isFinite(value))\n  );\n}\n\nfunction pushCanonicalJsonChildren(\n  value: unknown,\n  active: WeakSet<object>,\n  pending: CanonicalJsonFrame[],\n): boolean {\n  if (Array.isArray(value)) {\n    if (active.has(value)) {\n      return false;\n    }\n    active.add(value);\n    pending.push({ leave: value });\n    for (let index = 0; index < value.length; index += 1) {\n      if (!(index in value)) {\n        return false;\n      }\n      pending.push({ value: value[index] });\n    }\n    return true;\n  }\n\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  if (active.has(value)) {\n    return false;\n  }\n  active.add(value);\n  pending.push({ leave: value });\n  for (const key of Object.keys(value)) {\n    pending.push({ value: Reflect.get(value, key) });\n  }\n  return true;\n}\n\nfunction isCanonicalJson(value: unknown): value is KeyingCanonicalJson {\n  const pending: CanonicalJsonFrame[] = [{ value }];\n  const active = new WeakSet<object>();\n\n  while (pending.length > 0) {\n    const frame = pending.pop();\n    if (!frame) {\n      break;\n    }\n    if (frame.leave) {\n      active.delete(frame.leave);\n      continue;\n    }\n\n    const item = frame.value;\n    if (isCanonicalJsonScalar(item)) {\n      continue;\n    }\n    if (!pushCanonicalJsonChildren(item, active, pending)) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\nexport function readCanonicalJson(\n  value: unknown,\n  label: string,\n): KeyingCanonicalJson {\n  if (!isCanonicalJson(value)) {\n    throw new Error(`${label} must be canonical JSON`);\n  }\n  return value;\n}\n\nexport function readCanonicalRecord(\n  value: unknown,\n  label: string,\n): Record<string, unknown> {\n  if (!isPlainObject(value)) {\n    throw new Error(`${label} must be an object`);\n  }\n  readCanonicalJson(value, label);\n  return value;\n}\n\nexport function readCanonicalRecords(\n  values: readonly unknown[],\n  label: string,\n): Record<string, unknown>[] {\n  return values.map((value, index) =>\n    readCanonicalRecord(value, `${label}[${index}]`),\n  );\n}\n\n/**\n * Canonicalize-then-serialize, the one string form every keying equality\n * check compares. Both halves are shared already; composing them per-file\n * invited the composition itself to drift.\n */\nexport function canonicalKeyingJsonString(\n  value: unknown,\n  label: string,\n): string {\n  return serializeKeyingCanonicalJson(readCanonicalJson(value, label));\n}\n"]}

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js

@@ -0,0 +1,57 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { advanceKeyingCheckpointsAtomically, validateKeyingCheckpointsAtomically, } from "../persistence/keyingCheckpointAdvancePersistence.js";
+function objectKey(manifest) {
+    const { objectKind, organizationId, objectId } = manifest.checkpoint;
+    return JSON.stringify([objectKind, organizationId, objectId]);
+}
+function manifestsByObject(manifests) {
+    const byObject = new Map();
+    for (const manifest of manifests) {
+        const key = objectKey(manifest);
+        let byHash = byObject.get(key);
+        if (!byHash) {
+            byHash = new Map();
+            byObject.set(key, byHash);
+        }
+        byHash.set(manifest.manifestHash, manifest);
+    }
+    return byObject;
+}
+function accessManifestCheckpointAdvances(input) {
+    const evidenceByObject = manifestsByObject(input.verifiedManifests);
+    const headsByObject = manifestsByObject(input.verifiedHeads);
+    const advances = [];
+    for (const [key, headsByHash] of headsByObject) {
+        if (headsByHash.size !== 1) {
+            throw new KeyingVerificationError("equivocation", `projection declares conflicting access manifest heads for ${key}`);
+        }
+        const head = headsByHash.values().next().value;
+        if (!head) {
+            continue;
+        }
+        const predecessors = [
+            ...(evidenceByObject.get(key)?.values() ?? []),
+        ].filter((manifest) => manifest.manifestHash !== head.manifestHash);
+        advances.push({ head, predecessors });
+    }
+    return advances;
+}
+export async function validateAccessManifestCheckpoints(input) {
+    await validateKeyingCheckpointsAtomically({
+        access: accessManifestCheckpointAdvances(input),
+        execSql: input.execSql,
+        policies: input.policies,
+        stillCurrent: input.stillCurrent,
+    });
+}
+export async function enforceAccessManifestCheckpoints(input) {
+    await advanceKeyingCheckpointsAtomically({
+        access: accessManifestCheckpointAdvances(input),
+        documentPurgeCheckpoint: input.documentPurgeCheckpoint,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: input.policies,
+        stillCurrent: input.stillCurrent,
+    });
+}
+//# sourceMappingURL=accessManifestCheckpointEnforcement.js.map

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,mDAAmD,CAAC;AAI3D,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAQtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../persistence/keyingCheckpointAdvancePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}