@tearleads/client-sdk 0.1.116 → 0.1.118
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/data/keyingProjectionVerification/checkpoints/checkpointContext.d.ts +8 -1
- package/data/keyingProjectionVerification/checkpoints/checkpointContext.js +15 -0
- package/data/keyingProjectionVerification/checkpoints/checkpointContext.js.map +1 -1
- package/data/keyingProjectionVerification/container/containerProjectionVerification.js +3 -1
- package/data/keyingProjectionVerification/container/containerProjectionVerification.js.map +1 -1
- package/data/keyingProjectionVerification/document/documentProjectionVerification.js +2 -1
- package/data/keyingProjectionVerification/document/documentProjectionVerification.js.map +1 -1
- package/data/persistence/container-contents/containerContentsPersistence.js +14 -13
- package/data/persistence/container-contents/containerContentsPersistence.js.map +1 -1
- package/data/persistence/documents/internal/ensureDocumentsSchema.js +10 -12
- package/data/persistence/documents/internal/ensureDocumentsSchema.js.map +1 -1
- package/data/persistence/verifiedCitations/citationScope.js +121 -0
- package/data/persistence/verifiedCitations/citationScope.js.map +1 -0
- package/data/persistence/verifiedCitations/kekLevelCitations.d.ts +33 -0
- package/data/persistence/verifiedCitations/kekLevelCitations.js +44 -0
- package/data/persistence/verifiedCitations/kekLevelCitations.js.map +1 -0
- package/data/persistence/verifiedManifestBundlePersistence.d.ts +17 -12
- package/data/persistence/verifiedManifestBundlePersistence.js +75 -104
- package/data/persistence/verifiedManifestBundlePersistence.js.map +1 -1
- package/data/sqlite/schema/containerSchema.d.ts +1 -0
- package/data/sqlite/schema/containerSchema.js +8 -1
- package/data/sqlite/schema/containerSchema.js.map +1 -1
- package/data/sqlite/schema/documentAttachmentSchema.d.ts +0 -2
- package/data/sqlite/schema/documentAttachmentSchema.js +0 -4
- package/data/sqlite/schema/documentAttachmentSchema.js.map +1 -1
- package/data/sqlite/schema/index.d.ts +2 -0
- package/data/sqlite/schema/index.js +10 -1
- package/data/sqlite/schema/index.js.map +1 -1
- package/data/sqlite/schema/principalPolicySchema.js +0 -1
- package/data/sqlite/schema/principalPolicySchema.js.map +1 -1
- package/data/sqlite/schema/verifiedManifestBundleSchema.d.ts +7 -2
- package/data/sqlite/schema/verifiedManifestBundleSchema.js +11 -4
- package/data/sqlite/schema/verifiedManifestBundleSchema.js.map +1 -1
- package/data/sqlite/sqlExec.d.ts +12 -0
- package/data/sqlite/sqlExec.js +47 -3
- package/data/sqlite/sqlExec.js.map +1 -1
- package/data/sqlite/sqlTableSchema.js +40 -15
- package/data/sqlite/sqlTableSchema.js.map +1 -1
- package/data/sqlite/sqlitePersistenceRuntime.js +18 -10
- package/data/sqlite/sqlitePersistenceRuntime.js.map +1 -1
- package/internal/api-client/ApiClient.d.ts +3 -2
- package/internal/api-client/ApiClient.js +3 -2
- package/internal/api-client/ApiClient.js.map +1 -1
- package/internal/api-client/index.d.ts +1 -1
- package/internal/api-client/index.js.map +1 -1
- package/internal/api-client/types.d.ts +7 -0
- package/internal/api-client/types.js.map +1 -1
- package/internal/api-client/verifiedManifestCitations.d.ts +26 -9
- package/internal/api-client/verifiedManifestCitations.js +44 -25
- package/internal/api-client/verifiedManifestCitations.js.map +1 -1
- package/internal/api-client/writerProjectionRequests.js +21 -10
- package/internal/api-client/writerProjectionRequests.js.map +1 -1
- package/internal/crypto/index.d.ts +1 -1
- package/internal/crypto/index.js +1 -1
- package/internal/crypto/index.js.map +1 -1
- package/internal/crypto/keying/canonicalJsonGuard.d.ts +7 -0
- package/internal/crypto/keying/canonicalJsonGuard.js +20 -0
- package/internal/crypto/keying/canonicalJsonGuard.js.map +1 -1
- package/internal/crypto/keying/index.d.ts +1 -1
- package/internal/crypto/keying/index.js +1 -1
- package/internal/crypto/keying/index.js.map +1 -1
- package/internal/validators/knownManifestsRefinements.js +1 -1
- package/internal/validators/knownManifestsRefinements.js.map +1 -1
- package/internal/validators/operation/writerProjections.d.ts +42 -18
- package/internal/validators/response/container.d.ts +137 -16
- package/internal/validators/response/container.js +23 -2
- package/internal/validators/response/container.js.map +1 -1
- package/internal/validators/response/documentMutation.d.ts +20 -8
- package/internal/validators/response/index.d.ts +2 -2
- package/internal/validators/response/index.js +2 -2
- package/internal/validators/response/index.js.map +1 -1
- package/internal/validators/response/writerProjectionWire.d.ts +19 -8
- package/internal/validators/response/writerProjectionWire.js +78 -20
- package/internal/validators/response/writerProjectionWire.js.map +1 -1
- package/internal/validators/util/index.d.ts +1 -1
- package/internal/validators/util/index.js +1 -1
- package/internal/validators/util/index.js.map +1 -1
- package/internal/validators/util/knownManifestWire.d.ts +13 -3
- package/internal/validators/util/knownManifestWire.js +37 -10
- package/internal/validators/util/knownManifestWire.js.map +1 -1
- package/package.json +1 -1
- package/workflows/container-contents/remoteHydration/destination/destinationPrefetch.js +10 -5
- package/workflows/container-contents/remoteHydration/destination/destinationPrefetch.js.map +1 -1
- package/workflows/container-contents/remoteHydration/remoteContainers/remoteContainerPageHydration.js +4 -6
- package/workflows/container-contents/remoteHydration/remoteContainers/remoteContainerPageHydration.js.map +1 -1
- package/workflows/container-contents/remoteHydration/types.d.ts +2 -2
- package/workflows/container-contents/remoteHydration/types.js.map +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifiedManifestBundlePersistence.js","sourceRoot":"","sources":["verifiedManifestBundlePersistence.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAEL,kCAAkC,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,6BAA6B,IAAI,OAAO,EACxC,4BAA4B,GAC7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,eAAe,GAAG,GAAG,CAAC;AAY5B,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/D,SAAS,MAAM,CAAI,MAAoB,EAAE,IAAY;IACnD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI;QACtD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAI,MAAoB;IACtC,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAgC;IAEhC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,6BAA6B,CAAC;IACjE,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;SAC9C,IAAI,CAAC,OAAO,CAAC;SACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;SAC3D,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/E,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0C;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAC3D,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU;YACV,YAAY,EAAE,MAAM,SAAS,CAAC,UAAU,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,IAA0C,EAC1C,UAAkB;IAElB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC,CAAC;IACF,4DAA4D;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,YAAY,CAC3D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;aACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;aAC3C,GAAG,EAAE,CAAC;IACX,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC;SAClE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAC5D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,YAAY;YAC5B,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC;gBACrD,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACzC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;gBACjD,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9C;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,gBAAgB,CAC7B,EAAwB,EACxB,WAAmB;IAEnB,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;aACzC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM;QACnD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,EAAwB,EACxB,MAA8B;IAE9B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAC7B,OAAO,CAAC,MAAM,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,EAAE,WAAW;YACjB,EAAE;SACH,CAAC,CAAC,CAAC;IACN,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,EAAE;aACT,MAAM,CAAC,EAAE,WAAW,EAAE,2BAA2B,CAAC,WAAW,EAAE,CAAC;aAChE,IAAI,CAAC,2BAA2B,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,EAAE;aACT,MAAM,CAAC,EAAE,WAAW,EAAE,0BAA0B,CAAC,WAAW,EAAE,CAAC;aAC/D,IAAI,CAAC,0BAA0B,CAAC;aAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,EAAE;aACT,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;KACxD,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,EAAE,WAAW,EAAE,IAAI,UAAU;QACtC,IAAI,WAAW;YACb,KAAK,MAAM,EAAE,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC;gBACtD,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO;QACL,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;QACnC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,MAA8B,EAC9B,OAAkE;IAElE,MAAM,YAAY,GAAG,OAAO;SACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;SAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;aACrD,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACrD,MAAM,kBAAkB,GACtB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;aAClD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,EACnC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CACxC,CACF,CAAC;IACV,MAAM,cAAc,GAAG,MAAM,EAAE;SAC5B,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAClD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC1E,CAAC;IACJ,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,cAAc,EAAE,sBAAsB,CAAC,cAAc,EAAE,CAAC;aACjE,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAChD,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,GAAG,aAAa,CAAC;IACvC,OAAO,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAQD,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,UAAU,EAAE,OAAO,CAAC,UAAU;IAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;CACnC,CAAC;AAEF,KAAK,UAAU,gBAAgB,CAC7B,GAAoB;IAEpB,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,kCAAkC,CAAC,MAAM,CAAC;YAC/C,MAAM,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;YACxC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,EAAwB,EACxB,cAAsB,EACtB,MAAsD,EACtD,KAAa;IAEb,OAAO,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,EAC1C,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EACnC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAChC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,EAAwB,EACxB,cAAsB,EACtB,KAAa;IAEb,OAAO,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACjD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;SAC5D,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,MAA8B,EAC9B,KAAK,GAAG,yBAAyB;IAEjC,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,4BAA4B;QAC/B,GAAG,eAAe;QAClB,GAAG,iCAAiC;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4C,CAAC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,IAAgC,EAAE,EAAE;QACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAS;YACjE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO;QAC1B,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;YACpB,MAAM,OAAO,CACX,MAAM,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CACjE,CAAC;IACN,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;QACpB,MAAM,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,MAAM,iCAAiC,CAAC,OAAO,CAAC;aAC7C,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CACtB,MAAM;aACH,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;aAC7C,GAAG,EAAE,CACT;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,+BAA+B,CAC7C,cAAoC;IAEpC,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,cAAsB;IAEtB,MAAM,EAAE;SACL,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACjD,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import type {\n VerifiedManifestCitations,\n WriterProjectionTarget,\n} from \"@tearleads/api-client\";\nimport { toFingerprint } from \"@tearleads/crypto\";\nimport {\n type AccessManifestBundleWireResponse,\n isAccessManifestBundleWireResponse,\n} from \"@tearleads/validators/response\";\nimport {\n KNOWN_MANIFEST_HINT_LIMIT,\n MAX_CONTAINER_PATH_LENGTH,\n} from \"@tearleads/validators/util\";\nimport { and, asc, desc, eq, inArray, sql } from \"drizzle-orm\";\nimport {\n containerTables,\n documentContainerProjection,\n documentContainerProjectionTables,\n} from \"../sqlite/schema\";\nimport { containers } from \"../sqlite/schema/containerSchema\";\nimport {\n documentDiscoveryHeads,\n pendingDocumentDiscoveries,\n} from \"../sqlite/schema/documentDiscoveryEvidenceSchema\";\nimport {\n verifiedAccessManifestBundles as bundles,\n verifiedManifestBundleTables,\n} from \"../sqlite/schema/verifiedManifestBundleSchema\";\nimport { sqliteInsertBatchSize } from \"../sqlite/sqliteBindBudget\";\nimport {\n type ClientSQLiteDatabase,\n type ClientSQLiteTransactionScope,\n getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\n/**\n * Bounds local bytes (a bundle is ~10–20 KB). Evicting the least recently\n * verified rows only makes a later read carry those bundles again.\n */\nexport const MAX_VERIFIED_MANIFEST_BUNDLES = 1024;\nconst STATEMENT_BATCH = 200;\n\nexport interface VerifiedManifestBundle {\n readonly bundle: AccessManifestBundleWireResponse;\n readonly checkpoint: {\n readonly objectKind: string;\n readonly organizationId: string;\n readonly objectId: string;\n readonly epoch: number;\n };\n}\n\nfunction sha256Hex(text: string): Promise<string> {\n return toFingerprint(new TextEncoder().encode(text));\n}\n\nconst BUNDLE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(bundles);\n\nfunction slices<T>(values: readonly T[], size: number): T[][] {\n const result: T[][] = [];\n for (let index = 0; index < values.length; index += size)\n result.push(values.slice(index, index + size));\n return result;\n}\n\nfunction batches<T>(values: readonly T[]): T[][] {\n return slices(values, STATEMENT_BATCH);\n}\n\nasync function pruneInTransaction(\n tx: ClientSQLiteTransactionScope,\n): Promise<void> {\n const [row] = await tx.select({ count: sql<number>`count(*)` }).from(bundles);\n const excess = (row?.count ?? 0) - MAX_VERIFIED_MANIFEST_BUNDLES;\n if (excess <= 0) return;\n const evicted = await tx\n .select({ manifestHash: bundles.manifestHash })\n .from(bundles)\n .orderBy(asc(bundles.verifiedAt), asc(bundles.manifestHash))\n .limit(excess);\n for (const batch of batches(evicted.map((entry) => entry.manifestHash)))\n await tx.delete(bundles).where(inArray(bundles.manifestHash, batch)).run();\n}\n\n/** A verified bundle's exact JSON and that JSON's digest. */\nexport type VerifiedManifestBundleRow = Omit<\n typeof bundles.$inferInsert,\n \"verifiedAt\"\n>;\n\n/**\n * Prepares rows for bundles that just passed projection verification. The\n * digests are computed here, before the checkpoint transaction that writes\n * them begins.\n */\nexport function verifiedManifestBundleRows(\n entries: readonly VerifiedManifestBundle[],\n): Promise<VerifiedManifestBundleRow[]> {\n const unique = new Map(\n entries.map((entry) => [entry.bundle.manifestHash, entry]),\n );\n return Promise.all(\n [...unique.values()].map(async ({ bundle, checkpoint }) => {\n const bundleJson = JSON.stringify(bundle);\n return {\n manifestHash: bundle.manifestHash,\n organizationId: checkpoint.organizationId,\n objectKind: checkpoint.objectKind,\n objectId: checkpoint.objectId,\n epoch: checkpoint.epoch,\n bundleJson,\n bundleDigest: await sha256Hex(bundleJson),\n };\n }),\n );\n}\n\n/**\n * Records verified bundles inside the transaction that finalizes their\n * projection's checkpoints, so they commit or roll back with it and no cache\n * work outlives the verification. Freshly verified bytes replace any stored\n * copy.\n */\nexport async function writeVerifiedManifestBundlesInTransaction(\n tx: ClientSQLiteTransactionScope,\n rows: readonly VerifiedManifestBundleRow[],\n verifiedAt: string,\n): Promise<void> {\n if (rows.length === 0) return;\n const stored = await storedDigests(\n tx,\n rows.map((row) => row.manifestHash),\n );\n // An identical stored row only needs its recency refreshed.\n const unchanged = rows.filter(\n (row) => stored.get(row.manifestHash) === row.bundleDigest,\n );\n for (const batch of batches(unchanged.map((row) => row.manifestHash)))\n await tx\n .update(bundles)\n .set({ verifiedAt })\n .where(inArray(bundles.manifestHash, batch))\n .run();\n // A repeated hash keeps its last changed row, as sequential upserts would.\n const changed = new Map(\n rows\n .filter((row) => stored.get(row.manifestHash) !== row.bundleDigest)\n .map((row) => [row.manifestHash, { ...row, verifiedAt }]),\n );\n for (const batch of slices([...changed.values()], BUNDLE_WRITE_BATCH_SIZE))\n await tx\n .insert(bundles)\n .values(batch)\n .onConflictDoUpdate({\n target: bundles.manifestHash,\n set: {\n organizationId: excludedValue(bundles.organizationId),\n objectKind: excludedValue(bundles.objectKind),\n objectId: excludedValue(bundles.objectId),\n epoch: excludedValue(bundles.epoch),\n bundleJson: excludedValue(bundles.bundleJson),\n bundleDigest: excludedValue(bundles.bundleDigest),\n verifiedAt: excludedValue(bundles.verifiedAt),\n },\n })\n .run();\n await pruneInTransaction(tx);\n}\n\nasync function storedDigests(\n tx: ClientSQLiteTransactionScope,\n manifestHashes: readonly string[],\n): Promise<Map<string, string>> {\n const digests = new Map<string, string>();\n for (const batch of batches(manifestHashes)) {\n const rows = await tx\n .select({\n bundleDigest: bundles.bundleDigest,\n manifestHash: bundles.manifestHash,\n })\n .from(bundles)\n .where(inArray(bundles.manifestHash, batch));\n for (const row of rows) digests.set(row.manifestHash, row.bundleDigest);\n }\n return digests;\n}\n\n/** The requested object first, then each container whose lineage it cites. */\nasync function containerLineage(\n db: ClientSQLiteDatabase,\n containerId: string,\n): Promise<string[]> {\n const lineage = [containerId];\n while (lineage.length < MAX_CONTAINER_PATH_LENGTH) {\n const [row] = await db\n .select({ parentId: containers.parentId })\n .from(containers)\n .where(eq(containers.id, lineage.at(-1) ?? \"\"))\n .limit(1);\n const parentId = row?.parentId;\n if (!parentId || lineage.includes(parentId)) break;\n lineage.push(parentId);\n }\n return lineage;\n}\n\nasync function citedObjects(\n db: ClientSQLiteDatabase,\n target: WriterProjectionTarget,\n): Promise<{ readonly kind: string; readonly id: string }[]> {\n if (target.kind === \"container\")\n return (await containerLineage(db, target.id)).map((id) => ({\n kind: \"container\",\n id,\n }));\n // Linked containers, containers listing the document before its signed\n // placement is checked, and a container whose metadata document it is.\n const placements = [\n ...(await db\n .select({ containerId: documentContainerProjection.containerId })\n .from(documentContainerProjection)\n .where(eq(documentContainerProjection.documentId, target.id))),\n ...(await db\n .select({ containerId: pendingDocumentDiscoveries.containerId })\n .from(pendingDocumentDiscoveries)\n .where(eq(pendingDocumentDiscoveries.documentId, target.id))),\n ...(await db\n .select({ containerId: containers.id })\n .from(containers)\n .where(eq(containers.metadataDocumentId, target.id))),\n ];\n const containerIds = new Set<string>();\n for (const { containerId } of placements)\n if (containerId)\n for (const id of await containerLineage(db, containerId))\n containerIds.add(id);\n return [\n { kind: \"document\", id: target.id },\n ...[...containerIds].map((id) => ({ kind: \"container\", id })),\n ];\n}\n\n/**\n * The one organization every local source places the read in. Verified\n * ownership (stored verified bundles of the target and of the containers on\n * its walk, and a document's verified discovery head) and local placement\n * (listed container rows reached through links, pending listings, metadata,\n * or parents) must all agree: any disagreement, or no source at all, yields\n * null, so the read is sent with no hints rather than another\n * organization's.\n */\nasync function targetOrganization(\n db: ClientSQLiteDatabase,\n target: WriterProjectionTarget,\n objects: readonly { readonly kind: string; readonly id: string }[],\n): Promise<string | null> {\n const containerIds = objects\n .filter((object) => object.kind === \"container\")\n .map((object) => object.id);\n const listed =\n containerIds.length === 0\n ? []\n : await db\n .select({ organizationId: containers.organizationId })\n .from(containers)\n .where(inArray(containers.id, containerIds));\n const verifiedContainers =\n containerIds.length === 0\n ? []\n : await db\n .select({ organizationId: bundles.organizationId })\n .from(bundles)\n .where(\n and(\n eq(bundles.objectKind, \"container\"),\n inArray(bundles.objectId, containerIds),\n ),\n );\n const verifiedTarget = await db\n .select({ organizationId: bundles.organizationId })\n .from(bundles)\n .where(\n and(eq(bundles.objectKind, target.kind), eq(bundles.objectId, target.id)),\n );\n const discovered =\n target.kind === \"document\"\n ? await db\n .select({ organizationId: documentDiscoveryHeads.organizationId })\n .from(documentDiscoveryHeads)\n .where(eq(documentDiscoveryHeads.documentId, target.id))\n : [];\n const sources = [listed, verifiedContainers, verifiedTarget, discovered];\n const organizations = new Set(\n sources.flat().map((row) => row.organizationId),\n );\n const [organizationId] = organizations;\n return organizations.size === 1 && organizationId ? organizationId : null;\n}\n\ninterface StoredBundleRow {\n readonly bundleDigest: string;\n readonly bundleJson: string;\n readonly manifestHash: string;\n}\n\nconst storedColumns = {\n bundleDigest: bundles.bundleDigest,\n bundleJson: bundles.bundleJson,\n manifestHash: bundles.manifestHash,\n};\n\nasync function readStoredBundle(\n row: StoredBundleRow,\n): Promise<AccessManifestBundleWireResponse | null> {\n if ((await sha256Hex(row.bundleJson)) !== row.bundleDigest) return null;\n try {\n const bundle: unknown = JSON.parse(row.bundleJson);\n return isAccessManifestBundleWireResponse(bundle) &&\n bundle.manifestHash === row.manifestHash\n ? bundle\n : null;\n } catch {\n return null;\n }\n}\n\nfunction objectRows(\n db: ClientSQLiteDatabase,\n organizationId: string,\n object: { readonly kind: string; readonly id: string },\n limit: number,\n) {\n return db\n .select(storedColumns)\n .from(bundles)\n .where(\n and(\n eq(bundles.organizationId, organizationId),\n eq(bundles.objectKind, object.kind),\n eq(bundles.objectId, object.id),\n ),\n )\n .orderBy(desc(bundles.epoch))\n .limit(limit);\n}\n\nfunction recentRows(\n db: ClientSQLiteDatabase,\n organizationId: string,\n limit: number,\n) {\n return db\n .select(storedColumns)\n .from(bundles)\n .where(eq(bundles.organizationId, organizationId))\n .orderBy(desc(bundles.verifiedAt), asc(bundles.manifestHash))\n .limit(limit);\n}\n\n/**\n * Verified bundles of the target's object and of the containers its\n * projection walks, newest epochs first; then the most recently verified rows\n * of its organization, since a just-verified parent is the likeliest part of\n * a new child's projection. Citations never leave the target's organization:\n * an object whose organization the device cannot place cites nothing.\n * Damaged rows are dropped.\n */\nexport async function loadVerifiedManifestCitations(\n execSql: ExecSql,\n target: WriterProjectionTarget,\n limit = KNOWN_MANIFEST_HINT_LIMIT,\n): Promise<AccessManifestBundleWireResponse[]> {\n await ensureSqlTables(execSql, [\n ...verifiedManifestBundleTables,\n ...containerTables,\n ...documentContainerProjectionTables,\n ]);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const cited = new Map<string, AccessManifestBundleWireResponse>();\n const damaged: string[] = [];\n const collect = async (rows: readonly StoredBundleRow[]) => {\n for (const row of rows) {\n if (cited.size >= limit || cited.has(row.manifestHash)) continue;\n const bundle = await readStoredBundle(row);\n if (bundle) cited.set(row.manifestHash, bundle);\n else damaged.push(row.manifestHash);\n }\n };\n const objects = await citedObjects(db, target);\n const organizationId = await targetOrganization(db, target, objects);\n if (organizationId === null) return [];\n for (const object of objects)\n if (cited.size < limit)\n await collect(\n await objectRows(db, organizationId, object, limit - cited.size),\n );\n if (cited.size < limit)\n await collect(await recentRows(db, organizationId, limit + cited.size));\n if (damaged.length > 0)\n await getClientSQLitePersistenceRuntime(execSql)\n .runMutation((handle) =>\n handle\n .delete(bundles)\n .where(inArray(bundles.manifestHash, damaged))\n .run(),\n )\n .catch(() => undefined);\n return [...cited.values()];\n}\n\n/** Cites from whichever database the signed-in identity currently uses. */\nexport function createVerifiedManifestCitations(\n resolveExecSql: () => ExecSql | null,\n): VerifiedManifestCitations {\n return {\n cite: async (target) => {\n const execSql = resolveExecSql();\n return execSql ? loadVerifiedManifestCitations(execSql, target) : [];\n },\n };\n}\n\n/** Drops an organization's verified bundles when a remote reset forgets it. */\nexport async function deleteVerifiedManifestBundlesForOrganization(\n tx: ClientSQLiteTransactionScope,\n organizationId: string,\n): Promise<void> {\n await tx\n .delete(bundles)\n .where(eq(bundles.organizationId, organizationId))\n .run();\n}\n"]}
|
|
1
|
+
{"version":3,"file":"verifiedManifestBundlePersistence.js","sourceRoot":"","sources":["verifiedManifestBundlePersistence.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAEL,kCAAkC,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,iCAAiC,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,IAAI,OAAO,EACxC,4BAA4B,GAC7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAEL,YAAY,EACZ,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GAEnB,MAAM,uCAAuC,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,eAAe,GAAG,GAAG,CAAC;AAe5B,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/D,SAAS,MAAM,CAAI,MAAoB,EAAE,IAAY;IACnD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI;QACtD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAI,MAAoB;IACtC,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAgC;IAEhC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,6BAA6B,CAAC;IACjE,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;SAC9C,IAAI,CAAC,OAAO,CAAC;SACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;SAC3D,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/E,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA0C;IAE1C,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO;QACzB,IAAI,UAAU,IAAI,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC7C,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;YAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,OAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAC3D,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU;YACV,YAAY,EAAE,MAAM,SAAS,CAAC,UAAU,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,IAA0C,EAC1C,UAAkB;IAElB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC,CAAC;IACF,4DAA4D;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,YAAY,CAC3D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;aACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;aAC3C,GAAG,EAAE,CAAC;IACX,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC;SAClE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAC5D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,YAAY;YAC5B,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC;gBACrD,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACzC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;gBACjD,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9C;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,EAAgC,EAChC,IAA0C;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,qBAAqB,CAAC,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC7C,OAAO,CACL,OAAO,CAAC,QAAQ,EAChB,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CACjC,EACD,UAAU,CACR,OAAO,CAAC,YAAY,EACpB,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACrC,CACF,CACF;aACA,GAAG,EAAE,CAAC;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,UAAU,EAAE,OAAO,CAAC,UAAU;IAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;CACnC,CAAC;AAEF,KAAK,UAAU,gBAAgB,CAC7B,GAAoB;IAEpB,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,kCAAkC,CAAC,MAAM,CAAC;YAC/C,MAAM,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;YACxC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,EAAwB,EACxB,cAAsB,EACtB,MAAmB,EACnB,KAAa;IAEb,OAAO,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,EAC1C,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EACnC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAChC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,EAAwB,EACxB,cAAsB,EACtB,KAAa;IAEb,OAAO,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,EAC1C,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAC9C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;SAC5D,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,gBAAgB,CAC7B,EAAwB,EACxB,cAAsB,EACtB,OAA+B;IAE/B,MAAM,YAAY,GAAG,OAAO;SACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;SAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SACxD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,EAC1C,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC7C,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CACxC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,IAAI;QACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,MAA8B,EAC9B,KAAK,GAAG,yBAAyB;IAEjC,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,4BAA4B;QAC/B,GAAG,eAAe;QAClB,GAAG,iCAAiC;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,IAAgC,EAAE,EAAE;QACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAS;YACjE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM;QAC/B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;;YACzC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAC1B,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;YACpB,MAAM,OAAO,CACX,MAAM,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CACjE,CAAC;IACN,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;QACpB,MAAM,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,MAAM,iCAAiC,CAAC,OAAO,CAAC;aAC7C,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CACtB,MAAM;aACH,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;aAC7C,GAAG,EAAE,CACT;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,+BAA+B,CAC7C,cAAoC;IAEpC,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,cAAsB;IAEtB,MAAM,EAAE;SACL,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACjD,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import type {\n HeldProjectionCitation,\n VerifiedManifestCitations,\n WriterProjectionTarget,\n} from \"@tearleads/api-client\";\nimport { toFingerprint } from \"@tearleads/crypto\";\nimport {\n type AccessManifestBundleWireResponse,\n isAccessManifestBundleWireResponse,\n} from \"@tearleads/validators/response\";\nimport { KNOWN_MANIFEST_HINT_LIMIT } from \"@tearleads/validators/util\";\nimport { and, asc, desc, eq, inArray, ne, notInArray, sql } from \"drizzle-orm\";\nimport {\n containerTables,\n documentContainerProjectionTables,\n} from \"../sqlite/schema\";\nimport {\n verifiedAccessManifestBundles as bundles,\n verifiedManifestBundleTables,\n} from \"../sqlite/schema/verifiedManifestBundleSchema\";\nimport { sqliteInsertBatchSize } from \"../sqlite/sqliteBindBudget\";\nimport {\n type ClientSQLiteDatabase,\n type ClientSQLiteTransactionScope,\n getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n type CitedObject,\n citedObjects,\n targetOrganization,\n} from \"./verifiedCitations/citationScope\";\nimport {\n KEK_LEVEL_OBJECT_KIND,\n kekLevelRow,\n readStoredKekLevel,\n type VerifiedKekLevel,\n} from \"./verifiedCitations/kekLevelCitations\";\n\n/**\n * Bounds local bytes (a bundle is ~10–20 KB). Evicting the least recently\n * verified rows only makes a later read carry those bundles again.\n */\nexport const MAX_VERIFIED_MANIFEST_BUNDLES = 1024;\nconst STATEMENT_BATCH = 200;\n\ninterface VerifiedBundle {\n readonly bundle: AccessManifestBundleWireResponse;\n readonly checkpoint: {\n readonly objectKind: string;\n readonly organizationId: string;\n readonly objectId: string;\n readonly epoch: number;\n };\n}\n\n/** Bytes a projection verification accepted: a bundle or a KEK level. */\nexport type VerifiedManifestBundle = VerifiedBundle | VerifiedKekLevel;\n\nfunction sha256Hex(text: string): Promise<string> {\n return toFingerprint(new TextEncoder().encode(text));\n}\n\nconst BUNDLE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(bundles);\n\nfunction slices<T>(values: readonly T[], size: number): T[][] {\n const result: T[][] = [];\n for (let index = 0; index < values.length; index += size)\n result.push(values.slice(index, index + size));\n return result;\n}\n\nfunction batches<T>(values: readonly T[]): T[][] {\n return slices(values, STATEMENT_BATCH);\n}\n\nasync function pruneInTransaction(\n tx: ClientSQLiteTransactionScope,\n): Promise<void> {\n const [row] = await tx.select({ count: sql<number>`count(*)` }).from(bundles);\n const excess = (row?.count ?? 0) - MAX_VERIFIED_MANIFEST_BUNDLES;\n if (excess <= 0) return;\n const evicted = await tx\n .select({ manifestHash: bundles.manifestHash })\n .from(bundles)\n .orderBy(asc(bundles.verifiedAt), asc(bundles.manifestHash))\n .limit(excess);\n for (const batch of batches(evicted.map((entry) => entry.manifestHash)))\n await tx.delete(bundles).where(inArray(bundles.manifestHash, batch)).run();\n}\n\n/** A verified bundle's exact JSON and that JSON's digest. */\nexport type VerifiedManifestBundleRow = Omit<\n typeof bundles.$inferInsert,\n \"verifiedAt\"\n>;\n\n/**\n * Prepares rows for bundles and KEK levels that just passed projection\n * verification. The digests are computed here, before the checkpoint\n * transaction that writes them begins.\n */\nexport async function verifiedManifestBundleRows(\n entries: readonly VerifiedManifestBundle[],\n): Promise<VerifiedManifestBundleRow[]> {\n const bundleEntries: VerifiedBundle[] = [];\n const levelEntries: VerifiedKekLevel[] = [];\n for (const entry of entries)\n if (\"kekLevel\" in entry) levelEntries.push(entry);\n else bundleEntries.push(entry);\n // One level per container: its newest epoch, the last one seen on a tie.\n const levelRows = new Map<string, VerifiedManifestBundleRow>();\n for (const level of levelEntries) {\n const row = await kekLevelRow(level);\n const held = row && levelRows.get(row.objectId);\n if (row && (!held || held.epoch <= row.epoch))\n levelRows.set(row.objectId, row);\n }\n return [...(await bundleRows(bundleEntries)), ...levelRows.values()];\n}\n\nfunction bundleRows(\n entries: readonly VerifiedBundle[],\n): Promise<VerifiedManifestBundleRow[]> {\n const unique = new Map(\n entries.map((entry) => [entry.bundle.manifestHash, entry]),\n );\n return Promise.all(\n [...unique.values()].map(async ({ bundle, checkpoint }) => {\n const bundleJson = JSON.stringify(bundle);\n return {\n manifestHash: bundle.manifestHash,\n organizationId: checkpoint.organizationId,\n objectKind: checkpoint.objectKind,\n objectId: checkpoint.objectId,\n epoch: checkpoint.epoch,\n bundleJson,\n bundleDigest: await sha256Hex(bundleJson),\n };\n }),\n );\n}\n\n/**\n * Records verified bundles inside the transaction that finalizes their\n * projection's checkpoints, so they commit or roll back with it and no cache\n * work outlives the verification. Freshly verified bytes replace any stored\n * copy.\n */\nexport async function writeVerifiedManifestBundlesInTransaction(\n tx: ClientSQLiteTransactionScope,\n rows: readonly VerifiedManifestBundleRow[],\n verifiedAt: string,\n): Promise<void> {\n if (rows.length === 0) return;\n const stored = await storedDigests(\n tx,\n rows.map((row) => row.manifestHash),\n );\n // An identical stored row only needs its recency refreshed.\n const unchanged = rows.filter(\n (row) => stored.get(row.manifestHash) === row.bundleDigest,\n );\n for (const batch of batches(unchanged.map((row) => row.manifestHash)))\n await tx\n .update(bundles)\n .set({ verifiedAt })\n .where(inArray(bundles.manifestHash, batch))\n .run();\n // A repeated hash keeps its last changed row, as sequential upserts would.\n const changed = new Map(\n rows\n .filter((row) => stored.get(row.manifestHash) !== row.bundleDigest)\n .map((row) => [row.manifestHash, { ...row, verifiedAt }]),\n );\n for (const batch of slices([...changed.values()], BUNDLE_WRITE_BATCH_SIZE))\n await tx\n .insert(bundles)\n .values(batch)\n .onConflictDoUpdate({\n target: bundles.manifestHash,\n set: {\n organizationId: excludedValue(bundles.organizationId),\n objectKind: excludedValue(bundles.objectKind),\n objectId: excludedValue(bundles.objectId),\n epoch: excludedValue(bundles.epoch),\n bundleJson: excludedValue(bundles.bundleJson),\n bundleDigest: excludedValue(bundles.bundleDigest),\n verifiedAt: excludedValue(bundles.verifiedAt),\n },\n })\n .run();\n await dropSupersededKekLevels(tx, rows);\n await pruneInTransaction(tx);\n}\n\n/**\n * A container keeps only its latest verified level: the API serves its\n * current level, so an older one can never be cited usefully again.\n */\nasync function dropSupersededKekLevels(\n tx: ClientSQLiteTransactionScope,\n rows: readonly VerifiedManifestBundleRow[],\n): Promise<void> {\n const levels = rows.filter((row) => row.objectKind === KEK_LEVEL_OBJECT_KIND);\n for (const batch of batches(levels))\n await tx\n .delete(bundles)\n .where(\n and(\n eq(bundles.objectKind, KEK_LEVEL_OBJECT_KIND),\n inArray(\n bundles.objectId,\n batch.map((row) => row.objectId),\n ),\n notInArray(\n bundles.manifestHash,\n batch.map((row) => row.manifestHash),\n ),\n ),\n )\n .run();\n}\n\nasync function storedDigests(\n tx: ClientSQLiteTransactionScope,\n manifestHashes: readonly string[],\n): Promise<Map<string, string>> {\n const digests = new Map<string, string>();\n for (const batch of batches(manifestHashes)) {\n const rows = await tx\n .select({\n bundleDigest: bundles.bundleDigest,\n manifestHash: bundles.manifestHash,\n })\n .from(bundles)\n .where(inArray(bundles.manifestHash, batch));\n for (const row of rows) digests.set(row.manifestHash, row.bundleDigest);\n }\n return digests;\n}\n\ninterface StoredBundleRow {\n readonly bundleDigest: string;\n readonly bundleJson: string;\n readonly manifestHash: string;\n}\n\nconst storedColumns = {\n bundleDigest: bundles.bundleDigest,\n bundleJson: bundles.bundleJson,\n manifestHash: bundles.manifestHash,\n};\n\nasync function readStoredBundle(\n row: StoredBundleRow,\n): Promise<AccessManifestBundleWireResponse | null> {\n if ((await sha256Hex(row.bundleJson)) !== row.bundleDigest) return null;\n try {\n const bundle: unknown = JSON.parse(row.bundleJson);\n return isAccessManifestBundleWireResponse(bundle) &&\n bundle.manifestHash === row.manifestHash\n ? bundle\n : null;\n } catch {\n return null;\n }\n}\n\nfunction objectRows(\n db: ClientSQLiteDatabase,\n organizationId: string,\n object: CitedObject,\n limit: number,\n) {\n return db\n .select(storedColumns)\n .from(bundles)\n .where(\n and(\n eq(bundles.organizationId, organizationId),\n eq(bundles.objectKind, object.kind),\n eq(bundles.objectId, object.id),\n ),\n )\n .orderBy(desc(bundles.epoch))\n .limit(limit);\n}\n\nfunction recentRows(\n db: ClientSQLiteDatabase,\n organizationId: string,\n limit: number,\n) {\n return db\n .select(storedColumns)\n .from(bundles)\n .where(\n and(\n eq(bundles.organizationId, organizationId),\n ne(bundles.objectKind, KEK_LEVEL_OBJECT_KIND),\n ),\n )\n .orderBy(desc(bundles.verifiedAt), asc(bundles.manifestHash))\n .limit(limit);\n}\n\n/** The latest verified KEK level of each container, in lineage order. */\nasync function lineageKekLevels(\n db: ClientSQLiteDatabase,\n organizationId: string,\n objects: readonly CitedObject[],\n): Promise<StoredBundleRow[]> {\n const containerIds = objects\n .filter((object) => object.kind === \"container\")\n .map((object) => object.id);\n if (containerIds.length === 0) return [];\n const rows = await db\n .select({ ...storedColumns, objectId: bundles.objectId })\n .from(bundles)\n .where(\n and(\n eq(bundles.organizationId, organizationId),\n eq(bundles.objectKind, KEK_LEVEL_OBJECT_KIND),\n inArray(bundles.objectId, containerIds),\n ),\n )\n .orderBy(desc(bundles.epoch), desc(bundles.verifiedAt));\n const latest = new Map<string, StoredBundleRow>();\n for (const row of rows)\n if (!latest.has(row.objectId)) latest.set(row.objectId, row);\n return containerIds.flatMap((id) => latest.get(id) ?? []);\n}\n\n/**\n * The latest verified KEK level of each container the target's projection\n * walks; then verified bundles of those objects, newest epochs first; then\n * the most recently verified bundles of its organization, since a\n * just-verified parent is the likeliest part of a new child's projection.\n * Citations never leave the target's organization: an object whose\n * organization the device cannot place cites nothing. Damaged rows are\n * dropped.\n */\nexport async function loadVerifiedManifestCitations(\n execSql: ExecSql,\n target: WriterProjectionTarget,\n limit = KNOWN_MANIFEST_HINT_LIMIT,\n): Promise<HeldProjectionCitation[]> {\n await ensureSqlTables(execSql, [\n ...verifiedManifestBundleTables,\n ...containerTables,\n ...documentContainerProjectionTables,\n ]);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const cited = new Map<string, HeldProjectionCitation>();\n const damaged: string[] = [];\n const collect = async (rows: readonly StoredBundleRow[]) => {\n for (const row of rows) {\n if (cited.size >= limit || cited.has(row.manifestHash)) continue;\n const bundle = await readStoredBundle(row);\n if (bundle) cited.set(row.manifestHash, bundle);\n else damaged.push(row.manifestHash);\n }\n };\n const objects = await citedObjects(db, target);\n const organizationId = await targetOrganization(db, target, objects);\n if (organizationId === null) return [];\n for (const row of await lineageKekLevels(db, organizationId, objects)) {\n if (cited.size >= limit) break;\n const level = await readStoredKekLevel(row);\n if (level) cited.set(row.manifestHash, level);\n else damaged.push(row.manifestHash);\n }\n for (const object of objects)\n if (cited.size < limit)\n await collect(\n await objectRows(db, organizationId, object, limit - cited.size),\n );\n if (cited.size < limit)\n await collect(await recentRows(db, organizationId, limit + cited.size));\n if (damaged.length > 0)\n await getClientSQLitePersistenceRuntime(execSql)\n .runMutation((handle) =>\n handle\n .delete(bundles)\n .where(inArray(bundles.manifestHash, damaged))\n .run(),\n )\n .catch(() => undefined);\n return [...cited.values()];\n}\n\n/** Cites from whichever database the signed-in identity currently uses. */\nexport function createVerifiedManifestCitations(\n resolveExecSql: () => ExecSql | null,\n): VerifiedManifestCitations {\n return {\n cite: async (target) => {\n const execSql = resolveExecSql();\n return execSql ? loadVerifiedManifestCitations(execSql, target) : [];\n },\n };\n}\n\n/** Drops an organization's verified bundles when a remote reset forgets it. */\nexport async function deleteVerifiedManifestBundlesForOrganization(\n tx: ClientSQLiteTransactionScope,\n organizationId: string,\n): Promise<void> {\n await tx\n .delete(bundles)\n .where(eq(bundles.organizationId, organizationId))\n .run();\n}\n"]}
|
|
@@ -10,6 +10,7 @@ import { type SqlTableSchema } from "../sqlTableSchema.js";
|
|
|
10
10
|
* nullable so presentation falls back to `/` for a root and `Untitled`
|
|
11
11
|
* otherwise. Local timestamps track client storage/structural changes, while
|
|
12
12
|
* server timestamps are populated once the container has synced.
|
|
13
|
+
* `(parentId) where parentId is not null` serves child-folder listings.
|
|
13
14
|
*/
|
|
14
15
|
export declare const containers: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
|
|
15
16
|
name: "containers";
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { sql } from "drizzle-orm";
|
|
1
2
|
import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
|
|
2
3
|
import { defineSqlTableSchema } from "../sqlTableSchema.js";
|
|
3
4
|
const accessLevelColumn = "effective_access_level";
|
|
@@ -12,6 +13,7 @@ const accessLevelColumn = "effective_access_level";
|
|
|
12
13
|
* nullable so presentation falls back to `/` for a root and `Untitled`
|
|
13
14
|
* otherwise. Local timestamps track client storage/structural changes, while
|
|
14
15
|
* server timestamps are populated once the container has synced.
|
|
16
|
+
* `(parentId) where parentId is not null` serves child-folder listings.
|
|
15
17
|
*/
|
|
16
18
|
export const containers = sqliteTable("containers", {
|
|
17
19
|
id: text("id"),
|
|
@@ -26,7 +28,12 @@ export const containers = sqliteTable("containers", {
|
|
|
26
28
|
localUpdatedAt: text("local_updated_at").notNull(),
|
|
27
29
|
serverCreatedAt: text("server_created_at"),
|
|
28
30
|
serverUpdatedAt: text("server_updated_at"),
|
|
29
|
-
}, (table) => [
|
|
31
|
+
}, (table) => [
|
|
32
|
+
primaryKey({ columns: [table.id] }),
|
|
33
|
+
index("containers_parent_idx")
|
|
34
|
+
.on(table.parentId)
|
|
35
|
+
.where(sql `${table.parentId} IS NOT NULL`),
|
|
36
|
+
]);
|
|
30
37
|
/**
|
|
31
38
|
* Latest removal observed for each container. Hydration must observe the same
|
|
32
39
|
* generation before fetching verified restoration evidence; unsigned clocks
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"containerSchema.js","sourceRoot":"","sources":["containerSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAE9E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD
|
|
1
|
+
{"version":3,"file":"containerSchema.js","sourceRoot":"","sources":["containerSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAE9E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CACnC,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IACd,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvE,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IAClD,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;CAC3C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,CAAC,uBAAuB,CAAC;SAC3B,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,cAAc,CAAC;CAC7C,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;CAC1C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IAC5C,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,CACrD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,WAAW,CAClB;CACF,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,+BAA+B,EAC/B;IACE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;CAC9C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;CACnE,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;CAC5C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CACvE,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE;QACE,GAAG,oBAAoB,CAAC,UAAU,CAAC;QACnC,eAAe,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;KAC1C;IACD;QACE,GAAG,oBAAoB,CAAC,4BAA4B,CAAC;QACrD,eAAe,EAAE,CAAC,SAAS,CAAC;KAC7B;IACD,oBAAoB,CAAC,wBAAwB,CAAC;IAC9C,oBAAoB,CAAC,4BAA4B,CAAC;IAClD,oBAAoB,CAAC,2BAA2B,CAAC;CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU;IACV,4BAA4B;IAC5B,wBAAwB;IACxB,4BAA4B;IAC5B,2BAA2B;CAC5B,CAAC","sourcesContent":["import { sql } from \"drizzle-orm\";\nimport {\n index,\n integer,\n primaryKey,\n sqliteTable,\n text,\n} from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema, type SqlTableSchema } from \"../sqlTableSchema\";\n\nconst accessLevelColumn = \"effective_access_level\";\n\n/**\n * Materialized local container tree.\n *\n * Container rows describe the tree and its encrypted metadata document;\n * metadata rows live in `documents`. `id` is the primary key for structural\n * lookups. `metadataDocumentId` is the server metadata-document id when known;\n * `systemSlot` is an optional opaque app-owned slot. `displayName` and `icon`\n * are the decrypted metadata projection lists read: `displayName` stays\n * nullable so presentation falls back to `/` for a root and `Untitled`\n * otherwise. Local timestamps track client storage/structural changes, while\n * server timestamps are populated once the container has synced.\n * `(parentId) where parentId is not null` serves child-folder listings.\n */\nexport const containers = sqliteTable(\n \"containers\",\n {\n id: text(\"id\"),\n organizationId: text(\"organization_id\").notNull(),\n parentId: text(\"parent_id\"),\n metadataDocumentId: text(\"metadata_document_id\"),\n systemSlot: text(\"system_slot\"),\n displayName: text(\"display_name\"),\n icon: text(\"icon\"),\n effectiveAccessLevel: text(accessLevelColumn).notNull().default(\"read\"),\n localCreatedAt: text(\"local_created_at\").notNull(),\n localUpdatedAt: text(\"local_updated_at\").notNull(),\n serverCreatedAt: text(\"server_created_at\"),\n serverUpdatedAt: text(\"server_updated_at\"),\n },\n (table) => [\n primaryKey({ columns: [table.id] }),\n index(\"containers_parent_idx\")\n .on(table.parentId)\n .where(sql`${table.parentId} IS NOT NULL`),\n ],\n);\n\n/**\n * Latest removal observed for each container. Hydration must observe the same\n * generation before fetching verified restoration evidence; unsigned clocks\n * never establish a terminal deletion or bypass a concurrent removal. Cleared\n * observations retain their generation so remove/restore/remove cannot reuse it.\n */\nexport const containerHydrationTombstones = sqliteTable(\n \"container_hydration_tombstones\",\n {\n containerId: text(\"container_id\").notNull(),\n generation: integer(\"generation\").notNull().default(1),\n cleared: integer(\"cleared\", { mode: \"boolean\" }).notNull().default(false),\n reason: text(\"reason\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.containerId] })],\n);\n\n/**\n * Organization attribution for container metadata retained after access loss.\n * The container row is removed on revocation, so this marker retains the\n * organization scope needed by a later access-restoration sweep.\n */\nexport const dormantContainerMetadata = sqliteTable(\n \"dormant_container_metadata\",\n {\n containerId: text(\"container_id\").notNull(),\n organizationId: text(\"organization_id\").notNull(),\n retainedAt: text(\"retained_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.containerId] }),\n index(\"dormant_container_metadata_organization_idx\").on(\n table.organizationId,\n table.containerId,\n ),\n ],\n);\n\n/**\n * Organizations a held folder was re-homed away from. Purged-organization\n * recovery re-creates folders under their existing ids and a purged\n * organization never returns, so a later proof binding the folder back to one\n * of these organizations is a replay. Retained across remote resets.\n */\nexport const supersededContainerBindings = sqliteTable(\n \"superseded_container_bindings\",\n {\n containerId: text(\"container_id\").notNull(),\n organizationId: text(\"organization_id\").notNull(),\n supersededAt: text(\"superseded_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.containerId, table.organizationId] }),\n ],\n);\n\n/**\n * Durable request for a post-access-restoration crawl and sweep. Attempt state\n * enforces exponential backoff and a bounded retry budget across restarts.\n */\nexport const dormantMetadataSweepRequests = sqliteTable(\n \"dormant_metadata_sweep_requests\",\n {\n organizationId: text(\"organization_id\").notNull(),\n requesterUserId: text(\"requester_user_id\").notNull(),\n generation: integer(\"generation\").notNull().default(1),\n attemptCount: integer(\"attempt_count\").notNull().default(0),\n lastAttemptedAt: text(\"last_attempted_at\"),\n requestedAt: text(\"requested_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.organizationId, table.requesterUserId] }),\n ],\n);\n\nexport const containerTableSchemas: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(containers),\n requiredColumns: [\"display_name\", \"icon\"],\n },\n {\n ...defineSqlTableSchema(containerHydrationTombstones),\n requiredColumns: [\"cleared\"],\n },\n defineSqlTableSchema(dormantContainerMetadata),\n defineSqlTableSchema(dormantMetadataSweepRequests),\n defineSqlTableSchema(supersededContainerBindings),\n];\n\nexport const containerSQLiteSchema = {\n containers,\n containerHydrationTombstones,\n dormantContainerMetadata,\n dormantMetadataSweepRequests,\n supersededContainerBindings,\n};\n"]}
|
|
@@ -17,7 +17,6 @@
|
|
|
17
17
|
* Indexes:
|
|
18
18
|
* - `(localId, slotId)` is the primary key and keeps one pending blob per
|
|
19
19
|
* document attachment slot.
|
|
20
|
-
* - `mimeType` supports blob-browser MIME grouping and sorting.
|
|
21
20
|
*/
|
|
22
21
|
export declare const documentPendingAttachments: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
|
|
23
22
|
name: "document_pending_attachments";
|
|
@@ -333,7 +332,6 @@ export declare const documentPendingAttachments: import("drizzle-orm/sqlite-core
|
|
|
333
332
|
* Indexes:
|
|
334
333
|
* - `(localId, slotId)` is the primary key and keeps one projected blob per
|
|
335
334
|
* document attachment slot.
|
|
336
|
-
* - `mimeType` supports blob-browser MIME grouping and sorting.
|
|
337
335
|
*/
|
|
338
336
|
export declare const documentAttachmentBlobProjection: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
|
|
339
337
|
name: "document_attachment_blob_projection";
|
|
@@ -18,7 +18,6 @@ import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqli
|
|
|
18
18
|
* Indexes:
|
|
19
19
|
* - `(localId, slotId)` is the primary key and keeps one pending blob per
|
|
20
20
|
* document attachment slot.
|
|
21
|
-
* - `mimeType` supports blob-browser MIME grouping and sorting.
|
|
22
21
|
*/
|
|
23
22
|
export const documentPendingAttachments = sqliteTable("document_pending_attachments", {
|
|
24
23
|
localId: text("local_id").notNull(),
|
|
@@ -43,7 +42,6 @@ export const documentPendingAttachments = sqliteTable("document_pending_attachme
|
|
|
43
42
|
uploadStageId: text("upload_stage_id"),
|
|
44
43
|
}, (table) => [
|
|
45
44
|
primaryKey({ columns: [table.localId, table.slotId] }),
|
|
46
|
-
index("document_pending_attachments_mime_type_idx").on(table.mimeType),
|
|
47
45
|
index("document_pending_attachments_storage_key_idx").on(table.storageKey),
|
|
48
46
|
]);
|
|
49
47
|
/**
|
|
@@ -74,7 +72,6 @@ export const documentPendingAttachments = sqliteTable("document_pending_attachme
|
|
|
74
72
|
* Indexes:
|
|
75
73
|
* - `(localId, slotId)` is the primary key and keeps one projected blob per
|
|
76
74
|
* document attachment slot.
|
|
77
|
-
* - `mimeType` supports blob-browser MIME grouping and sorting.
|
|
78
75
|
*/
|
|
79
76
|
export const documentAttachmentBlobProjection = sqliteTable("document_attachment_blob_projection", {
|
|
80
77
|
localId: text("local_id").notNull(),
|
|
@@ -88,7 +85,6 @@ export const documentAttachmentBlobProjection = sqliteTable("document_attachment
|
|
|
88
85
|
detachedAt: text("detached_at"),
|
|
89
86
|
}, (table) => [
|
|
90
87
|
primaryKey({ columns: [table.localId, table.slotId] }),
|
|
91
|
-
index("document_attachment_blob_projection_mime_type_idx").on(table.mimeType),
|
|
92
88
|
index("document_attachment_blob_projection_storage_key_idx").on(table.storageKey),
|
|
93
89
|
]);
|
|
94
90
|
//# sourceMappingURL=documentAttachmentSchema.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"documentAttachmentSchema.js","sourceRoot":"","sources":["documentAttachmentSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC
|
|
1
|
+
{"version":3,"file":"documentAttachmentSchema.js","sourceRoot":"","sources":["documentAttachmentSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAC5C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,iCAAiC;IACjC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC,0BAA0B,CAAC;IAC1D,cAAc,EAAE,OAAO,CAAC,kBAAkB,CAAC;IAC3C,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC;CACvC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC3E,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,qCAAqC,EACrC;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAC5C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;CAChC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,KAAK,CAAC,qDAAqD,CAAC,CAAC,EAAE,CAC7D,KAAK,CAAC,UAAU,CACjB;CACF,CACF,CAAC","sourcesContent":["import {\n index,\n integer,\n primaryKey,\n sqliteTable,\n text,\n} from \"drizzle-orm/sqlite-core\";\n\n/**\n * Pending attachment uploads for local document changes.\n *\n * These rows describe attachment blobs referenced by local document mutations\n * that have not yet been folded into the synced attachment/blob projection.\n * Once the attachment is accepted or discarded, the pending row is removed.\n *\n * Columns:\n * - `localId`: Local document id that owns the attachment slot.\n * - `slotId`: Stable attachment slot id within the document.\n * - `name`: User-facing attachment filename.\n * - `mimeType`: Optional MIME type supplied for the blob.\n * - `storageKey`: Local blob storage key for upload/readback.\n * - `byteLength`: Blob size in bytes.\n * - `createdAt`: Queue insertion timestamp used for ordered display.\n *\n * Indexes:\n * - `(localId, slotId)` is the primary key and keeps one pending blob per\n * document attachment slot.\n */\nexport const documentPendingAttachments = sqliteTable(\n \"document_pending_attachments\",\n {\n localId: text(\"local_id\").notNull(),\n slotId: text(\"slot_id\").notNull(),\n name: text(\"name\").notNull(),\n mimeType: text(\"mime_type\"),\n storageKey: text(\"storage_key\").notNull(),\n byteLength: integer(\"byte_length\").notNull(),\n contentSha256: text(\"content_sha256\").notNull(),\n createdAt: text(\"created_at\").notNull(),\n // Upload-resume identity, set on the first upload attempt. Reusing the blob\n // id, content key and IV seed makes every encrypted chunk byte-identical, so\n // the persisted multipart stage can resume instead of being orphaned. All\n // nullable: only in-flight uploads have them, and they are dropped with the\n // row once the upload completes.\n uploadBlobId: text(\"upload_blob_id\"),\n uploadContentKey: text(\"upload_content_key\"),\n uploadIv: text(\"upload_iv\"),\n uploadContentKeyEpoch: integer(\"upload_content_key_epoch\"),\n uploadPartSize: integer(\"upload_part_size\"),\n uploadPlaintextSha256: text(\"upload_plaintext_sha256\"),\n uploadStageId: text(\"upload_stage_id\"),\n },\n (table) => [\n primaryKey({ columns: [table.localId, table.slotId] }),\n index(\"document_pending_attachments_storage_key_idx\").on(table.storageKey),\n ],\n);\n\n/**\n * Local attachment blob projection for stored documents.\n *\n * This table tracks the attachment blobs currently available to the client for\n * each document slot. `blobId` is optional because the local storage key can be\n * known before the server blob identity has been assigned or downloaded.\n *\n * Columns:\n * - `localId`: Local document id that owns the attachment slot.\n * - `slotId`: Stable attachment slot id within the document.\n * - `blobId`: Server blob id when known.\n * - `storageKey`: Local blob storage key for opening the attachment.\n * - `mimeType`: Optional MIME type associated with the blob.\n * - `byteLength`: Blob size in bytes.\n * - `contentSha256`: Plaintext digest of the bytes held at `storageKey`. The\n * document content records the digest it intends for the slot; a held copy\n * whose digest differs is a validly signed served binding the document has\n * not (yet) recorded, and read models flag it rather than hide it.\n * - `updatedAt`: Local timestamp for the attachment projection update.\n * - `detachedAt`: Local timestamp set when the slot is unlinked from a synced\n * document. The row outlives the unlink because it is also the durable\n * \"still needs a remote detach\" marker (see `syncDetachedAttachments`), so\n * read models that answer \"what references this blob\" must skip detached\n * rows instead of waiting for the detach to flush.\n *\n * Indexes:\n * - `(localId, slotId)` is the primary key and keeps one projected blob per\n * document attachment slot.\n */\nexport const documentAttachmentBlobProjection = sqliteTable(\n \"document_attachment_blob_projection\",\n {\n localId: text(\"local_id\").notNull(),\n slotId: text(\"slot_id\").notNull(),\n blobId: text(\"blob_id\"),\n storageKey: text(\"storage_key\").notNull(),\n mimeType: text(\"mime_type\"),\n byteLength: integer(\"byte_length\").notNull(),\n contentSha256: text(\"content_sha256\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n detachedAt: text(\"detached_at\"),\n },\n (table) => [\n primaryKey({ columns: [table.localId, table.slotId] }),\n index(\"document_attachment_blob_projection_storage_key_idx\").on(\n table.storageKey,\n ),\n ],\n);\n"]}
|
|
@@ -1298,6 +1298,8 @@ export declare const trustedUserIdentityPins: import("drizzle-orm/sqlite-core").
|
|
|
1298
1298
|
* Indexes:
|
|
1299
1299
|
* - `(documentId, containerId)` is the primary key and prevents duplicate
|
|
1300
1300
|
* links for the same document/container pair.
|
|
1301
|
+
* - `(containerId, documentId)` serves the container-filtered link scans
|
|
1302
|
+
* (folder item and sidebar windows) as a covering index search.
|
|
1301
1303
|
*/
|
|
1302
1304
|
export declare const documentContainerProjection: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
|
|
1303
1305
|
name: "document_container_projection";
|
|
@@ -176,6 +176,10 @@ export const documentHistoryUpdates = sqliteTable("document_history_updates", {
|
|
|
176
176
|
uniqueIndex("document_history_updates_update_id_idx")
|
|
177
177
|
.on(table.updateId)
|
|
178
178
|
.where(sql `${table.updateId} IS NOT NULL`),
|
|
179
|
+
// Queued rows only: pending counts and pending loads skip settled history.
|
|
180
|
+
index("document_history_updates_queued_scope_idx")
|
|
181
|
+
.on(table.appKind, table.localId, table.createdAt)
|
|
182
|
+
.where(sql `${table.updateId} IS NOT NULL`),
|
|
179
183
|
]);
|
|
180
184
|
/**
|
|
181
185
|
* Anti-rollback pin for verified access manifests.
|
|
@@ -280,12 +284,17 @@ export const trustedUserIdentityPins = sqliteTable("trusted_user_identity_pins",
|
|
|
280
284
|
* Indexes:
|
|
281
285
|
* - `(documentId, containerId)` is the primary key and prevents duplicate
|
|
282
286
|
* links for the same document/container pair.
|
|
287
|
+
* - `(containerId, documentId)` serves the container-filtered link scans
|
|
288
|
+
* (folder item and sidebar windows) as a covering index search.
|
|
283
289
|
*/
|
|
284
290
|
export const documentContainerProjection = sqliteTable("document_container_projection", {
|
|
285
291
|
documentId: text("document_id").notNull(),
|
|
286
292
|
containerId: text("container_id").notNull(),
|
|
287
293
|
updatedAt: text("updated_at").notNull(),
|
|
288
|
-
}, (table) => [
|
|
294
|
+
}, (table) => [
|
|
295
|
+
primaryKey({ columns: [table.documentId, table.containerId] }),
|
|
296
|
+
index("document_container_projection_container_idx").on(table.containerId, table.documentId),
|
|
297
|
+
]);
|
|
289
298
|
/**
|
|
290
299
|
* Queryable document summary and detail projection.
|
|
291
300
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,qBAAqB,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,mBAAmB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,iCAAiC,EACjC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,qBAAqB,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,CAAC;AAExE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAClC,WAAW,EACX;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvE,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACtC,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC;IACxD,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC;IACjD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,sBAAsB,EAAE,IAAI,CAAC,2BAA2B,CAAC;IACzD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,KAAK,CAAC,4BAA4B,CAAC;SAChC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;SACnC,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,UAAU,cAAc,CAAC;CAC/C,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IACd,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,yBAAyB,EAAE,IAAI,CAAC,8BAA8B,CAAC;IAC/D,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC;IAC3D,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;IAClD,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACxD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,CAAC,4CAA4C,CAAC,CAAC,EAAE,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAChB;IACD,WAAW,CAAC,wCAAwC,CAAC;SAClD,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,cAAc,CAAC;CAC7C,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAClD,6BAA6B,EAC7B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC;KAClE,CAAC;CACH,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE;IAC5C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE;IAC9D,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,4BAA4B,EAC5B;IACE,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC5D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,kBAAkB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;IACzD,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE;IAClE,2BAA2B,EAAE,IAAI,CAC/B,+BAA+B,CAChC,CAAC,OAAO,EAAE;IACX,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;KACnC,CAAC,CAAC,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC;KACnD,CAAC;IACF,WAAW,CAAC,2DAA2D,CAAC,CAAC,EAAE,CACzE,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,qBAAqB,CAC5B;CACF,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,+BAA+B,EAC/B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAC3C,qBAAqB,EACrB;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,CAAC,mCAAmC,CAAC;SACvC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;SACrB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,WAAW,cAAc,CAAC;IAC/C,KAAK,CAAC,6CAA6C,CAAC;SACjD,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;SACxB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,WAAW,UAAU,CAAC;IAC3C,KAAK,CAAC,kCAAkC,CAAC;SACtC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;SACpB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,UAAU,cAAc,CAAC;CAC/C,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;CAC7B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,2BAA2B,EAC3B;IACE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAkC;IAC3D;QACE,GAAG,oBAAoB,CAAC,SAAS,CAAC;QAClC,eAAe,EAAE;YACf,mBAAmB;YACnB,qBAAqB;YACrB,sBAAsB;YACtB,qBAAqB;YACrB,sBAAsB;YACtB,2BAA2B;SAC5B;KACF;IACD,oBAAoB,CAAC,0BAA0B,CAAC;IAChD;QACE,GAAG,oBAAoB,CAAC,sBAAsB,CAAC;QAC/C,eAAe,EAAE,CAAC,WAAW,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE;QACE,GAAG,oBAAoB,CAAC,iBAAiB,CAAC;QAC1C,eAAe,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD;QACE,GAAG,oBAAoB,CAAC,4BAA4B,CAAC;QACrD,eAAe,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD,oBAAoB,CAAC,+BAA+B,CAAC;IACrD,oBAAoB,CAAC,4BAA4B,CAAC;IAClD,GAAG,2BAA2B;IAC9B,GAAG,8BAA8B;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE,oBAAoB,CAAC,oBAAoB,CAAC;IAC1C,oBAAoB,CAAC,yBAAyB,CAAC;IAC/C,oBAAoB,CAAC,yBAAyB,CAAC;IAC/C,oBAAoB,CAAC,wBAAwB,CAAC;IAC9C,oBAAoB,CAAC,0BAA0B,CAAC;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkC;IACzE;QACE,GAAG,oBAAoB,CAAC,uBAAuB,CAAC;QAChD,eAAe,EAAE,CAAC,YAAY,CAAC;KAChC;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAkC;IAC5D,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,iCAAiC,GAC5C;IACE,oBAAoB,CAAC,2BAA2B,CAAC;IACjD;QACE,GAAG,oBAAoB,CAAC,+BAA+B,CAAC;QACxD,eAAe,EAAE,CAAC,QAAQ,CAAC;KAC5B;IACD,oBAAoB,CAAC,0BAA0B,CAAC;IAChD;QACE,GAAG,oBAAoB,CAAC,sBAAsB,CAAC;QAC/C,eAAe,EAAE,CAAC,iBAAiB,CAAC;KACrC;IACD,oBAAoB,CAAC,yBAAyB,CAAC;CAChD,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,oBAAoB,CAAC,YAAY,CAAC;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,GAAG,iBAAiB;IACpB,oBAAoB,CAAC,yBAAyB,CAAC;CAChD,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAkC;IACrE,oBAAoB,CAAC,kBAAkB,CAAC;IACxC,oBAAoB,CAAC,sBAAsB,CAAC;IAC5C;QACE,GAAG,oBAAoB,CAAC,0BAA0B,CAAC;QACnD,eAAe,EAAE,CAAC,gBAAgB,CAAC;KACpC;IACD;QACE,GAAG,oBAAoB,CAAC,gCAAgC,CAAC;QACzD,eAAe,EAAE,CAAC,gBAAgB,CAAC;KACpC;IACD,8BAA8B;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkC;IACzE;QACE,GAAG,oBAAoB,CAAC,uBAAuB,CAAC;QAChD,eAAe,EAAE,CAAC,YAAY,CAAC;KAChC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAkC;IAC5D,GAAG,8BAA8B;IACjC,GAAG,cAAc;IACjB,GAAG,qBAAqB;IACxB,GAAG,sBAAsB;IACzB,GAAG,4BAA4B;IAC/B,GAAG,4BAA4B;IAC/B,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;IAChC,GAAG,wBAAwB;IAC3B,GAAG,4BAA4B;IAC/B,GAAG,2BAA2B;IAC9B,GAAG,qBAAqB,CAAC,2BAA2B;IACpD,GAAG,mBAAmB,CAAC,qCAAqC;IAC5D,GAAG,qBAAqB,CAAC,2BAA2B;CACrD,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,8BAA8B;IAC9B,0BAA0B;IAC1B,2BAA2B;IAC3B,wBAAwB;IACxB,uBAAuB;IACvB,qBAAqB;IACrB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,SAAS;IACT,iBAAiB;IACjB,4BAA4B;IAC5B,+BAA+B;IAC/B,4BAA4B;IAC5B,yBAAyB;IACzB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,uBAAuB;IACvB,iBAAiB;IACjB,GAAG,qBAAqB;IACxB,2BAA2B;IAC3B,YAAY;IACZ,yBAAyB;IACzB,kBAAkB;IAClB,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B,EAAE,0BAA0B;IACtD,uBAAuB;IACvB,GAAG,iCAAiC;IACpC,GAAG,qBAAqB,CAAC,iCAAiC;IAC1D,GAAG,mBAAmB,CAAC,2CAA2C;IAClE,GAAG,qBAAqB,CAAC,iCAAiC;CAC3D,CAAC","sourcesContent":["import { sql } from \"drizzle-orm\";\nimport {\n index,\n integer,\n primaryKey,\n sqliteTable,\n text,\n uniqueIndex,\n} from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema, type SqlTableSchema } from \"../sqlTableSchema\";\nimport { containerDocumentTombstoneHolds } from \"./containerDocumentTombstoneHoldSchema\";\nimport {\n containerSQLiteSchema,\n containerTableSchemas,\n} from \"./containerSchema\";\nimport {\n documentAttachmentBlobProjection,\n documentPendingAttachments,\n} from \"./documentAttachmentSchema\";\nimport {\n documentDiscoveryHeads,\n documentDiscoverySequence,\n pendingDocumentDiscoveries,\n} from \"./documentDiscoveryEvidenceSchema\";\nimport {\n documentOrphanBlobReclaims,\n documentOrphanBlobReclaimTable,\n} from \"./documentOrphanBlobReclaimSchema\";\nimport { documentIntentLinkTargets } from \"./documentPlacementIntentSchema\";\nimport { localIntents } from \"./localIntentSchema\";\nimport * as organizationDataUsage from \"./organizationDataUsageSchema\";\nimport { organizationFounders } from \"./organizationFounderSchema\";\nimport * as provisioningAttempt from \"./organizationProvisioningAttemptSchema\";\nimport {\n organizationReadModelSQLiteSchema,\n organizationReadModelTables,\n} from \"./organizationReadModelTableRegistry\";\nimport * as organizationSyncPause from \"./organizationSyncPauseSchema\";\nimport { principalGrantRetirements } from \"./principalGrantRetirementSchema\";\nimport {\n principalHistoryEntries,\n principalHistoryEvidenceTables,\n principalHistoryNodes,\n principalHistoryPrefixes,\n} from \"./principalHistoryEvidenceSchema\";\nimport {\n principalHistoryNodeReferences,\n principalHistoryRootOwners,\n} from \"./principalHistoryNodeRetentionSchema\";\nimport { principalKeyEnvelopeArchive } from \"./principalHistoryRetentionSchema\";\nimport {\n principalHistoryStages,\n principalHistoryStageTables,\n} from \"./principalHistoryStageSchema\";\nimport {\n principalMutationJournal,\n principalMutationJournalTables,\n} from \"./principalMutationJournalSchema\";\nimport {\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyCheckpoints,\n principalPolicyOrganizations,\n} from \"./principalPolicySchema\";\nimport {\n securityIncidents,\n securityIncidentTable,\n} from \"./securityIncidentSchema\";\nimport {\n verifiedAccessManifestBundles,\n verifiedManifestBundleTables,\n} from \"./verifiedManifestBundleSchema\";\n\nexport {\n containerHydrationTombstones,\n containers,\n dormantContainerMetadata,\n dormantMetadataSweepRequests,\n supersededContainerBindings,\n} from \"./containerSchema\";\nexport {\n documentAttachmentBlobProjection,\n documentPendingAttachments,\n} from \"./documentAttachmentSchema\";\nexport {\n inContainerIntentLanes,\n inLocalIntentLane,\n LOCAL_INTENT_LANES,\n LOCAL_INTENT_SUBJECT,\n localIntents,\n} from \"./localIntentSchema\";\nexport {\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyCheckpoints,\n principalPolicyOrganizations,\n} from \"./principalPolicySchema\";\nexport { securityIncidents } from \"./securityIncidentSchema\";\nexport { containerDocumentTombstoneHolds, organizationReadModelTables };\n\nconst accessLevelColumn = \"effective_access_level\";\n\n/**\n * Durable Loro-backed document records shared by app features.\n *\n * This table stores encrypted document runtime state for multiple app domains.\n * `appKind` namespaces records for documents and container metadata. User-facing\n * list data is projected into feature-specific read models.\n *\n * Columns:\n * - `appKind`: Local domain namespace for the row, such as `documents` or\n * `container-metadata`.\n * - `localId`: Stable local id inside `appKind`. It may be created before a\n * server `documentId` exists.\n * - `documentId`: Server document id once the record is known remotely, or\n * `null` while the document is local-only.\n * - `accessEpoch`: Latest access epoch persisted for the document. Defaults to\n * the initial epoch.\n * - `accessStateHash`: Current document access/manifest state hash returned by\n * sync, when known.\n * - `lastCommitLsn`: Last remote commit cursor applied to this local document.\n * - `documentManifestBundle`: Serialized document manifest bundle used for\n * encrypted document sync.\n * - `contentKeyBundle`: Serialized content-key material needed to open the\n * local document.\n * - `documentKekTargets`: Serialized KEK target state for document key wraps.\n * - `pendingBaseVersion`: Encoded oplog version through which every persisted\n * op is already enqueued or synced. Persisted so a restart restores the\n * outgoing-delta marker instead of re-seeding it past a device-first\n * `deferRemoteSync` write's un-advanced op. `null` when unset.\n * - `snapshotEndVersion`: Encoded end version vector of the persisted content\n * (which lives in the durable-history tables, never on this row), written on\n * every content persist. Lets the pending-write queue's deferred-tail scan\n * compare version coverage without loading content. Empty string when the\n * document has never hydrated content, which readers treat as \"no deferred\n * tail claimable\".\n * - `recoveryGeneration`: Atomic raw-history recovery writer fence.\n * - `recoveryDocumentId`: Former server id for cross-client post-purge recreation.\n * - `pullContinuation`: Durable progress for the next bounded remote pull.\n * - `syncFailureStatus`, `syncFailureMessage`, `syncFailureAttemptedAt`: The\n * last terminal sync failure or quarantined incoming update for this scope.\n * The durable write queue (queued rows of `documentHistoryUpdates`) has no\n * status columns, so these let the write-queue view and footer explain why\n * the document is blocked. `syncFailureMessage` is non-null exactly when a\n * failure is recorded; a newer failure replaces the old, and a later fully\n * validated sync pass, a remote reset, or the scope's teardown clears all\n * three.\n * - `updatedAt`: Local timestamp for the last persisted runtime-state update.\n *\n * Indexes:\n * - `(appKind, localId)` is the primary key and scopes local document lookups.\n * - `(appKind, documentId) where documentId is not null` supports resolving a\n * server document id back to the local row during discovery and relinking.\n */\nexport const documents = sqliteTable(\n \"documents\",\n {\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n documentId: text(\"document_id\"),\n accessEpoch: integer(\"access_epoch\").notNull().default(1),\n accessStateHash: text(\"access_state_hash\"),\n effectiveAccessLevel: text(accessLevelColumn).notNull().default(\"read\"),\n lastCommitLsn: text(\"last_commit_lsn\"),\n documentManifestBundle: text(\"document_manifest_bundle\"),\n contentKeyBundle: text(\"content_key_bundle\"),\n documentKekTargets: text(\"document_kek_targets\"),\n pendingBaseVersion: text(\"pending_base_version\"),\n pullContinuation: text(\"pull_continuation\"),\n recoveryGeneration: integer(\"recovery_generation\").notNull().default(0),\n recoveryDocumentId: text(\"recovery_document_id\"),\n snapshotEndVersion: text(\"snapshot_end_version\").notNull().default(\"\"),\n syncFailureStatus: integer(\"sync_failure_status\"),\n syncFailureMessage: text(\"sync_failure_message\"),\n syncFailureAttemptedAt: text(\"sync_failure_attempted_at\"),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.appKind, table.localId] }),\n index(\"documents_app_document_idx\")\n .on(table.appKind, table.documentId)\n .where(sql`${table.documentId} IS NOT NULL`),\n ],\n);\n\n/**\n * Full-history persistence for local documents (checkpoint + tail) — the ONLY\n * durable content source. Record rows in `documents` carry runtime metadata\n * and the content frontier (`snapshotEndVersion`), never content. The\n * checkpoint holds a full-history snapshot refreshed only at compaction, and\n * the tail appends every update (local deltas and decrypted remote updates)\n * written since. Restore = import checkpoint + replay tail; compaction =\n * export full history from the live doc, replace the checkpoint, clear the\n * tail — all bounded and amortized. Container metadata stores its content (an\n * exported-updates blob) as its checkpoint row, with no tail.\n */\nexport const documentHistoryCheckpoints = sqliteTable(\n \"document_history_checkpoints\",\n {\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n snapshot: text(\"snapshot\").notNull(),\n endVersionVector: text(\"end_version_vector\").notNull(),\n revision: text(\"revision\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.appKind, table.localId] })],\n);\n\n/**\n * The local update log: one row per Loro update, serving as both the history\n * tail (restore = checkpoint + tail) and the outbound write queue.\n *\n * Every locally authored update is stored once. While it waits for sync it\n * carries an `updateId` (the id submitted to the server) and the version-vector\n * metadata the submission needs; settlement clears them, leaving the row as\n * ordinary tail history until compaction folds it into a checkpoint.\n *\n * Columns:\n * - `id`: Row id; tail compaction deletes by it.\n * - `appKind`, `localId`: Document scope matching `documents`.\n * - `updateData`: Serialized Loro update payload.\n * - `origin`: \"local\" (authored on this device) or \"remote\" (decrypted\n * pulled update) for tail rows. Restores use it to advance the\n * outgoing-delta marker across remote rows — their ops are already\n * server-side — while a local row left behind by a crash stays below the\n * marker so the next edit re-derives and sends it. \"outbox\" marks a queued\n * update with no tail role (container metadata, whose content is its\n * checkpoint, and full-state re-uploads after a remote reset); restores and\n * compaction never see it and settlement deletes it.\n * - `createdAt`: Insertion timestamp; with `rowid`, deterministic replay order.\n * - `updateId`: Present exactly while the row is queued for sync; rekeyed\n * after a lost acknowledgement poisons the submitted id.\n * - `partialStartVersionVector` / `partialEndVersionVector`: Version vectors\n * around a queued partial update.\n * - `sourceVersionVector`: Present on a queued rotation baseline checkpoint.\n * - `rekeyCount`: Durable bound on rekeys of a queued row.\n *\n * Invariant: compaction never deletes a queued row, so a checkpoint can cover\n * a queued update's operations without removing it from the queue.\n */\nexport const documentHistoryUpdates = sqliteTable(\n \"document_history_updates\",\n {\n id: text(\"id\"),\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n updateData: text(\"update_data\").notNull(),\n origin: text(\"origin\").notNull(),\n createdAt: text(\"created_at\").notNull(),\n updateId: text(\"update_id\"),\n partialStartVersionVector: text(\"partial_start_version_vector\"),\n partialEndVersionVector: text(\"partial_end_version_vector\"),\n sourceVersionVector: text(\"source_version_vector\"),\n rekeyCount: integer(\"rekey_count\").notNull().default(0),\n },\n (table) => [\n primaryKey({ columns: [table.id] }),\n index(\"document_history_updates_scope_created_idx\").on(\n table.appKind,\n table.localId,\n table.createdAt,\n ),\n uniqueIndex(\"document_history_updates_update_id_idx\")\n .on(table.updateId)\n .where(sql`${table.updateId} IS NOT NULL`),\n ],\n);\n\n/**\n * Anti-rollback pin for verified access manifests.\n *\n * Records the highest access-manifest epoch this client has verified for each\n * object, so a later projection that serves an older epoch (rollback) or a\n * conflicting manifest at the same epoch (equivocation) is detected before any\n * key is unwrapped. Updated monotonically after a projection verifies cleanly.\n *\n * Columns:\n * - `objectKind`: Access object kind (`container`, `document`, ...).\n * - `organizationId`: Organization boundary that owns the object.\n * - `objectId`: Stable object id.\n * - `epoch`: Highest verified manifest epoch.\n * - `manifestHash`: Manifest hash pinned at that epoch.\n * - `updatedAt`: Local timestamp for the pin.\n *\n * Indexes:\n * - `(objectKind, organizationId, objectId)` is the primary key and gives one\n * pin per object.\n */\nexport const accessManifestCheckpoints = sqliteTable(\n \"access_manifest_checkpoints\",\n {\n objectKind: text(\"object_kind\").notNull(),\n organizationId: text(\"organization_id\").notNull(),\n objectId: text(\"object_id\").notNull(),\n epoch: integer(\"epoch\").notNull(),\n manifestHash: text(\"manifest_hash\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({\n columns: [table.objectKind, table.organizationId, table.objectId],\n }),\n ],\n);\n\n/**\n * Durable terminal pins for documents whose signed purge proof was verified.\n * These survive remote-state resets so a dishonest API cannot later replay the\n * pre-purge writer projection and resurrect locally deleted content.\n */\nexport const documentPurgeCheckpoints = sqliteTable(\n \"document_purge_checkpoints\",\n {\n documentId: text(\"document_id\").primaryKey(),\n organizationId: text(\"organization_id\").notNull(),\n documentManifestHash: text(\"document_manifest_hash\").notNull(),\n purgeEventHash: text(\"purge_event_hash\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n);\n\n/**\n * Durable pins for user identity bundles.\n *\n * The first validated identity accepted for a user in a configured API trust\n * domain is inserted once. Later observations must match every suite, public\n * key, and fingerprint exactly; the persistence adapter never changes those\n * columns. `firstSeenAt` records when the local trust decision was made and is\n * likewise immutable. `provenance` (`self`, `link`, or `observed`) records how\n * the pin was established; only `self` and `link` admit a user, and it only\n * rises. A table without it is an obsolete local database.\n *\n * Indexes:\n * - `(identityTrustDomain, userId)` is the primary key and scopes a user pin to\n * the host-configured API authority that supplied it.\n * - `(identityTrustDomain, signingKeyFingerprint)` binds the reverse identity\n * mapping durably, including across session recreation. There is no\n * migration for a table that already violates it. Earlier builds pinned a\n * registration's user id before the server confirmed it, so a device that\n * ran one may hold two users on one key; deployments are greenfield, and\n * such a device clears its local data, which recreates this table empty. A\n * device that used an environment before a reset does the same (see\n * docs/developer/greenfield-reset.md).\n */\nexport const trustedUserIdentityPins = sqliteTable(\n \"trusted_user_identity_pins\",\n {\n identityTrustDomain: text(\"identity_trust_domain\").notNull(),\n userId: text(\"user_id\").notNull(),\n formatVersion: integer(\"format_version\").notNull(),\n signingSuite: text(\"signing_suite\").notNull(),\n signingPublicKey: text(\"signing_public_key\").notNull(),\n signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n encapsulationSuite: text(\"encapsulation_suite\").notNull(),\n encapsulationPublicKey: text(\"encapsulation_public_key\").notNull(),\n encapsulationKeyFingerprint: text(\n \"encapsulation_key_fingerprint\",\n ).notNull(),\n firstSeenAt: text(\"first_seen_at\").notNull(),\n provenance: text(\"provenance\", {\n enum: [\"self\", \"link\", \"observed\"],\n }).notNull(),\n },\n (table) => [\n primaryKey({\n columns: [table.identityTrustDomain, table.userId],\n }),\n uniqueIndex(\"trusted_user_identity_pins_domain_signing_fingerprint_idx\").on(\n table.identityTrustDomain,\n table.signingKeyFingerprint,\n ),\n ],\n);\n\n/**\n * Local many-to-many projection between documents and containers.\n *\n * The document summary row stores one selected `containerId` for primary list\n * placement, while this table keeps the full set of linked containers returned\n * by container/document sync. Removing a container deletes its links and may\n * repair affected document summary rows to point at another remaining link.\n *\n * Columns:\n * - `documentId`: Server document id whose container links are projected.\n * - `containerId`: Linked container id.\n * - `updatedAt`: Local timestamp for the last replacement of the link set.\n *\n * Indexes:\n * - `(documentId, containerId)` is the primary key and prevents duplicate\n * links for the same document/container pair.\n */\nexport const documentContainerProjection = sqliteTable(\n \"document_container_projection\",\n {\n documentId: text(\"document_id\").notNull(),\n containerId: text(\"container_id\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.documentId, table.containerId] })],\n);\n\n/**\n * Queryable document summary and detail projection.\n *\n * The durable Loro state lives in `documents`. This table stores the fields the\n * app needs for document lists, summaries, and fast detail hydration without\n * opening the full Loro snapshot on every read.\n *\n * Columns:\n * - `localId`: Stable local document id. This joins to `documents.localId` for\n * rows where `documents.appKind = documents`.\n * - `documentId`: Server document id when known.\n * - `containerId`: Selected container for primary document placement, or\n * `null` if the document is not currently linked to a visible container.\n * - `organizationId`: Last-known owning organization. Stamped from the\n * container row when the document is detached because its container was\n * removed locally (e.g. access to a shared org was revoked and the container\n * tombstoned), so pending writes keep their org attribution after the\n * `containers` join source disappears. Read as a fallback only — a live\n * container join always wins.\n * - `documentKind`: Stored document kind. Defaults to `note`.\n * - `title`: Plain projected title. Defaults to the note fallback title.\n * - `updatedAt`: Timestamp used for document list ordering.\n *\n * The projected full text lives in `documentProjectionText`, keyed by the same\n * `localId`. Keeping it out of this row keeps list/window scans narrow: the\n * sidebar and summary queries read titles and placement from rows whose size\n * does not grow with document content.\n *\n * Indexes:\n * - `localId` is the primary key for document projection lookups.\n * - `(containerId) where containerId is not null` serves container-scoped\n * window/count scans without walking the whole table.\n * - `(organizationId) where containerId is null` serves the orphan-recovery\n * existence and window scans.\n * - `(documentId) where documentId is not null` serves the linked-placement\n * join from `documentContainerProjection` and server-id lookups.\n */\nexport const documentProjection = sqliteTable(\n \"document_projection\",\n {\n localId: text(\"local_id\"),\n documentId: text(\"document_id\"),\n containerId: text(\"container_id\"),\n organizationId: text(\"organization_id\"),\n documentKind: text(\"document_kind\").notNull().default(\"note\"),\n title: text(\"title\").notNull().default(\"Untitled note\"),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.localId] }),\n index(\"document_projection_container_idx\")\n .on(table.containerId)\n .where(sql`${table.containerId} IS NOT NULL`),\n index(\"document_projection_orphan_organization_idx\")\n .on(table.organizationId)\n .where(sql`${table.containerId} IS NULL`),\n index(\"document_projection_document_idx\")\n .on(table.documentId)\n .where(sql`${table.documentId} IS NOT NULL`),\n ],\n);\n\n/**\n * Projected document text, split from `documentProjection` so content size\n * never bloats the rows that list/window queries scan. Loaded only by detail\n * reads (`loadDocument`) and the save-timestamp change check.\n *\n * Columns:\n * - `localId`: Stable local document id, matching `documentProjection.localId`.\n * - `text`: Plain projected text used to rebuild summaries/details.\n */\nexport const documentProjectionText = sqliteTable(\n \"document_projection_text\",\n {\n localId: text(\"local_id\"),\n text: text(\"text\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.localId] })],\n);\n\n/**\n * Per-lane sync state for container data: the server cursor and the local\n * freshness marker share one row per lane.\n *\n * Container sync is split into lanes, such as a parent-container child lane or\n * a container-document membership lane. The cursor lets the next request\n * resume without replaying the entire tree. The freshness marker records the\n * last fully drained check independently of the cursor: empty server\n * responses do not always carry a new watermark, but startup still needs to\n * know that it recently checked the lane before polling again.\n *\n * Columns:\n * - `laneKind`: Sync lane category, such as `container_parent` or\n * `container_documents`.\n * - `laneId`: Lane identity. Root parent sync uses `root`, child sync uses a\n * parent-prefixed container id, and document lanes use the container id.\n * - `watermarkUpdatedAt`: Server `updatedAt` value for the stored watermark;\n * null until a watermark is saved.\n * - `watermarkId`: Server id tie-breaker for the stored watermark; null\n * exactly when `watermarkUpdatedAt` is.\n * - `updatedAt`: Local timestamp for when the cursor was saved.\n * - `checkedAt`: Local timestamp for the most recent fully drained lane check;\n * null until one completes.\n *\n * Indexes:\n * - `(laneKind, laneId)` is the primary key and stores one row per lane.\n */\nexport const containerSyncWatermarks = sqliteTable(\n \"container_sync_watermarks\",\n {\n laneKind: text(\"lane_kind\").notNull(),\n laneId: text(\"lane_id\").notNull(),\n watermarkUpdatedAt: text(\"watermark_updated_at\"),\n watermarkId: text(\"watermark_id\"),\n updatedAt: text(\"updated_at\"),\n checkedAt: text(\"checked_at\"),\n },\n (table) => [primaryKey({ columns: [table.laneKind, table.laneId] })],\n);\n\nexport const documentTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(documents),\n requiredColumns: [\n \"pull_continuation\",\n \"recovery_generation\",\n \"recovery_document_id\",\n \"sync_failure_status\",\n \"sync_failure_message\",\n \"sync_failure_attempted_at\",\n ],\n },\n defineSqlTableSchema(documentHistoryCheckpoints),\n {\n ...defineSqlTableSchema(documentHistoryUpdates),\n requiredColumns: [\"update_id\"],\n },\n];\n\nexport const principalPolicyTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(principalPolicies),\n requiredColumns: [\"current_grants_json\"],\n },\n {\n ...defineSqlTableSchema(principalPolicyBundleHistory),\n requiredColumns: [\"current_grants_json\"],\n },\n defineSqlTableSchema(principalPolicyBundleReferences),\n defineSqlTableSchema(principalPolicyOrganizations),\n ...principalHistoryStageTables,\n ...principalHistoryEvidenceTables,\n];\n\nexport const keyingCheckpointTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(organizationFounders),\n defineSqlTableSchema(accessManifestCheckpoints),\n defineSqlTableSchema(principalGrantRetirements),\n defineSqlTableSchema(documentPurgeCheckpoints),\n defineSqlTableSchema(principalPolicyCheckpoints),\n];\n\nexport const trustedUserIdentityPinTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(trustedUserIdentityPins),\n requiredColumns: [\"provenance\"],\n },\n];\n\nconst securityIncidentTables: ReadonlyArray<SqlTableSchema> = [\n securityIncidentTable,\n];\n\nexport const containerTables = containerTableSchemas;\n\nexport const documentContainerProjectionTables: ReadonlyArray<SqlTableSchema> =\n [\n defineSqlTableSchema(documentContainerProjection),\n {\n ...defineSqlTableSchema(containerDocumentTombstoneHolds),\n requiredColumns: [\"hidden\"],\n },\n defineSqlTableSchema(pendingDocumentDiscoveries),\n {\n ...defineSqlTableSchema(documentDiscoveryHeads),\n requiredColumns: [\"organization_id\"],\n },\n defineSqlTableSchema(documentDiscoverySequence),\n ];\n\nexport const localIntentTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(localIntents),\n];\n\nexport const documentPlacementIntentTables: ReadonlyArray<SqlTableSchema> = [\n ...localIntentTables,\n defineSqlTableSchema(documentIntentLinkTargets),\n];\n\nexport const documentProjectionTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(documentProjection),\n defineSqlTableSchema(documentProjectionText),\n {\n ...defineSqlTableSchema(documentPendingAttachments),\n requiredColumns: [\"content_sha256\"],\n },\n {\n ...defineSqlTableSchema(documentAttachmentBlobProjection),\n requiredColumns: [\"content_sha256\"],\n },\n documentOrphanBlobReclaimTable,\n];\n\nexport const containerSyncWatermarkTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(containerSyncWatermarks),\n requiredColumns: [\"checked_at\"],\n },\n];\n\nexport const clientSqlTables: ReadonlyArray<SqlTableSchema> = [\n ...principalMutationJournalTables,\n ...documentTables,\n ...principalPolicyTables,\n ...keyingCheckpointTables,\n ...verifiedManifestBundleTables,\n ...trustedUserIdentityPinTables,\n ...securityIncidentTables,\n ...containerTables,\n ...documentContainerProjectionTables,\n ...documentPlacementIntentTables,\n ...documentProjectionTables,\n ...containerSyncWatermarkTables,\n ...organizationReadModelTables,\n ...organizationDataUsage.organizationDataUsageTables,\n ...provisioningAttempt.organizationProvisioningAttemptTables,\n ...organizationSyncPause.organizationSyncPauseTables,\n];\n\nexport const clientSQLiteSchema = {\n principalHistoryNodeReferences,\n principalHistoryRootOwners,\n principalKeyEnvelopeArchive,\n principalMutationJournal,\n principalHistoryEntries,\n principalHistoryNodes,\n principalHistoryPrefixes,\n principalHistoryStages,\n organizationFounders,\n principalGrantRetirements,\n documents,\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyOrganizations,\n accessManifestCheckpoints,\n documentPurgeCheckpoints,\n principalPolicyCheckpoints,\n verifiedAccessManifestBundles,\n trustedUserIdentityPins,\n securityIncidents,\n ...containerSQLiteSchema,\n documentContainerProjection,\n localIntents,\n documentIntentLinkTargets,\n documentProjection,\n documentPendingAttachments,\n documentAttachmentBlobProjection,\n documentOrphanBlobReclaims: documentOrphanBlobReclaims,\n containerSyncWatermarks,\n ...organizationReadModelSQLiteSchema,\n ...organizationDataUsage.organizationDataUsageSQLiteSchema,\n ...provisioningAttempt.organizationProvisioningAttemptSQLiteSchema,\n ...organizationSyncPause.organizationSyncPauseSQLiteSchema,\n};\n"]}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,qBAAqB,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,mBAAmB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,iCAAiC,EACjC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,qBAAqB,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,CAAC;AAExE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAClC,WAAW,EACX;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvE,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACtC,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC;IACxD,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC;IACjD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,sBAAsB,EAAE,IAAI,CAAC,2BAA2B,CAAC;IACzD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,KAAK,CAAC,4BAA4B,CAAC;SAChC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;SACnC,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,UAAU,cAAc,CAAC;CAC/C,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IACd,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,yBAAyB,EAAE,IAAI,CAAC,8BAA8B,CAAC;IAC/D,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC;IAC3D,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;IAClD,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACxD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,CAAC,4CAA4C,CAAC,CAAC,EAAE,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAChB;IACD,WAAW,CAAC,wCAAwC,CAAC;SAClD,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,cAAc,CAAC;IAC5C,2EAA2E;IAC3E,KAAK,CAAC,2CAA2C,CAAC;SAC/C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;SACjD,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,cAAc,CAAC;CAC7C,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAClD,6BAA6B,EAC7B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC;KAClE,CAAC;CACH,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE;IAC5C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE;IAC9D,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,4BAA4B,EAC5B;IACE,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC5D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,kBAAkB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;IACzD,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE;IAClE,2BAA2B,EAAE,IAAI,CAC/B,+BAA+B,CAChC,CAAC,OAAO,EAAE;IACX,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;KACnC,CAAC,CAAC,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC;KACnD,CAAC;IACF,WAAW,CAAC,2DAA2D,CAAC,CAAC,EAAE,CACzE,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,qBAAqB,CAC5B;CACF,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,+BAA+B,EAC/B;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,CACrD,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,UAAU,CACjB;CACF,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAC3C,qBAAqB,EACrB;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,CAAC,mCAAmC,CAAC;SACvC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;SACrB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,WAAW,cAAc,CAAC;IAC/C,KAAK,CAAC,6CAA6C,CAAC;SACjD,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;SACxB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,WAAW,UAAU,CAAC;IAC3C,KAAK,CAAC,kCAAkC,CAAC;SACtC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;SACpB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,UAAU,cAAc,CAAC;CAC/C,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;CAC7B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,2BAA2B,EAC3B;IACE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAkC;IAC3D;QACE,GAAG,oBAAoB,CAAC,SAAS,CAAC;QAClC,eAAe,EAAE;YACf,mBAAmB;YACnB,qBAAqB;YACrB,sBAAsB;YACtB,qBAAqB;YACrB,sBAAsB;YACtB,2BAA2B;SAC5B;KACF;IACD,oBAAoB,CAAC,0BAA0B,CAAC;IAChD;QACE,GAAG,oBAAoB,CAAC,sBAAsB,CAAC;QAC/C,eAAe,EAAE,CAAC,WAAW,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE;QACE,GAAG,oBAAoB,CAAC,iBAAiB,CAAC;QAC1C,eAAe,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD;QACE,GAAG,oBAAoB,CAAC,4BAA4B,CAAC;QACrD,eAAe,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD,oBAAoB,CAAC,+BAA+B,CAAC;IACrD,oBAAoB,CAAC,4BAA4B,CAAC;IAClD,GAAG,2BAA2B;IAC9B,GAAG,8BAA8B;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE,oBAAoB,CAAC,oBAAoB,CAAC;IAC1C,oBAAoB,CAAC,yBAAyB,CAAC;IAC/C,oBAAoB,CAAC,yBAAyB,CAAC;IAC/C,oBAAoB,CAAC,wBAAwB,CAAC;IAC9C,oBAAoB,CAAC,0BAA0B,CAAC;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkC;IACzE;QACE,GAAG,oBAAoB,CAAC,uBAAuB,CAAC;QAChD,eAAe,EAAE,CAAC,YAAY,CAAC;KAChC;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAkC;IAC5D,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,iCAAiC,GAC5C;IACE,oBAAoB,CAAC,2BAA2B,CAAC;IACjD;QACE,GAAG,oBAAoB,CAAC,+BAA+B,CAAC;QACxD,eAAe,EAAE,CAAC,QAAQ,CAAC;KAC5B;IACD,oBAAoB,CAAC,0BAA0B,CAAC;IAChD;QACE,GAAG,oBAAoB,CAAC,sBAAsB,CAAC;QAC/C,eAAe,EAAE,CAAC,iBAAiB,CAAC;KACrC;IACD,oBAAoB,CAAC,yBAAyB,CAAC;CAChD,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,oBAAoB,CAAC,YAAY,CAAC;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,GAAG,iBAAiB;IACpB,oBAAoB,CAAC,yBAAyB,CAAC;CAChD,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAkC;IACrE,oBAAoB,CAAC,kBAAkB,CAAC;IACxC,oBAAoB,CAAC,sBAAsB,CAAC;IAC5C;QACE,GAAG,oBAAoB,CAAC,0BAA0B,CAAC;QACnD,eAAe,EAAE,CAAC,gBAAgB,CAAC;KACpC;IACD;QACE,GAAG,oBAAoB,CAAC,gCAAgC,CAAC;QACzD,eAAe,EAAE,CAAC,gBAAgB,CAAC;KACpC;IACD,8BAA8B;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkC;IACzE;QACE,GAAG,oBAAoB,CAAC,uBAAuB,CAAC;QAChD,eAAe,EAAE,CAAC,YAAY,CAAC;KAChC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAkC;IAC5D,GAAG,8BAA8B;IACjC,GAAG,cAAc;IACjB,GAAG,qBAAqB;IACxB,GAAG,sBAAsB;IACzB,GAAG,4BAA4B;IAC/B,GAAG,4BAA4B;IAC/B,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;IAChC,GAAG,wBAAwB;IAC3B,GAAG,4BAA4B;IAC/B,GAAG,2BAA2B;IAC9B,GAAG,qBAAqB,CAAC,2BAA2B;IACpD,GAAG,mBAAmB,CAAC,qCAAqC;IAC5D,GAAG,qBAAqB,CAAC,2BAA2B;CACrD,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,8BAA8B;IAC9B,0BAA0B;IAC1B,2BAA2B;IAC3B,wBAAwB;IACxB,uBAAuB;IACvB,qBAAqB;IACrB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,SAAS;IACT,iBAAiB;IACjB,4BAA4B;IAC5B,+BAA+B;IAC/B,4BAA4B;IAC5B,yBAAyB;IACzB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,uBAAuB;IACvB,iBAAiB;IACjB,GAAG,qBAAqB;IACxB,2BAA2B;IAC3B,YAAY;IACZ,yBAAyB;IACzB,kBAAkB;IAClB,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B,EAAE,0BAA0B;IACtD,uBAAuB;IACvB,GAAG,iCAAiC;IACpC,GAAG,qBAAqB,CAAC,iCAAiC;IAC1D,GAAG,mBAAmB,CAAC,2CAA2C;IAClE,GAAG,qBAAqB,CAAC,iCAAiC;CAC3D,CAAC","sourcesContent":["import { sql } from \"drizzle-orm\";\nimport {\n index,\n integer,\n primaryKey,\n sqliteTable,\n text,\n uniqueIndex,\n} from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema, type SqlTableSchema } from \"../sqlTableSchema\";\nimport { containerDocumentTombstoneHolds } from \"./containerDocumentTombstoneHoldSchema\";\nimport {\n containerSQLiteSchema,\n containerTableSchemas,\n} from \"./containerSchema\";\nimport {\n documentAttachmentBlobProjection,\n documentPendingAttachments,\n} from \"./documentAttachmentSchema\";\nimport {\n documentDiscoveryHeads,\n documentDiscoverySequence,\n pendingDocumentDiscoveries,\n} from \"./documentDiscoveryEvidenceSchema\";\nimport {\n documentOrphanBlobReclaims,\n documentOrphanBlobReclaimTable,\n} from \"./documentOrphanBlobReclaimSchema\";\nimport { documentIntentLinkTargets } from \"./documentPlacementIntentSchema\";\nimport { localIntents } from \"./localIntentSchema\";\nimport * as organizationDataUsage from \"./organizationDataUsageSchema\";\nimport { organizationFounders } from \"./organizationFounderSchema\";\nimport * as provisioningAttempt from \"./organizationProvisioningAttemptSchema\";\nimport {\n organizationReadModelSQLiteSchema,\n organizationReadModelTables,\n} from \"./organizationReadModelTableRegistry\";\nimport * as organizationSyncPause from \"./organizationSyncPauseSchema\";\nimport { principalGrantRetirements } from \"./principalGrantRetirementSchema\";\nimport {\n principalHistoryEntries,\n principalHistoryEvidenceTables,\n principalHistoryNodes,\n principalHistoryPrefixes,\n} from \"./principalHistoryEvidenceSchema\";\nimport {\n principalHistoryNodeReferences,\n principalHistoryRootOwners,\n} from \"./principalHistoryNodeRetentionSchema\";\nimport { principalKeyEnvelopeArchive } from \"./principalHistoryRetentionSchema\";\nimport {\n principalHistoryStages,\n principalHistoryStageTables,\n} from \"./principalHistoryStageSchema\";\nimport {\n principalMutationJournal,\n principalMutationJournalTables,\n} from \"./principalMutationJournalSchema\";\nimport {\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyCheckpoints,\n principalPolicyOrganizations,\n} from \"./principalPolicySchema\";\nimport {\n securityIncidents,\n securityIncidentTable,\n} from \"./securityIncidentSchema\";\nimport {\n verifiedAccessManifestBundles,\n verifiedManifestBundleTables,\n} from \"./verifiedManifestBundleSchema\";\n\nexport {\n containerHydrationTombstones,\n containers,\n dormantContainerMetadata,\n dormantMetadataSweepRequests,\n supersededContainerBindings,\n} from \"./containerSchema\";\nexport {\n documentAttachmentBlobProjection,\n documentPendingAttachments,\n} from \"./documentAttachmentSchema\";\nexport {\n inContainerIntentLanes,\n inLocalIntentLane,\n LOCAL_INTENT_LANES,\n LOCAL_INTENT_SUBJECT,\n localIntents,\n} from \"./localIntentSchema\";\nexport {\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyCheckpoints,\n principalPolicyOrganizations,\n} from \"./principalPolicySchema\";\nexport { securityIncidents } from \"./securityIncidentSchema\";\nexport { containerDocumentTombstoneHolds, organizationReadModelTables };\n\nconst accessLevelColumn = \"effective_access_level\";\n\n/**\n * Durable Loro-backed document records shared by app features.\n *\n * This table stores encrypted document runtime state for multiple app domains.\n * `appKind` namespaces records for documents and container metadata. User-facing\n * list data is projected into feature-specific read models.\n *\n * Columns:\n * - `appKind`: Local domain namespace for the row, such as `documents` or\n * `container-metadata`.\n * - `localId`: Stable local id inside `appKind`. It may be created before a\n * server `documentId` exists.\n * - `documentId`: Server document id once the record is known remotely, or\n * `null` while the document is local-only.\n * - `accessEpoch`: Latest access epoch persisted for the document. Defaults to\n * the initial epoch.\n * - `accessStateHash`: Current document access/manifest state hash returned by\n * sync, when known.\n * - `lastCommitLsn`: Last remote commit cursor applied to this local document.\n * - `documentManifestBundle`: Serialized document manifest bundle used for\n * encrypted document sync.\n * - `contentKeyBundle`: Serialized content-key material needed to open the\n * local document.\n * - `documentKekTargets`: Serialized KEK target state for document key wraps.\n * - `pendingBaseVersion`: Encoded oplog version through which every persisted\n * op is already enqueued or synced. Persisted so a restart restores the\n * outgoing-delta marker instead of re-seeding it past a device-first\n * `deferRemoteSync` write's un-advanced op. `null` when unset.\n * - `snapshotEndVersion`: Encoded end version vector of the persisted content\n * (which lives in the durable-history tables, never on this row), written on\n * every content persist. Lets the pending-write queue's deferred-tail scan\n * compare version coverage without loading content. Empty string when the\n * document has never hydrated content, which readers treat as \"no deferred\n * tail claimable\".\n * - `recoveryGeneration`: Atomic raw-history recovery writer fence.\n * - `recoveryDocumentId`: Former server id for cross-client post-purge recreation.\n * - `pullContinuation`: Durable progress for the next bounded remote pull.\n * - `syncFailureStatus`, `syncFailureMessage`, `syncFailureAttemptedAt`: The\n * last terminal sync failure or quarantined incoming update for this scope.\n * The durable write queue (queued rows of `documentHistoryUpdates`) has no\n * status columns, so these let the write-queue view and footer explain why\n * the document is blocked. `syncFailureMessage` is non-null exactly when a\n * failure is recorded; a newer failure replaces the old, and a later fully\n * validated sync pass, a remote reset, or the scope's teardown clears all\n * three.\n * - `updatedAt`: Local timestamp for the last persisted runtime-state update.\n *\n * Indexes:\n * - `(appKind, localId)` is the primary key and scopes local document lookups.\n * - `(appKind, documentId) where documentId is not null` supports resolving a\n * server document id back to the local row during discovery and relinking.\n */\nexport const documents = sqliteTable(\n \"documents\",\n {\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n documentId: text(\"document_id\"),\n accessEpoch: integer(\"access_epoch\").notNull().default(1),\n accessStateHash: text(\"access_state_hash\"),\n effectiveAccessLevel: text(accessLevelColumn).notNull().default(\"read\"),\n lastCommitLsn: text(\"last_commit_lsn\"),\n documentManifestBundle: text(\"document_manifest_bundle\"),\n contentKeyBundle: text(\"content_key_bundle\"),\n documentKekTargets: text(\"document_kek_targets\"),\n pendingBaseVersion: text(\"pending_base_version\"),\n pullContinuation: text(\"pull_continuation\"),\n recoveryGeneration: integer(\"recovery_generation\").notNull().default(0),\n recoveryDocumentId: text(\"recovery_document_id\"),\n snapshotEndVersion: text(\"snapshot_end_version\").notNull().default(\"\"),\n syncFailureStatus: integer(\"sync_failure_status\"),\n syncFailureMessage: text(\"sync_failure_message\"),\n syncFailureAttemptedAt: text(\"sync_failure_attempted_at\"),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.appKind, table.localId] }),\n index(\"documents_app_document_idx\")\n .on(table.appKind, table.documentId)\n .where(sql`${table.documentId} IS NOT NULL`),\n ],\n);\n\n/**\n * Full-history persistence for local documents (checkpoint + tail) — the ONLY\n * durable content source. Record rows in `documents` carry runtime metadata\n * and the content frontier (`snapshotEndVersion`), never content. The\n * checkpoint holds a full-history snapshot refreshed only at compaction, and\n * the tail appends every update (local deltas and decrypted remote updates)\n * written since. Restore = import checkpoint + replay tail; compaction =\n * export full history from the live doc, replace the checkpoint, clear the\n * tail — all bounded and amortized. Container metadata stores its content (an\n * exported-updates blob) as its checkpoint row, with no tail.\n */\nexport const documentHistoryCheckpoints = sqliteTable(\n \"document_history_checkpoints\",\n {\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n snapshot: text(\"snapshot\").notNull(),\n endVersionVector: text(\"end_version_vector\").notNull(),\n revision: text(\"revision\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.appKind, table.localId] })],\n);\n\n/**\n * The local update log: one row per Loro update, serving as both the history\n * tail (restore = checkpoint + tail) and the outbound write queue.\n *\n * Every locally authored update is stored once. While it waits for sync it\n * carries an `updateId` (the id submitted to the server) and the version-vector\n * metadata the submission needs; settlement clears them, leaving the row as\n * ordinary tail history until compaction folds it into a checkpoint.\n *\n * Columns:\n * - `id`: Row id; tail compaction deletes by it.\n * - `appKind`, `localId`: Document scope matching `documents`.\n * - `updateData`: Serialized Loro update payload.\n * - `origin`: \"local\" (authored on this device) or \"remote\" (decrypted\n * pulled update) for tail rows. Restores use it to advance the\n * outgoing-delta marker across remote rows — their ops are already\n * server-side — while a local row left behind by a crash stays below the\n * marker so the next edit re-derives and sends it. \"outbox\" marks a queued\n * update with no tail role (container metadata, whose content is its\n * checkpoint, and full-state re-uploads after a remote reset); restores and\n * compaction never see it and settlement deletes it.\n * - `createdAt`: Insertion timestamp; with `rowid`, deterministic replay order.\n * - `updateId`: Present exactly while the row is queued for sync; rekeyed\n * after a lost acknowledgement poisons the submitted id.\n * - `partialStartVersionVector` / `partialEndVersionVector`: Version vectors\n * around a queued partial update.\n * - `sourceVersionVector`: Present on a queued rotation baseline checkpoint.\n * - `rekeyCount`: Durable bound on rekeys of a queued row.\n *\n * Invariant: compaction never deletes a queued row, so a checkpoint can cover\n * a queued update's operations without removing it from the queue.\n */\nexport const documentHistoryUpdates = sqliteTable(\n \"document_history_updates\",\n {\n id: text(\"id\"),\n appKind: text(\"app_kind\").notNull(),\n localId: text(\"local_id\").notNull(),\n updateData: text(\"update_data\").notNull(),\n origin: text(\"origin\").notNull(),\n createdAt: text(\"created_at\").notNull(),\n updateId: text(\"update_id\"),\n partialStartVersionVector: text(\"partial_start_version_vector\"),\n partialEndVersionVector: text(\"partial_end_version_vector\"),\n sourceVersionVector: text(\"source_version_vector\"),\n rekeyCount: integer(\"rekey_count\").notNull().default(0),\n },\n (table) => [\n primaryKey({ columns: [table.id] }),\n index(\"document_history_updates_scope_created_idx\").on(\n table.appKind,\n table.localId,\n table.createdAt,\n ),\n uniqueIndex(\"document_history_updates_update_id_idx\")\n .on(table.updateId)\n .where(sql`${table.updateId} IS NOT NULL`),\n // Queued rows only: pending counts and pending loads skip settled history.\n index(\"document_history_updates_queued_scope_idx\")\n .on(table.appKind, table.localId, table.createdAt)\n .where(sql`${table.updateId} IS NOT NULL`),\n ],\n);\n\n/**\n * Anti-rollback pin for verified access manifests.\n *\n * Records the highest access-manifest epoch this client has verified for each\n * object, so a later projection that serves an older epoch (rollback) or a\n * conflicting manifest at the same epoch (equivocation) is detected before any\n * key is unwrapped. Updated monotonically after a projection verifies cleanly.\n *\n * Columns:\n * - `objectKind`: Access object kind (`container`, `document`, ...).\n * - `organizationId`: Organization boundary that owns the object.\n * - `objectId`: Stable object id.\n * - `epoch`: Highest verified manifest epoch.\n * - `manifestHash`: Manifest hash pinned at that epoch.\n * - `updatedAt`: Local timestamp for the pin.\n *\n * Indexes:\n * - `(objectKind, organizationId, objectId)` is the primary key and gives one\n * pin per object.\n */\nexport const accessManifestCheckpoints = sqliteTable(\n \"access_manifest_checkpoints\",\n {\n objectKind: text(\"object_kind\").notNull(),\n organizationId: text(\"organization_id\").notNull(),\n objectId: text(\"object_id\").notNull(),\n epoch: integer(\"epoch\").notNull(),\n manifestHash: text(\"manifest_hash\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({\n columns: [table.objectKind, table.organizationId, table.objectId],\n }),\n ],\n);\n\n/**\n * Durable terminal pins for documents whose signed purge proof was verified.\n * These survive remote-state resets so a dishonest API cannot later replay the\n * pre-purge writer projection and resurrect locally deleted content.\n */\nexport const documentPurgeCheckpoints = sqliteTable(\n \"document_purge_checkpoints\",\n {\n documentId: text(\"document_id\").primaryKey(),\n organizationId: text(\"organization_id\").notNull(),\n documentManifestHash: text(\"document_manifest_hash\").notNull(),\n purgeEventHash: text(\"purge_event_hash\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n);\n\n/**\n * Durable pins for user identity bundles.\n *\n * The first validated identity accepted for a user in a configured API trust\n * domain is inserted once. Later observations must match every suite, public\n * key, and fingerprint exactly; the persistence adapter never changes those\n * columns. `firstSeenAt` records when the local trust decision was made and is\n * likewise immutable. `provenance` (`self`, `link`, or `observed`) records how\n * the pin was established; only `self` and `link` admit a user, and it only\n * rises. A table without it is an obsolete local database.\n *\n * Indexes:\n * - `(identityTrustDomain, userId)` is the primary key and scopes a user pin to\n * the host-configured API authority that supplied it.\n * - `(identityTrustDomain, signingKeyFingerprint)` binds the reverse identity\n * mapping durably, including across session recreation. There is no\n * migration for a table that already violates it. Earlier builds pinned a\n * registration's user id before the server confirmed it, so a device that\n * ran one may hold two users on one key; deployments are greenfield, and\n * such a device clears its local data, which recreates this table empty. A\n * device that used an environment before a reset does the same (see\n * docs/developer/greenfield-reset.md).\n */\nexport const trustedUserIdentityPins = sqliteTable(\n \"trusted_user_identity_pins\",\n {\n identityTrustDomain: text(\"identity_trust_domain\").notNull(),\n userId: text(\"user_id\").notNull(),\n formatVersion: integer(\"format_version\").notNull(),\n signingSuite: text(\"signing_suite\").notNull(),\n signingPublicKey: text(\"signing_public_key\").notNull(),\n signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n encapsulationSuite: text(\"encapsulation_suite\").notNull(),\n encapsulationPublicKey: text(\"encapsulation_public_key\").notNull(),\n encapsulationKeyFingerprint: text(\n \"encapsulation_key_fingerprint\",\n ).notNull(),\n firstSeenAt: text(\"first_seen_at\").notNull(),\n provenance: text(\"provenance\", {\n enum: [\"self\", \"link\", \"observed\"],\n }).notNull(),\n },\n (table) => [\n primaryKey({\n columns: [table.identityTrustDomain, table.userId],\n }),\n uniqueIndex(\"trusted_user_identity_pins_domain_signing_fingerprint_idx\").on(\n table.identityTrustDomain,\n table.signingKeyFingerprint,\n ),\n ],\n);\n\n/**\n * Local many-to-many projection between documents and containers.\n *\n * The document summary row stores one selected `containerId` for primary list\n * placement, while this table keeps the full set of linked containers returned\n * by container/document sync. Removing a container deletes its links and may\n * repair affected document summary rows to point at another remaining link.\n *\n * Columns:\n * - `documentId`: Server document id whose container links are projected.\n * - `containerId`: Linked container id.\n * - `updatedAt`: Local timestamp for the last replacement of the link set.\n *\n * Indexes:\n * - `(documentId, containerId)` is the primary key and prevents duplicate\n * links for the same document/container pair.\n * - `(containerId, documentId)` serves the container-filtered link scans\n * (folder item and sidebar windows) as a covering index search.\n */\nexport const documentContainerProjection = sqliteTable(\n \"document_container_projection\",\n {\n documentId: text(\"document_id\").notNull(),\n containerId: text(\"container_id\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.documentId, table.containerId] }),\n index(\"document_container_projection_container_idx\").on(\n table.containerId,\n table.documentId,\n ),\n ],\n);\n\n/**\n * Queryable document summary and detail projection.\n *\n * The durable Loro state lives in `documents`. This table stores the fields the\n * app needs for document lists, summaries, and fast detail hydration without\n * opening the full Loro snapshot on every read.\n *\n * Columns:\n * - `localId`: Stable local document id. This joins to `documents.localId` for\n * rows where `documents.appKind = documents`.\n * - `documentId`: Server document id when known.\n * - `containerId`: Selected container for primary document placement, or\n * `null` if the document is not currently linked to a visible container.\n * - `organizationId`: Last-known owning organization. Stamped from the\n * container row when the document is detached because its container was\n * removed locally (e.g. access to a shared org was revoked and the container\n * tombstoned), so pending writes keep their org attribution after the\n * `containers` join source disappears. Read as a fallback only — a live\n * container join always wins.\n * - `documentKind`: Stored document kind. Defaults to `note`.\n * - `title`: Plain projected title. Defaults to the note fallback title.\n * - `updatedAt`: Timestamp used for document list ordering.\n *\n * The projected full text lives in `documentProjectionText`, keyed by the same\n * `localId`. Keeping it out of this row keeps list/window scans narrow: the\n * sidebar and summary queries read titles and placement from rows whose size\n * does not grow with document content.\n *\n * Indexes:\n * - `localId` is the primary key for document projection lookups.\n * - `(containerId) where containerId is not null` serves container-scoped\n * window/count scans without walking the whole table.\n * - `(organizationId) where containerId is null` serves the orphan-recovery\n * existence and window scans.\n * - `(documentId) where documentId is not null` serves the linked-placement\n * join from `documentContainerProjection` and server-id lookups.\n */\nexport const documentProjection = sqliteTable(\n \"document_projection\",\n {\n localId: text(\"local_id\"),\n documentId: text(\"document_id\"),\n containerId: text(\"container_id\"),\n organizationId: text(\"organization_id\"),\n documentKind: text(\"document_kind\").notNull().default(\"note\"),\n title: text(\"title\").notNull().default(\"Untitled note\"),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.localId] }),\n index(\"document_projection_container_idx\")\n .on(table.containerId)\n .where(sql`${table.containerId} IS NOT NULL`),\n index(\"document_projection_orphan_organization_idx\")\n .on(table.organizationId)\n .where(sql`${table.containerId} IS NULL`),\n index(\"document_projection_document_idx\")\n .on(table.documentId)\n .where(sql`${table.documentId} IS NOT NULL`),\n ],\n);\n\n/**\n * Projected document text, split from `documentProjection` so content size\n * never bloats the rows that list/window queries scan. Loaded only by detail\n * reads (`loadDocument`) and the save-timestamp change check.\n *\n * Columns:\n * - `localId`: Stable local document id, matching `documentProjection.localId`.\n * - `text`: Plain projected text used to rebuild summaries/details.\n */\nexport const documentProjectionText = sqliteTable(\n \"document_projection_text\",\n {\n localId: text(\"local_id\"),\n text: text(\"text\").notNull(),\n },\n (table) => [primaryKey({ columns: [table.localId] })],\n);\n\n/**\n * Per-lane sync state for container data: the server cursor and the local\n * freshness marker share one row per lane.\n *\n * Container sync is split into lanes, such as a parent-container child lane or\n * a container-document membership lane. The cursor lets the next request\n * resume without replaying the entire tree. The freshness marker records the\n * last fully drained check independently of the cursor: empty server\n * responses do not always carry a new watermark, but startup still needs to\n * know that it recently checked the lane before polling again.\n *\n * Columns:\n * - `laneKind`: Sync lane category, such as `container_parent` or\n * `container_documents`.\n * - `laneId`: Lane identity. Root parent sync uses `root`, child sync uses a\n * parent-prefixed container id, and document lanes use the container id.\n * - `watermarkUpdatedAt`: Server `updatedAt` value for the stored watermark;\n * null until a watermark is saved.\n * - `watermarkId`: Server id tie-breaker for the stored watermark; null\n * exactly when `watermarkUpdatedAt` is.\n * - `updatedAt`: Local timestamp for when the cursor was saved.\n * - `checkedAt`: Local timestamp for the most recent fully drained lane check;\n * null until one completes.\n *\n * Indexes:\n * - `(laneKind, laneId)` is the primary key and stores one row per lane.\n */\nexport const containerSyncWatermarks = sqliteTable(\n \"container_sync_watermarks\",\n {\n laneKind: text(\"lane_kind\").notNull(),\n laneId: text(\"lane_id\").notNull(),\n watermarkUpdatedAt: text(\"watermark_updated_at\"),\n watermarkId: text(\"watermark_id\"),\n updatedAt: text(\"updated_at\"),\n checkedAt: text(\"checked_at\"),\n },\n (table) => [primaryKey({ columns: [table.laneKind, table.laneId] })],\n);\n\nexport const documentTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(documents),\n requiredColumns: [\n \"pull_continuation\",\n \"recovery_generation\",\n \"recovery_document_id\",\n \"sync_failure_status\",\n \"sync_failure_message\",\n \"sync_failure_attempted_at\",\n ],\n },\n defineSqlTableSchema(documentHistoryCheckpoints),\n {\n ...defineSqlTableSchema(documentHistoryUpdates),\n requiredColumns: [\"update_id\"],\n },\n];\n\nexport const principalPolicyTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(principalPolicies),\n requiredColumns: [\"current_grants_json\"],\n },\n {\n ...defineSqlTableSchema(principalPolicyBundleHistory),\n requiredColumns: [\"current_grants_json\"],\n },\n defineSqlTableSchema(principalPolicyBundleReferences),\n defineSqlTableSchema(principalPolicyOrganizations),\n ...principalHistoryStageTables,\n ...principalHistoryEvidenceTables,\n];\n\nexport const keyingCheckpointTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(organizationFounders),\n defineSqlTableSchema(accessManifestCheckpoints),\n defineSqlTableSchema(principalGrantRetirements),\n defineSqlTableSchema(documentPurgeCheckpoints),\n defineSqlTableSchema(principalPolicyCheckpoints),\n];\n\nexport const trustedUserIdentityPinTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(trustedUserIdentityPins),\n requiredColumns: [\"provenance\"],\n },\n];\n\nconst securityIncidentTables: ReadonlyArray<SqlTableSchema> = [\n securityIncidentTable,\n];\n\nexport const containerTables = containerTableSchemas;\n\nexport const documentContainerProjectionTables: ReadonlyArray<SqlTableSchema> =\n [\n defineSqlTableSchema(documentContainerProjection),\n {\n ...defineSqlTableSchema(containerDocumentTombstoneHolds),\n requiredColumns: [\"hidden\"],\n },\n defineSqlTableSchema(pendingDocumentDiscoveries),\n {\n ...defineSqlTableSchema(documentDiscoveryHeads),\n requiredColumns: [\"organization_id\"],\n },\n defineSqlTableSchema(documentDiscoverySequence),\n ];\n\nexport const localIntentTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(localIntents),\n];\n\nexport const documentPlacementIntentTables: ReadonlyArray<SqlTableSchema> = [\n ...localIntentTables,\n defineSqlTableSchema(documentIntentLinkTargets),\n];\n\nexport const documentProjectionTables: ReadonlyArray<SqlTableSchema> = [\n defineSqlTableSchema(documentProjection),\n defineSqlTableSchema(documentProjectionText),\n {\n ...defineSqlTableSchema(documentPendingAttachments),\n requiredColumns: [\"content_sha256\"],\n },\n {\n ...defineSqlTableSchema(documentAttachmentBlobProjection),\n requiredColumns: [\"content_sha256\"],\n },\n documentOrphanBlobReclaimTable,\n];\n\nexport const containerSyncWatermarkTables: ReadonlyArray<SqlTableSchema> = [\n {\n ...defineSqlTableSchema(containerSyncWatermarks),\n requiredColumns: [\"checked_at\"],\n },\n];\n\nexport const clientSqlTables: ReadonlyArray<SqlTableSchema> = [\n ...principalMutationJournalTables,\n ...documentTables,\n ...principalPolicyTables,\n ...keyingCheckpointTables,\n ...verifiedManifestBundleTables,\n ...trustedUserIdentityPinTables,\n ...securityIncidentTables,\n ...containerTables,\n ...documentContainerProjectionTables,\n ...documentPlacementIntentTables,\n ...documentProjectionTables,\n ...containerSyncWatermarkTables,\n ...organizationReadModelTables,\n ...organizationDataUsage.organizationDataUsageTables,\n ...provisioningAttempt.organizationProvisioningAttemptTables,\n ...organizationSyncPause.organizationSyncPauseTables,\n];\n\nexport const clientSQLiteSchema = {\n principalHistoryNodeReferences,\n principalHistoryRootOwners,\n principalKeyEnvelopeArchive,\n principalMutationJournal,\n principalHistoryEntries,\n principalHistoryNodes,\n principalHistoryPrefixes,\n principalHistoryStages,\n organizationFounders,\n principalGrantRetirements,\n documents,\n principalPolicies,\n principalPolicyBundleHistory,\n principalPolicyBundleReferences,\n principalPolicyOrganizations,\n accessManifestCheckpoints,\n documentPurgeCheckpoints,\n principalPolicyCheckpoints,\n verifiedAccessManifestBundles,\n trustedUserIdentityPins,\n securityIncidents,\n ...containerSQLiteSchema,\n documentContainerProjection,\n localIntents,\n documentIntentLinkTargets,\n documentProjection,\n documentPendingAttachments,\n documentAttachmentBlobProjection,\n documentOrphanBlobReclaims: documentOrphanBlobReclaims,\n containerSyncWatermarks,\n ...organizationReadModelSQLiteSchema,\n ...organizationDataUsage.organizationDataUsageSQLiteSchema,\n ...provisioningAttempt.organizationProvisioningAttemptSQLiteSchema,\n ...organizationSyncPause.organizationSyncPauseSQLiteSchema,\n};\n"]}
|
|
@@ -8,7 +8,6 @@ export const principalPolicyOrganizations = sqliteTable("principal_policy_organi
|
|
|
8
8
|
organizationId: text("organization_id").notNull(),
|
|
9
9
|
}, (table) => [
|
|
10
10
|
primaryKey({ columns: [table.principalType, table.principalId] }),
|
|
11
|
-
index("principal_policy_organizations_organization_idx").on(table.organizationId),
|
|
12
11
|
]);
|
|
13
12
|
function principalPolicyBundleColumns() {
|
|
14
13
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC;AAEF,SAAS,4BAA4B;IACnC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACtD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAChE,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;QACxD,0BAA0B,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC,OAAO,EAAE;QAC3E,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC1C,oBAAoB,EACpB,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAChD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;KACnE,CAAC;IACF,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;CACrD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,eAAe;SACtB;KACF,CAAC;CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport {\n index,\n integer,\n primaryKey,\n sqliteTable,\n text,\n} from \"drizzle-orm/sqlite-core\";\n\nimport { principalStateFingerprintJson } from \"../principalKeyFingerprintJson\";\n\n/** Durable organization ownership for every managed-principal cache. */\nexport const principalPolicyOrganizations = sqliteTable(\n \"principal_policy_organizations\",\n {\n principalType: text(\"principal_type\").notNull(),\n principalId: text(\"principal_id\").notNull(),\n organizationId: text(\"organization_id\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.principalType, table.principalId] }),\n ],\n);\n\nfunction principalPolicyBundleColumns() {\n return {\n principalType: text(\"principal_type\").notNull(),\n principalId: text(\"principal_id\").notNull(),\n stateHash: text(\"state_hash\").notNull(),\n currentStateJson: text(\"current_state_json\").notNull(),\n currentPayloadJson: text(\"current_payload_json\").notNull(),\n currentProjectionJson: text(\"current_projection_json\").notNull(),\n currentGrantsJson: text(\"current_grants_json\").notNull(),\n currentMemberEnvelopesJson: text(\"current_member_envelopes_json\").notNull(),\n previousStatesJson: text(\"previous_states_json\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n };\n}\n\n/** Latest full policy bundle per managed principal. */\nexport const principalPolicies = sqliteTable(\n \"principal_policies\",\n principalPolicyBundleColumns(),\n (table) => [\n primaryKey({ columns: [table.principalType, table.principalId] }),\n index(\"principal_policies_key_fingerprint_idx\").on(\n principalStateFingerprintJson(table.currentStateJson),\n desc(table.updatedAt),\n ),\n ],\n);\n\n/** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */\nexport const principalPolicyBundleHistory = sqliteTable(\n \"principal_policy_bundle_history\",\n principalPolicyBundleColumns(),\n (table) => [\n primaryKey({\n columns: [table.principalType, table.principalId, table.stateHash],\n }),\n index(\"principal_policy_history_key_fingerprint_idx\").on(\n principalStateFingerprintJson(table.currentStateJson),\n desc(table.updatedAt),\n ),\n ],\n);\n\n/** Exact policy states mapped to every retained bundle chain that contains them. */\nexport const principalPolicyBundleReferences = sqliteTable(\n \"principal_policy_bundle_references\",\n {\n principalType: text(\"principal_type\").notNull(),\n principalId: text(\"principal_id\").notNull(),\n version: integer(\"version\").notNull(),\n stateHash: text(\"state_hash\").notNull(),\n keyEpoch: integer(\"key_epoch\").notNull(),\n keyFingerprint: text(\"key_fingerprint\").notNull(),\n bundleVersion: integer(\"bundle_version\").notNull(),\n bundleStateHash: text(\"bundle_state_hash\").notNull(),\n },\n (table) => [\n primaryKey({\n columns: [\n table.principalType,\n table.principalId,\n table.version,\n table.stateHash,\n table.keyEpoch,\n table.keyFingerprint,\n table.bundleStateHash,\n ],\n }),\n ],\n);\n\n/** Monotonic anti-rollback pin for each verified managed principal. */\nexport const principalPolicyCheckpoints = sqliteTable(\n \"principal_policy_checkpoints\",\n {\n principalType: text(\"principal_type\").notNull(),\n principalId: text(\"principal_id\").notNull(),\n version: integer(\"version\").notNull(),\n stateHash: text(\"state_hash\").notNull(),\n updatedAt: text(\"updated_at\").notNull(),\n },\n (table) => [\n primaryKey({ columns: [table.principalType, table.principalId] }),\n ],\n);\n"]}
|
|
@@ -6,10 +6,15 @@ import { type SqlTableSchema } from "../sqlTableSchema.js";
|
|
|
6
6
|
* verifies the rebuilt projection from scratch. Rows are neither trust nor
|
|
7
7
|
* checkpoint state: a missing, evicted, or damaged row only costs bytes.
|
|
8
8
|
*
|
|
9
|
+
* Container KEK levels share the table as typed rows (`objectKind`
|
|
10
|
+
* `container-kek-level`), keyed by the SHA-256 of their canonical wire bytes.
|
|
11
|
+
*
|
|
9
12
|
* Columns:
|
|
10
|
-
* - `manifestHash`:
|
|
13
|
+
* - `manifestHash`: Citation key: the stored bundle's `manifestHash`, or a
|
|
14
|
+
* level row's digest.
|
|
11
15
|
* - `organizationId`, `objectKind`, `objectId`, `epoch`: The verified
|
|
12
|
-
* manifest's object
|
|
16
|
+
* manifest's object (or the level's container and key epoch), used to cite
|
|
17
|
+
* the lineage relevant to a request.
|
|
13
18
|
* - `bundleJson`: The exact verified bundle as JSON.
|
|
14
19
|
* - `bundleDigest`: SHA-256 hex of `bundleJson`; a mismatch drops the row.
|
|
15
20
|
* - `verifiedAt`: Latest local verification time; oldest rows evict first.
|