@tearleads/client-sdk 0.1.114 → 0.1.116

package/data/persistence/keyingCheckpoints/documentPurgeCheckpointPersistence.js

@@ -1,6 +1,7 @@
 import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { eq } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import { documentPurgeCheckpoints, keyingCheckpointTables, } from "../../sqlite/schema/index.js";
+import { sqliteRowsPerStatement } from "../../sqlite/sqliteBindBudget.js";
 import { getClientSQLitePersistenceRuntime } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
 export async function loadDocumentPurgeCheckpoint(execSql, documentId) {
@@ -26,6 +27,21 @@ export async function hasDocumentPurgeCheckpointInTransaction(tx, documentId) {
         .limit(1);
     return row !== undefined;
 }
+/** The document ids among `documentIds` that carry a purge checkpoint. */
+export async function listPurgedDocumentIdsInTransaction(tx, documentIds) {
+    const purged = new Set();
+    const unique = Array.from(new Set(documentIds));
+    const chunkSize = sqliteRowsPerStatement(1);
+    for (let offset = 0; offset < unique.length; offset += chunkSize) {
+        const rows = await tx
+            .select({ documentId: documentPurgeCheckpoints.documentId })
+            .from(documentPurgeCheckpoints)
+            .where(inArray(documentPurgeCheckpoints.documentId, unique.slice(offset, offset + chunkSize)));
+        for (const row of rows)
+            purged.add(row.documentId);
+    }
+    return purged;
+}
 export async function storeDocumentPurgeCheckpointInTransaction(tx, checkpoint, updatedAt) {
     const [stored] = await tx
         .select({

package/data/persistence/keyingCheckpoints/documentPurgeCheckpointPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentPurgeCheckpointPersistence.js","sourceRoot":"","sources":["documentPurgeCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AASvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,UAAkB;IAElB,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC;SAC3D,EAAE,CAAC,MAAM,CAAC;QACT,UAAU,EAAE,wBAAwB,CAAC,UAAU;QAC/C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,UAAkB;IAElB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,wBAAwB,CAAC,UAAU,EAAE,CAAC;SAC3D,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,UAAmC,EACnC,SAAiB;IAEjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;SACrE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,EAAE,CAAC;QACX,IACE,MAAM,CAAC,oBAAoB,KAAK,UAAU,CAAC,oBAAoB;YAC/D,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACnD,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc,EACnD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;SACpC,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport {\n  documentPurgeCheckpoints,\n  keyingCheckpointTables,\n} from \"../../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\n\nexport interface DocumentPurgeCheckpoint {\n  readonly documentId: string;\n  readonly documentManifestHash: string;\n  readonly organizationId: string;\n  readonly purgeEventHash: string;\n}\n\nexport async function loadDocumentPurgeCheckpoint(\n  execSql: ExecSql,\n  documentId: string,\n): Promise<DocumentPurgeCheckpoint | null> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n  const [row] = await getClientSQLitePersistenceRuntime(execSql)\n    .db.select({\n      documentId: documentPurgeCheckpoints.documentId,\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Whether the document was permanently purged, read in the caller's transaction. */\nexport async function hasDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  documentId: string,\n): Promise<boolean> {\n  const [row] = await tx\n    .select({ documentId: documentPurgeCheckpoints.documentId })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row !== undefined;\n}\n\nexport async function storeDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: DocumentPurgeCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const [stored] = await tx\n    .select({\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, checkpoint.documentId))\n    .limit(1);\n  if (stored) {\n    if (\n      stored.documentManifestHash !== checkpoint.documentManifestHash ||\n      stored.organizationId !== checkpoint.organizationId ||\n      stored.purgeEventHash !== checkpoint.purgeEventHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"Document purge checkpoint conflicts with the verified terminal event\",\n      );\n    }\n    return;\n  }\n  await tx\n    .insert(documentPurgeCheckpoints)\n    .values({ ...checkpoint, updatedAt })\n    .run();\n}\n"]}
+{"version":3,"file":"documentPurgeCheckpointPersistence.js","sourceRoot":"","sources":["documentPurgeCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AASvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,UAAkB;IAElB,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC;SAC3D,EAAE,CAAC,MAAM,CAAC;QACT,UAAU,EAAE,wBAAwB,CAAC,UAAU;QAC/C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,UAAkB;IAElB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,wBAAwB,CAAC,UAAU,EAAE,CAAC;SAC3D,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,EAAgC,EAChC,WAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC5C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,wBAAwB,CAAC,UAAU,EAAE,CAAC;aAC3D,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,OAAO,CACL,wBAAwB,CAAC,UAAU,EACnC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CACzC,CACF,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,UAAmC,EACnC,SAAiB;IAEjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;SACrE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,EAAE,CAAC;QACX,IACE,MAAM,CAAC,oBAAoB,KAAK,UAAU,CAAC,oBAAoB;YAC/D,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACnD,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc,EACnD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;SACpC,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { eq, inArray } from \"drizzle-orm\";\nimport {\n  documentPurgeCheckpoints,\n  keyingCheckpointTables,\n} from \"../../sqlite/schema\";\nimport { sqliteRowsPerStatement } from \"../../sqlite/sqliteBindBudget\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\n\nexport interface DocumentPurgeCheckpoint {\n  readonly documentId: string;\n  readonly documentManifestHash: string;\n  readonly organizationId: string;\n  readonly purgeEventHash: string;\n}\n\nexport async function loadDocumentPurgeCheckpoint(\n  execSql: ExecSql,\n  documentId: string,\n): Promise<DocumentPurgeCheckpoint | null> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n  const [row] = await getClientSQLitePersistenceRuntime(execSql)\n    .db.select({\n      documentId: documentPurgeCheckpoints.documentId,\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Whether the document was permanently purged, read in the caller's transaction. */\nexport async function hasDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  documentId: string,\n): Promise<boolean> {\n  const [row] = await tx\n    .select({ documentId: documentPurgeCheckpoints.documentId })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row !== undefined;\n}\n\n/** The document ids among `documentIds` that carry a purge checkpoint. */\nexport async function listPurgedDocumentIdsInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  documentIds: ReadonlyArray<string>,\n): Promise<Set<string>> {\n  const purged = new Set<string>();\n  const unique = Array.from(new Set(documentIds));\n  const chunkSize = sqliteRowsPerStatement(1);\n  for (let offset = 0; offset < unique.length; offset += chunkSize) {\n    const rows = await tx\n      .select({ documentId: documentPurgeCheckpoints.documentId })\n      .from(documentPurgeCheckpoints)\n      .where(\n        inArray(\n          documentPurgeCheckpoints.documentId,\n          unique.slice(offset, offset + chunkSize),\n        ),\n      );\n    for (const row of rows) purged.add(row.documentId);\n  }\n  return purged;\n}\n\nexport async function storeDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: DocumentPurgeCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const [stored] = await tx\n    .select({\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, checkpoint.documentId))\n    .limit(1);\n  if (stored) {\n    if (\n      stored.documentManifestHash !== checkpoint.documentManifestHash ||\n      stored.organizationId !== checkpoint.organizationId ||\n      stored.purgeEventHash !== checkpoint.purgeEventHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"Document purge checkpoint conflicts with the verified terminal event\",\n      );\n    }\n    return;\n  }\n  await tx\n    .insert(documentPurgeCheckpoints)\n    .values({ ...checkpoint, updatedAt })\n    .run();\n}\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -1134,6 +1134,124 @@ export declare class ApiClient {
             version: number;
         };
     }>, void, any>;
+    /** Unpinned discovery; `ifHead` asks for a bare head when it is still live. */
+    getPrincipalPolicyDiscovery(...args: Parameters<PrincipalPolicyRequests["discover"]>): Promise<RequestResult<{
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        historyPage: {
+            afterVersion: number;
+            nextAfterVersion: number | null;
+        };
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | {
+        unchanged: true;
+        head: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+            version: number;
+        };
+    }>>;
     getProjectionPolicyHistoryPages(...args: Parameters<PrincipalPolicyRequests["publicPages"]>): AsyncGenerator<RequestResult<{
         currentGrants: {
             accessLevel: "admin" | "read" | "write";

package/internal/api-client/ApiClient.js

@@ -271,6 +271,10 @@ export class ApiClient {
     getPrincipalPolicyPages(principalType, principalId, options = {}) {
         return this.principalPolicyRequests.pages(principalType, principalId, options);
     }
+    /** Unpinned discovery; `ifHead` asks for a bare head when it is still live. */
+    getPrincipalPolicyDiscovery(...args) {
+        return this.principalPolicyRequests.discover(...args);
+    }
     getProjectionPolicyHistoryPages(...args) {
         return this.principalPolicyRequests.publicPages(...args);
     }