@tearleads/client-sdk 0.1.14 → 0.1.15

package/internal/validators/response/projectionPolicyEvidence.js

@@ -1,9 +1,14 @@
 import { arraySchema, loosePlainObject } from "../schema.js";
-import { PrincipalPolicySnapshotResponseSchema, PrincipalStatePayloadResponseSchema, } from "./principalSnapshot.js";
-/** Public authorization history only; never group payloads or member envelopes. */
+import { PrincipalPolicyHistorySourceResponseSchema } from "./principalPolicySnapshotPage.js";
+import { ReferencedPrincipalStateResponseSchema } from "./principalReference.js";
+import { PrincipalStatePayloadResponseSchema } from "./principalSnapshot.js";
+/** Pinned public history sources plus the signed directory payloads they need. */
 export const ProjectionPolicyEvidenceResponseSchema = loosePlainObject({
-    organization: PrincipalPolicySnapshotResponseSchema.nullable(),
-    organizationPayloads: arraySchema(PrincipalStatePayloadResponseSchema),
-    groups: arraySchema(PrincipalPolicySnapshotResponseSchema),
+    organization: PrincipalPolicyHistorySourceResponseSchema.nullable(),
+    organizationPayloads: arraySchema(loosePlainObject({
+        reference: ReferencedPrincipalStateResponseSchema,
+        payload: PrincipalStatePayloadResponseSchema,
+    })),
+    groups: arraySchema(PrincipalPolicyHistorySourceResponseSchema),
 });
 //# sourceMappingURL=projectionPolicyEvidence.js.map

package/internal/validators/response/projectionPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GACpC,MAAM,qBAAqB,CAAC;AAE7B,mFAAmF;AACnF,MAAM,CAAC,MAAM,sCAAsC,GAAG,gBAAgB,CAAC;IACrE,YAAY,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAC9D,oBAAoB,EAAE,WAAW,CAAC,mCAAmC,CAAC;IACtE,MAAM,EAAE,WAAW,CAAC,qCAAqC,CAAC;CAC3D,CAAC,CAAC","sourcesContent":["import type { z } from \"zod\";\nimport { arraySchema, loosePlainObject } from \"../schema\";\nimport {\n  PrincipalPolicySnapshotResponseSchema,\n  PrincipalStatePayloadResponseSchema,\n} from \"./principalSnapshot\";\n\n/** Public authorization history only; never group payloads or member envelopes. */\nexport const ProjectionPolicyEvidenceResponseSchema = loosePlainObject({\n  organization: PrincipalPolicySnapshotResponseSchema.nullable(),\n  organizationPayloads: arraySchema(PrincipalStatePayloadResponseSchema),\n  groups: arraySchema(PrincipalPolicySnapshotResponseSchema),\n});\n\nexport type ProjectionPolicyEvidenceResponse = z.infer<\n  typeof ProjectionPolicyEvidenceResponseSchema\n>;\n"]}
+{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAE1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,sCAAsC,GAAG,gBAAgB,CAAC;IACrE,YAAY,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACnE,oBAAoB,EAAE,WAAW,CAC/B,gBAAgB,CAAC;QACf,SAAS,EAAE,sCAAsC;QACjD,OAAO,EAAE,mCAAmC;KAC7C,CAAC,CACH;IACD,MAAM,EAAE,WAAW,CAAC,0CAA0C,CAAC;CAChE,CAAC,CAAC","sourcesContent":["import type { z } from \"zod\";\nimport { arraySchema, loosePlainObject } from \"../schema\";\nimport { PrincipalPolicyHistorySourceResponseSchema } from \"./principalPolicySnapshotPage\";\nimport { ReferencedPrincipalStateResponseSchema } from \"./principalReference\";\nimport { PrincipalStatePayloadResponseSchema } from \"./principalSnapshot\";\n\n/** Pinned public history sources plus the signed directory payloads they need. */\nexport const ProjectionPolicyEvidenceResponseSchema = loosePlainObject({\n  organization: PrincipalPolicyHistorySourceResponseSchema.nullable(),\n  organizationPayloads: arraySchema(\n    loosePlainObject({\n      reference: ReferencedPrincipalStateResponseSchema,\n      payload: PrincipalStatePayloadResponseSchema,\n    }),\n  ),\n  groups: arraySchema(PrincipalPolicyHistorySourceResponseSchema),\n});\n\nexport type ProjectionPolicyEvidenceResponse = z.infer<\n  typeof ProjectionPolicyEvidenceResponseSchema\n>;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/stores/documents/documentStore/attachmentHydration.js

@@ -2,6 +2,7 @@
 import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
 import { hydrateDocumentAttachmentBlobs } from "../../../workflows/blobs/index.js";
 import { reclaimDocumentOrphanBlobs, } from "../../../workflows/documents/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../workflows/principals/runtimePolicyWarmer.js";
 import { commitHydratedAttachment } from "./attachmentHydrationCommit.js";
 import { isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent, } from "./syncGeneration.js";
 export async function hydrateAttachmentBlobs(state, currentDoc, currentRecord, expectedGeneration) {
@@ -34,6 +35,8 @@ export async function hydrateAttachmentBlobs(state, currentDoc, currentRecord, e
         resolveProjectionUserKey: expectedGeneration?.resolveProjectionUserKey ??
             state.resolveProjectionUserKey,
         targetSecretKey: encapsulationKeyPair.secretKey,
+        stillCurrent: generationIsCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
     });
     if (!generationIsCurrent())
         return;

package/stores/documents/documentStore/attachmentHydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachmentHydration.js","sourceRoot":"","sources":["attachmentHydration.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAEL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAEL,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAAyB,EACzB,aAAoC,EACpC,kBAAgD;IAEhD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACjE,IACE,CAAC,oBAAoB;QACrB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QACrB,CAAC,aAAa,EAAE,UAAU,EAC1B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,KAAK,CAAC,wBAAwB;QACnD,uBAAuB,EAAE,KAAK,CAAC,4BAA4B;QAC3D,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,sBAAsB,EAAE,KAAK,CAAC,gCAAgC;QAC9D,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,wBAAwB,EACtB,kBAAkB,EAAE,wBAAwB;YAC5C,KAAK,CAAC,wBAAwB;QAChC,eAAe,EAAE,oBAAoB,CAAC,SAAS;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IACnC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,wBAAwB,CAAC;YAC7B,KAAK;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB;YACnB,kBAAkB,EAChB,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["/** Hydrate only bytes matching the current document's authenticated attachment intent. */\nimport { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n  type DocumentRecord,\n  reclaimDocumentOrphanBlobs,\n} from \"../../../workflows/documents\";\nimport { commitHydratedAttachment } from \"./attachmentHydrationCommit\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nexport async function hydrateAttachmentBlobs(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord | null,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  const generationIsCurrent = () =>\n    !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);\n  if (!generationIsCurrent()) return;\n\n  const runtime = state.runtime;\n  const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;\n  if (\n    !encapsulationKeyPair ||\n    !runtime.auth.isAuthenticated ||\n    !runtime.state.online ||\n    !currentRecord?.documentId\n  ) {\n    return;\n  }\n\n  const attachments = getDocumentAttachments(currentDoc);\n  if (attachments.length === 0) {\n    return;\n  }\n\n  const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };\n  const hydratedBlobs = await hydrateDocumentAttachmentBlobs({\n    apiClient: runtime.apiClient,\n    attachments,\n    documentId: currentRecord.documentId,\n    execSql: runtime.infra.execSql,\n    localBlobIdBySlotId: state.attachmentBlobIdBySlotId,\n    localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,\n    log: runtime.util.log,\n    rejectedServedBindings: state.rejectedServedAttachmentBindings,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveProjectionUserKey:\n      expectedGeneration?.resolveProjectionUserKey ??\n      state.resolveProjectionUserKey,\n    targetSecretKey: encapsulationKeyPair.secretKey,\n  });\n  if (!generationIsCurrent()) return;\n  if (!hydratedBlobs) {\n    return;\n  }\n\n  for (const hydratedBlob of hydratedBlobs) {\n    await commitHydratedAttachment({\n      state,\n      currentDoc,\n      hydratedBlob,\n      generationIsCurrent,\n      expectedStorageKey:\n        expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,\n    });\n  }\n  await reclaimDocumentOrphanBlobs(runtime);\n}\n"]}
+{"version":3,"file":"attachmentHydration.js","sourceRoot":"","sources":["attachmentHydration.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAEL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAEL,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAAyB,EACzB,aAAoC,EACpC,kBAAgD;IAEhD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACjE,IACE,CAAC,oBAAoB;QACrB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QACrB,CAAC,aAAa,EAAE,UAAU,EAC1B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,KAAK,CAAC,wBAAwB;QACnD,uBAAuB,EAAE,KAAK,CAAC,4BAA4B;QAC3D,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,sBAAsB,EAAE,KAAK,CAAC,gCAAgC;QAC9D,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,wBAAwB,EACtB,kBAAkB,EAAE,wBAAwB;YAC5C,KAAK,CAAC,wBAAwB;QAChC,eAAe,EAAE,oBAAoB,CAAC,SAAS;QAC/C,YAAY,EAAE,mBAAmB;QACjC,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IACnC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,wBAAwB,CAAC;YAC7B,KAAK;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB;YACnB,kBAAkB,EAChB,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["/** Hydrate only bytes matching the current document's authenticated attachment intent. */\n\nimport { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n  type DocumentRecord,\n  reclaimDocumentOrphanBlobs,\n} from \"../../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../workflows/principals/runtimePolicyWarmer\";\nimport { commitHydratedAttachment } from \"./attachmentHydrationCommit\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nexport async function hydrateAttachmentBlobs(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord | null,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  const generationIsCurrent = () =>\n    !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);\n  if (!generationIsCurrent()) return;\n\n  const runtime = state.runtime;\n  const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;\n  if (\n    !encapsulationKeyPair ||\n    !runtime.auth.isAuthenticated ||\n    !runtime.state.online ||\n    !currentRecord?.documentId\n  ) {\n    return;\n  }\n\n  const attachments = getDocumentAttachments(currentDoc);\n  if (attachments.length === 0) {\n    return;\n  }\n\n  const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };\n  const hydratedBlobs = await hydrateDocumentAttachmentBlobs({\n    apiClient: runtime.apiClient,\n    attachments,\n    documentId: currentRecord.documentId,\n    execSql: runtime.infra.execSql,\n    localBlobIdBySlotId: state.attachmentBlobIdBySlotId,\n    localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,\n    log: runtime.util.log,\n    rejectedServedBindings: state.rejectedServedAttachmentBindings,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveProjectionUserKey:\n      expectedGeneration?.resolveProjectionUserKey ??\n      state.resolveProjectionUserKey,\n    targetSecretKey: encapsulationKeyPair.secretKey,\n    stillCurrent: generationIsCurrent,\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  });\n  if (!generationIsCurrent()) return;\n  if (!hydratedBlobs) {\n    return;\n  }\n\n  for (const hydratedBlob of hydratedBlobs) {\n    await commitHydratedAttachment({\n      state,\n      currentDoc,\n      hydratedBlob,\n      generationIsCurrent,\n      expectedStorageKey:\n        expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,\n    });\n  }\n  await reclaimDocumentOrphanBlobs(runtime);\n}\n"]}

package/stores/documents/documentStore/syncDetachedAttachments.js

@@ -1,6 +1,7 @@
 import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
 import { detachDocumentAttachment } from "../../../workflows/blobs/detach.js";
 import { reclaimDocumentOrphanBlobs, resolveDocumentCreateAuthor, } from "../../../workflows/documents/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../workflows/principals/runtimePolicyWarmer.js";
 import { deleteLocalAttachmentRecord } from "./attachmentPersistence.js";
 import { isDocumentStoreSyncGenerationCurrent, } from "./syncGeneration.js";
 import { documentSyncContextMatches } from "./syncUpdateImport.js";
@@ -102,6 +103,8 @@ async function syncDetachedAttachmentBinding(input) {
         },
         resolveProjectionUserKey: generation.resolveProjectionUserKey,
         slotId: binding.slotId,
+        stillCurrent: contextIsCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(state.runtime),
     };
     let detached = await detachDocumentAttachment({
         ...baseDetachInput,

package/stores/documents/documentStore/syncDetachedAttachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncDetachedAttachments.js","sourceRoot":"","sources":["syncDetachedAttachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAEL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAMtE,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAO/E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAyB,EACzB,UAA0B,EAC1B,UAAuC;IAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,gCAAgC,CACpC,KAAK,EACL,UAAU,EACV,UAAU,EACV,eAAe,EACf,UAAU,CACX,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC/C,MAAM,cAAc,GAClB,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC1E,IACE,CAAC,cAAc;QACf,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC3D,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;gBACnD,OAAO,EAAE,aAAa;gBACtB,UAAU;gBACV,gBAAgB;gBAChB,aAAa,EAAE,UAAU;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,+BAA+B,CACnD,KAAK,EACL,UAAU,EACV,UAAU,EACV,MAAM,EACN,UAAU,CACX,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAyB,EACzB,UAAuC,EACvC,aAA6B;IAE7B,OAAO,CACL,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;QACvD,0BAA0B,CACxB,KAAK,CAAC,MAAM,EACZ,aAAa,EACb,aAAa,CAAC,UAAU,CACzB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAyB,EACzB,UAAyB;IAEzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,sBAAsB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1E,CAAC;IAEF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAC/D,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CACvB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,OAA4C,EAC5C,UAAuC;IAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,CAAC,CAAC,MAAM,+BAA+B,CACrC,KAAK,EACL,UAAU,EACV,aAAa,EACb,MAAM,EACN,UAAU,CACX,CAAC,EACF,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,MAAgC,EAChC,UAAuC;IAEvC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,2BAA2B,CAC/B,KAAK,EACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,UAAU,EACjB,UAAU,CACX,CAAC;IACF,uEAAuE;IACvE,KAAK,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAM5C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iFAAiF,CAClF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,KAAK,CAAC,gBAAgB;QAC3D,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACxB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,eAAe,GAAG;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,mBAAmB,EAAE,CAAC,cAAsB,EAAE,EAAE;YAC9C,iBAAiB;gBACf,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YACpE,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;QAC7D,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC5C,GAAG,eAAe;QAClB,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC9B,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,EAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+BAA+B,CAC7B,KAAK,EACL,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,uBAAuB,OAAO,CAAC,MAAM,kBAAkB,KAAK,CAAC,gBAAgB,GAAG,CACjF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport { detachDocumentAttachment } from \"../../../workflows/blobs/detach\";\nimport {\n  type DocumentRecord,\n  reclaimDocumentOrphanBlobs,\n  resolveDocumentCreateAuthor,\n} from \"../../../workflows/documents\";\nimport { deleteLocalAttachmentRecord } from \"./attachmentPersistence\";\nimport type {\n  DocumentAttachmentBinding,\n  DocumentState,\n  DocumentStoreState,\n} from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { documentSyncContextMatches } from \"./syncUpdateImport\";\nimport { installDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\ninterface DetachedAttachmentMarker {\n  slotId: string;\n  storageKey: string;\n}\n\nexport async function syncDetachedAttachmentBindings(\n  state: DocumentStoreState,\n  nextRecord: DocumentRecord,\n  generation: DocumentStoreSyncGeneration,\n): Promise<void> {\n  const currentDoc = generation.currentDoc;\n  if (\n    !currentDoc ||\n    !detachedSyncContextIsCurrent(state, generation, nextRecord)\n  ) {\n    return;\n  }\n\n  const detachedMarkers = listDetachedAttachmentMarkers(state, currentDoc);\n  if (detachedMarkers.length === 0) {\n    return;\n  }\n\n  if (!nextRecord.documentId) {\n    await cleanupDetachedAttachmentMarkers(\n      state,\n      currentDoc,\n      nextRecord,\n      detachedMarkers,\n      generation,\n    );\n    return;\n  }\n\n  const remoteDocumentId = nextRecord.documentId;\n  const remoteBindings =\n    await state.runtime.apiClient.listDocumentAttachments(remoteDocumentId);\n  if (\n    !remoteBindings ||\n    !detachedSyncContextIsCurrent(state, generation, nextRecord)\n  ) {\n    return;\n  }\n\n  const activeBindingBySlotId = new Map(\n    remoteBindings.map((binding) => [binding.slotId, binding]),\n  );\n\n  for (const marker of detachedMarkers) {\n    if (!detachedSyncContextIsCurrent(state, generation, nextRecord)) {\n      return;\n    }\n    const activeBinding = activeBindingBySlotId.get(marker.slotId);\n    if (activeBinding) {\n      const detached = await syncDetachedAttachmentBinding({\n        binding: activeBinding,\n        generation,\n        remoteDocumentId,\n        requestRecord: nextRecord,\n        state,\n      });\n      if (!detached) {\n        return;\n      }\n    }\n\n    const cleaned = await cleanupDetachedAttachmentMarker(\n      state,\n      currentDoc,\n      nextRecord,\n      marker,\n      generation,\n    );\n    if (!cleaned) {\n      return;\n    }\n  }\n}\n\nfunction detachedSyncContextIsCurrent(\n  state: DocumentStoreState,\n  generation: DocumentStoreSyncGeneration,\n  requestRecord: DocumentRecord,\n): boolean {\n  return (\n    isDocumentStoreSyncGenerationCurrent(state, generation) &&\n    documentSyncContextMatches(\n      state.record,\n      requestRecord,\n      requestRecord.documentId,\n    )\n  );\n}\n\nfunction listDetachedAttachmentMarkers(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n): DetachedAttachmentMarker[] {\n  const currentSlotIds = new Set(\n    getDocumentAttachments(currentDoc).map((attachment) => attachment.slotId),\n  );\n\n  return Object.entries(state.attachmentStorageKeyBySlotId).flatMap(\n    ([slotId, storageKey]) =>\n      currentSlotIds.has(slotId) ? [] : [{ slotId, storageKey }],\n  );\n}\n\nasync function cleanupDetachedAttachmentMarkers(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  requestRecord: DocumentRecord,\n  markers: readonly DetachedAttachmentMarker[],\n  generation: DocumentStoreSyncGeneration,\n): Promise<void> {\n  for (const marker of markers) {\n    if (\n      !(await cleanupDetachedAttachmentMarker(\n        state,\n        currentDoc,\n        requestRecord,\n        marker,\n        generation,\n      ))\n    ) {\n      return;\n    }\n  }\n}\n\nasync function cleanupDetachedAttachmentMarker(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  requestRecord: DocumentRecord,\n  marker: DetachedAttachmentMarker,\n  generation: DocumentStoreSyncGeneration,\n): Promise<boolean> {\n  if (!detachedSyncContextIsCurrent(state, generation, requestRecord)) {\n    return false;\n  }\n  await deleteLocalAttachmentRecord(\n    state,\n    marker.slotId,\n    marker.storageKey,\n    currentDoc,\n  );\n  // Deleting the row queued its bytes for the reference-checked reclaim.\n  void reclaimDocumentOrphanBlobs(state.runtime);\n  return detachedSyncContextIsCurrent(state, generation, requestRecord);\n}\n\nasync function syncDetachedAttachmentBinding(input: {\n  binding: DocumentAttachmentBinding;\n  generation: DocumentStoreSyncGeneration;\n  remoteDocumentId: string;\n  requestRecord: DocumentRecord;\n  state: DocumentStoreState;\n}): Promise<boolean> {\n  const { binding, generation, requestRecord, state } = input;\n  const contextIsCurrent = () =>\n    detachedSyncContextIsCurrent(state, generation, requestRecord);\n  if (!contextIsCurrent()) return false;\n\n  const author = resolveDocumentCreateAuthor(state.runtime);\n  if (!author) {\n    state.runtime.util.log(\n      \"Documents: skipped attachment detach because the writer context is unavailable.\",\n    );\n    return false;\n  }\n\n  const writerProjection =\n    state.writerProjection?.documentId === input.remoteDocumentId\n      ? state.writerProjection\n      : null;\n  const writerProjectionGeneration = state.writerProjectionGeneration;\n  let remoteSyncBlocked = false;\n  const baseDetachInput = {\n    apiClient: state.runtime.apiClient,\n    author,\n    bindingId: binding.bindingId,\n    blobId: binding.blobId,\n    documentId: input.remoteDocumentId,\n    execSql: generation.execSql,\n    isRemoteSyncBlocked: (organizationId: string) => {\n      remoteSyncBlocked =\n        state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;\n      return remoteSyncBlocked;\n    },\n    resolveProjectionUserKey: generation.resolveProjectionUserKey,\n    slotId: binding.slotId,\n  };\n  let detached = await detachDocumentAttachment({\n    ...baseDetachInput,\n    writerProjection: writerProjection ?? undefined,\n  });\n  if (!contextIsCurrent()) return false;\n  if (!detached && writerProjection && !remoteSyncBlocked) {\n    state.writerProjection = null;\n    detached = await detachDocumentAttachment(baseDetachInput);\n    if (!contextIsCurrent()) return false;\n  }\n  if (!detached) {\n    return false;\n  }\n\n  installDocumentWriterProjection(\n    state,\n    detached.writerProjection,\n    writerProjectionGeneration,\n  );\n  state.runtime.util.log(\n    `Detached attachment ${binding.slotId} from document ${input.remoteDocumentId}.`,\n  );\n  return true;\n}\n"]}
+{"version":3,"file":"syncDetachedAttachments.js","sourceRoot":"","sources":["syncDetachedAttachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAEL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAMtE,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAO/E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAyB,EACzB,UAA0B,EAC1B,UAAuC;IAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,gCAAgC,CACpC,KAAK,EACL,UAAU,EACV,UAAU,EACV,eAAe,EACf,UAAU,CACX,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC/C,MAAM,cAAc,GAClB,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC1E,IACE,CAAC,cAAc;QACf,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC3D,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;gBACnD,OAAO,EAAE,aAAa;gBACtB,UAAU;gBACV,gBAAgB;gBAChB,aAAa,EAAE,UAAU;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,+BAA+B,CACnD,KAAK,EACL,UAAU,EACV,UAAU,EACV,MAAM,EACN,UAAU,CACX,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAyB,EACzB,UAAuC,EACvC,aAA6B;IAE7B,OAAO,CACL,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;QACvD,0BAA0B,CACxB,KAAK,CAAC,MAAM,EACZ,aAAa,EACb,aAAa,CAAC,UAAU,CACzB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAyB,EACzB,UAAyB;IAEzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,sBAAsB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1E,CAAC;IAEF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAC/D,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CACvB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,OAA4C,EAC5C,UAAuC;IAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,CAAC,CAAC,MAAM,+BAA+B,CACrC,KAAK,EACL,UAAU,EACV,aAAa,EACb,MAAM,EACN,UAAU,CACX,CAAC,EACF,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,KAAyB,EACzB,UAAyB,EACzB,aAA6B,EAC7B,MAAgC,EAChC,UAAuC;IAEvC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,2BAA2B,CAC/B,KAAK,EACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,UAAU,EACjB,UAAU,CACX,CAAC;IACF,uEAAuE;IACvE,KAAK,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAM5C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iFAAiF,CAClF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,KAAK,CAAC,gBAAgB;QAC3D,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACxB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,eAAe,GAAG;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,mBAAmB,EAAE,CAAC,cAAsB,EAAE,EAAE;YAC9C,iBAAiB;gBACf,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YACpE,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;QAC7D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,gBAAgB;QAC9B,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC;IACF,IAAI,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC5C,GAAG,eAAe;QAClB,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC9B,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,EAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+BAA+B,CAC7B,KAAK,EACL,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,uBAAuB,OAAO,CAAC,MAAM,kBAAkB,KAAK,CAAC,gBAAgB,GAAG,CACjF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport { detachDocumentAttachment } from \"../../../workflows/blobs/detach\";\nimport {\n  type DocumentRecord,\n  reclaimDocumentOrphanBlobs,\n  resolveDocumentCreateAuthor,\n} from \"../../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../workflows/principals/runtimePolicyWarmer\";\nimport { deleteLocalAttachmentRecord } from \"./attachmentPersistence\";\nimport type {\n  DocumentAttachmentBinding,\n  DocumentState,\n  DocumentStoreState,\n} from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { documentSyncContextMatches } from \"./syncUpdateImport\";\nimport { installDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\ninterface DetachedAttachmentMarker {\n  slotId: string;\n  storageKey: string;\n}\n\nexport async function syncDetachedAttachmentBindings(\n  state: DocumentStoreState,\n  nextRecord: DocumentRecord,\n  generation: DocumentStoreSyncGeneration,\n): Promise<void> {\n  const currentDoc = generation.currentDoc;\n  if (\n    !currentDoc ||\n    !detachedSyncContextIsCurrent(state, generation, nextRecord)\n  ) {\n    return;\n  }\n\n  const detachedMarkers = listDetachedAttachmentMarkers(state, currentDoc);\n  if (detachedMarkers.length === 0) {\n    return;\n  }\n\n  if (!nextRecord.documentId) {\n    await cleanupDetachedAttachmentMarkers(\n      state,\n      currentDoc,\n      nextRecord,\n      detachedMarkers,\n      generation,\n    );\n    return;\n  }\n\n  const remoteDocumentId = nextRecord.documentId;\n  const remoteBindings =\n    await state.runtime.apiClient.listDocumentAttachments(remoteDocumentId);\n  if (\n    !remoteBindings ||\n    !detachedSyncContextIsCurrent(state, generation, nextRecord)\n  ) {\n    return;\n  }\n\n  const activeBindingBySlotId = new Map(\n    remoteBindings.map((binding) => [binding.slotId, binding]),\n  );\n\n  for (const marker of detachedMarkers) {\n    if (!detachedSyncContextIsCurrent(state, generation, nextRecord)) {\n      return;\n    }\n    const activeBinding = activeBindingBySlotId.get(marker.slotId);\n    if (activeBinding) {\n      const detached = await syncDetachedAttachmentBinding({\n        binding: activeBinding,\n        generation,\n        remoteDocumentId,\n        requestRecord: nextRecord,\n        state,\n      });\n      if (!detached) {\n        return;\n      }\n    }\n\n    const cleaned = await cleanupDetachedAttachmentMarker(\n      state,\n      currentDoc,\n      nextRecord,\n      marker,\n      generation,\n    );\n    if (!cleaned) {\n      return;\n    }\n  }\n}\n\nfunction detachedSyncContextIsCurrent(\n  state: DocumentStoreState,\n  generation: DocumentStoreSyncGeneration,\n  requestRecord: DocumentRecord,\n): boolean {\n  return (\n    isDocumentStoreSyncGenerationCurrent(state, generation) &&\n    documentSyncContextMatches(\n      state.record,\n      requestRecord,\n      requestRecord.documentId,\n    )\n  );\n}\n\nfunction listDetachedAttachmentMarkers(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n): DetachedAttachmentMarker[] {\n  const currentSlotIds = new Set(\n    getDocumentAttachments(currentDoc).map((attachment) => attachment.slotId),\n  );\n\n  return Object.entries(state.attachmentStorageKeyBySlotId).flatMap(\n    ([slotId, storageKey]) =>\n      currentSlotIds.has(slotId) ? [] : [{ slotId, storageKey }],\n  );\n}\n\nasync function cleanupDetachedAttachmentMarkers(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  requestRecord: DocumentRecord,\n  markers: readonly DetachedAttachmentMarker[],\n  generation: DocumentStoreSyncGeneration,\n): Promise<void> {\n  for (const marker of markers) {\n    if (\n      !(await cleanupDetachedAttachmentMarker(\n        state,\n        currentDoc,\n        requestRecord,\n        marker,\n        generation,\n      ))\n    ) {\n      return;\n    }\n  }\n}\n\nasync function cleanupDetachedAttachmentMarker(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  requestRecord: DocumentRecord,\n  marker: DetachedAttachmentMarker,\n  generation: DocumentStoreSyncGeneration,\n): Promise<boolean> {\n  if (!detachedSyncContextIsCurrent(state, generation, requestRecord)) {\n    return false;\n  }\n  await deleteLocalAttachmentRecord(\n    state,\n    marker.slotId,\n    marker.storageKey,\n    currentDoc,\n  );\n  // Deleting the row queued its bytes for the reference-checked reclaim.\n  void reclaimDocumentOrphanBlobs(state.runtime);\n  return detachedSyncContextIsCurrent(state, generation, requestRecord);\n}\n\nasync function syncDetachedAttachmentBinding(input: {\n  binding: DocumentAttachmentBinding;\n  generation: DocumentStoreSyncGeneration;\n  remoteDocumentId: string;\n  requestRecord: DocumentRecord;\n  state: DocumentStoreState;\n}): Promise<boolean> {\n  const { binding, generation, requestRecord, state } = input;\n  const contextIsCurrent = () =>\n    detachedSyncContextIsCurrent(state, generation, requestRecord);\n  if (!contextIsCurrent()) return false;\n\n  const author = resolveDocumentCreateAuthor(state.runtime);\n  if (!author) {\n    state.runtime.util.log(\n      \"Documents: skipped attachment detach because the writer context is unavailable.\",\n    );\n    return false;\n  }\n\n  const writerProjection =\n    state.writerProjection?.documentId === input.remoteDocumentId\n      ? state.writerProjection\n      : null;\n  const writerProjectionGeneration = state.writerProjectionGeneration;\n  let remoteSyncBlocked = false;\n  const baseDetachInput = {\n    apiClient: state.runtime.apiClient,\n    author,\n    bindingId: binding.bindingId,\n    blobId: binding.blobId,\n    documentId: input.remoteDocumentId,\n    execSql: generation.execSql,\n    isRemoteSyncBlocked: (organizationId: string) => {\n      remoteSyncBlocked =\n        state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;\n      return remoteSyncBlocked;\n    },\n    resolveProjectionUserKey: generation.resolveProjectionUserKey,\n    slotId: binding.slotId,\n    stillCurrent: contextIsCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      state.runtime,\n    ),\n  };\n  let detached = await detachDocumentAttachment({\n    ...baseDetachInput,\n    writerProjection: writerProjection ?? undefined,\n  });\n  if (!contextIsCurrent()) return false;\n  if (!detached && writerProjection && !remoteSyncBlocked) {\n    state.writerProjection = null;\n    detached = await detachDocumentAttachment(baseDetachInput);\n    if (!contextIsCurrent()) return false;\n  }\n  if (!detached) {\n    return false;\n  }\n\n  installDocumentWriterProjection(\n    state,\n    detached.writerProjection,\n    writerProjectionGeneration,\n  );\n  state.runtime.util.log(\n    `Detached attachment ${binding.slotId} from document ${input.remoteDocumentId}.`,\n  );\n  return true;\n}\n"]}

package/workflows/blobs/decrypt.d.ts

@@ -4,7 +4,7 @@ export type AttachmentBlobDecryptionInput = Omit<DecryptDocumentAttachmentBlobIn
     encrypted: BlobEncryptedBytesHeader;
 };
 /** Verifies metadata and authority; the caller must still authenticate ciphertext. */
-export declare function prepareDocumentAttachmentBlobDecryption({ binding, encrypted, expectedDocumentId, expectedSlotId, execSql, resolveProjectionUserKey, targetSecretKey, writerProjection, }: AttachmentBlobDecryptionInput): Promise<{
+export declare function prepareDocumentAttachmentBlobDecryption({ binding, encrypted, expectedDocumentId, expectedSlotId, execSql, resolveProjectionUserKey, targetSecretKey, stillCurrent, warmReferencedPrincipalPolicies, writerProjection, }: AttachmentBlobDecryptionInput): Promise<{
     contentKey: Uint8Array;
     recordKey: CryptoKey;
     organizationId: string;

package/workflows/blobs/decrypt.js

@@ -48,10 +48,12 @@ async function assertBlobEncryptionMetadata(input) {
     }
 }
 /** Verifies metadata and authority; the caller must still authenticate ciphertext. */
-export async function prepareDocumentAttachmentBlobDecryption({ binding, encrypted, expectedDocumentId, expectedSlotId, execSql, resolveProjectionUserKey, targetSecretKey, writerProjection, }) {
+export async function prepareDocumentAttachmentBlobDecryption({ binding, encrypted, expectedDocumentId, expectedSlotId, execSql, resolveProjectionUserKey, targetSecretKey, stillCurrent, warmReferencedPrincipalPolicies, writerProjection, }) {
     const requiredResolveProjectionUserKey = requireProjectionUserKeyResolver(resolveProjectionUserKey, "Document attachment blob decrypt");
     const verificationOptions = projectionVerificationOptions({
         execSql,
+        stillCurrent,
+        warmReferencedPrincipalPolicies,
         resolveProjectionUserKey: requiredResolveProjectionUserKey,
     });
     let documentAuthorization;

package/workflows/blobs/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAKlG,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAE7G,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC9E,IACE,SAAS,CAAC,MAAM,KAAK,cAAc;QACnC,SAAS,CAAC,eAAe,KAAK,cAAc,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,SAAS,CAAC,eAAe,KAAK,gBAAgB,CAAC,eAAe;QAC9D,gBAAgB,CAAC,MAAM,KAAK,cAAc,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAE7D,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,cAAc;QACxB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC;QACzD,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,EAC5D,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,gBAAgB,GACc;IAK9B,MAAM,gCAAgC,GAAG,gCAAgC,CACvE,wBAAwB,EACxB,kCAAkC,CACnC,CAAC;IACF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;QACxD,OAAO;QACP,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,IAAI,qBAAwE,CAAC;IAC7E,MAAM,wCAAwC,CAAC,gBAAgB,EAAE;QAC/D,0BAA0B,EAAE,IAAI;QAChC,OAAO;QACP,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,qBAAqB,GAAG,aAAa,CAAC;QACxC,CAAC;QACD,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAClC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,4BAA4B,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,kBAAkB;QAClB,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC;QAClC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,SAAS;QACT,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,2BAA2B,CAAC;QAC1B,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU;QACV,SAAS;QACT,OAAO;QACP,iBAAiB,EAAE,OAAO,CAAC,SAAS;QACpC,SAAS,EAAE,eAAe;QAC1B,GAAG,mBAAmB;QACtB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,kBAAkB;QAClB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,cAAc;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oCAAoC,CACjD,KAAyC;IAEzC,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,uCAAuC,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAC/B,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CACvC,CACF,CACF,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,GAAG,OAAO;QACV,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC;IAEzC,OAAO,CAAC,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAI/C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,MAAM,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAClE,CACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,IACE,UAAU,KAAK,UAAU,CAAC,iBAAiB;QAC3C,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,KAAK,CAAC,wBAAwB;QAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACvD,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACtC,MAAM,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAC7D,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,6BAA6B;QAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC/D,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,0BAA0B;QAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7D,KAAK,EAAE,gCAAgC;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,6BAA6B,CAAC;QAC7D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,6BAA6B,EAAE,UAAU,CAAC,6BAA6B;QACvE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,kBAAkB,KAAK,UAAU,CAAC,sBAAsB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAsD;IAEtD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,gBAAgB,CACrB,mBAAmB,CACjB,OAAO,CAAC,YAAY,CAAC,IAAI,EACzB,+BAA+B,CAChC,EACD,YAAY,EACZ,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAQ5C;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QACxC,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QAC5C,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;IACH,IACE,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,YAAY;QACpD,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,iBAAiB,EAAE;YACjB,yBAAyB,EAAE,0BAA0B,CAAC;gBACpD,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;gBACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;aAC1D,CAAC,CAAC,wBAAwB;YAC3B,cAAc;YACd,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;SACzD;QACD,0BAA0B,EAAE,cAAc,CAAC,sBAAsB;QACjE,cAAc,EAAE;YACd,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,kBAAkB,EAAE,cAAc,CAAC,iBAAiB;QACpD,MAAM;QACN,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import {\n  bytesToHex,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContentRecordNonceDomainHash,\n  makeVerifiedBlobKekTargets,\n  verifyWriteHeader,\n} from \"@tearleads/crypto\";\nimport type { BlobKekTargetsResponse } from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../data/blobContracts\";\nimport {\n  blobContentMetadataHash,\n  deriveBlobContentRecordKey,\n} from \"../../data/documents/blob/shared/crypto\";\nimport { unwrapBlobContentKey } from \"../../data/documents/blob/shared/projection\";\nimport {\n  parseBlobEncryptedBytes,\n  readBlobKekTarget,\n  readDocumentManifestIdentity,\n  sortBlobTargets,\n} from \"../../data/documents/blob/shared/readers\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../data/documents/blob/shared/responses\";\nimport type {\n  BlobEncryptedBytesHeader,\n  DecryptDocumentAttachmentBlobInput,\n} from \"../../data/documents/blob/shared/types\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport {\n  asWebCryptoBytes,\n  readWriteHeader,\n  uniqueSortedStrings,\n} from \"../../data/documents/shared/readers\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../data/keyingCanonicalJson\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../data/keyingProjectionVerification\";\nimport {\n  readRecordString,\n  requireProjectionUserKeyResolver,\n} from \"../../data/keyingProjectionVerification\";\nimport { resolveEventContainerPaths } from \"../../data/keyingProjectionVerification/documentDependencyPaths\";\n\nimport { assertAttachmentBindingVerified } from \"./attachmentBindingVerification\";\nimport { decryptBlobChunks } from \"./blobChunkDecryption\";\nimport { assertBlobWrapScopeVerified } from \"./verifiedWrapScope\";\n\nasync function assertBlobEncryptionMetadata(input: {\n  readonly contentKeyBundle: DecryptDocumentAttachmentBlobInput[\"binding\"][\"contentKeyBundle\"];\n  readonly encrypted: BlobEncryptedBytesHeader;\n  readonly expectedBlobId: string;\n  readonly organizationId: string;\n}): Promise<void> {\n  const { contentKeyBundle, encrypted, expectedBlobId, organizationId } = input;\n  if (\n    encrypted.blobId !== expectedBlobId ||\n    encrypted.contentRecordId !== expectedBlobId\n  ) {\n    throw new Error(\"Blob encrypted bytes blob id mismatch\");\n  }\n  if (\n    encrypted.contentKeyEpoch !== contentKeyBundle.contentKeyEpoch ||\n    contentKeyBundle.blobId !== expectedBlobId\n  ) {\n    throw new Error(\"Blob encrypted bytes content-key bundle mismatch\");\n  }\n  await assertBlobContentKeyBundleTargetHash(contentKeyBundle);\n\n  const expectedNonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId,\n    objectKind: \"blob\",\n    objectId: expectedBlobId,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (encrypted.nonceDomainHash !== expectedNonceDomainHash) {\n    throw new Error(\"Blob encrypted bytes nonce domain mismatch\");\n  }\n  const expectedMetadataHash = await blobContentMetadataHash({\n    blobId: expectedBlobId,\n    byteLength: encrypted.byteLength,\n    chunkCount: encrypted.chunkCount,\n    chunkSize: encrypted.chunkSize,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n  });\n  if (encrypted.metadataHash !== expectedMetadataHash) {\n    throw new Error(\"Blob encrypted bytes metadata hash mismatch\");\n  }\n}\n\nexport type AttachmentBlobDecryptionInput = Omit<\n  DecryptDocumentAttachmentBlobInput,\n  \"encryptedBytes\"\n> & {\n  encrypted: BlobEncryptedBytesHeader;\n};\n\n/** Verifies metadata and authority; the caller must still authenticate ciphertext. */\nexport async function prepareDocumentAttachmentBlobDecryption({\n  binding,\n  encrypted,\n  expectedDocumentId,\n  expectedSlotId,\n  execSql,\n  resolveProjectionUserKey,\n  targetSecretKey,\n  writerProjection,\n}: AttachmentBlobDecryptionInput): Promise<{\n  contentKey: Uint8Array;\n  recordKey: CryptoKey;\n  organizationId: string;\n}> {\n  const requiredResolveProjectionUserKey = requireProjectionUserKeyResolver(\n    resolveProjectionUserKey,\n    \"Document attachment blob decrypt\",\n  );\n  const verificationOptions = projectionVerificationOptions({\n    execSql,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n  let documentAuthorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(writerProjection, {\n    allowStaleContentKeyBundle: true,\n    execSql,\n    onVerifiedAuthorization: (authorization) => {\n      documentAuthorization = authorization;\n    },\n    ...verificationOptions,\n  });\n  const { documentId, organizationId } =\n    readDocumentManifestIdentity(writerProjection);\n  await assertBlobEncryptionMetadata({\n    contentKeyBundle: binding.contentKeyBundle,\n    encrypted,\n    expectedBlobId: binding.blobId,\n    organizationId,\n  });\n  await assertAttachmentBindingVerified({\n    authorization: documentAuthorization,\n    binding,\n    expectedDocumentId,\n    expectedSlotId,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n  await assertBlobWriteHeaderVerified({\n    authorization: documentAuthorization,\n    binding,\n    encrypted,\n    organizationId,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n\n  if (!documentAuthorization)\n    throw new Error(\"Blob document authorization is unavailable\");\n  assertBlobWrapScopeVerified({\n    authorization: documentAuthorization,\n    binding,\n    documentId,\n  });\n  const contentKey = await unwrapBlobContentKey({\n    blobId: binding.blobId,\n    contentKeyBundle: binding.contentKeyBundle,\n    documentId,\n    encrypted,\n    execSql,\n    expectedBindingId: binding.bindingId,\n    secretKey: targetSecretKey,\n    ...verificationOptions,\n    writerProjection,\n  });\n  const contentKeyMaterial = await importContentKeyMaterial(contentKey);\n  const recordKey = await deriveBlobContentRecordKey({\n    blobId: binding.blobId,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n    contentKeyMaterial,\n    contentRecordId: encrypted.contentRecordId,\n    organizationId,\n    usage: \"decrypt\",\n  });\n  return { contentKey, recordKey, organizationId };\n}\n\nasync function decryptDocumentAttachmentBlobWithKey(\n  input: DecryptDocumentAttachmentBlobInput,\n): Promise<{ bytes: BlobBytes; contentKey: Uint8Array }> {\n  const encrypted = parseBlobEncryptedBytes(input.encryptedBytes);\n  const context = await prepareDocumentAttachmentBlobDecryption({\n    ...input,\n    encrypted,\n  });\n  const header = readWriteHeader(\n    input.binding.writeHeader,\n    \"Attachment blob write header\",\n  );\n  const ciphertextHash = bytesToHex(\n    new Uint8Array(\n      await crypto.subtle.digest(\n        \"SHA-256\",\n        asWebCryptoBytes(input.encryptedBytes),\n      ),\n    ),\n  );\n  if (header.ciphertextHash !== ciphertextHash)\n    throw new Error(\"Attachment blob write header does not match ciphertext\");\n  const bytes = await decryptBlobChunks({\n    ...context,\n    encrypted,\n    expectedBlobId: input.binding.blobId,\n  });\n  return { bytes, contentKey: context.contentKey };\n}\n\nexport async function decryptDocumentAttachmentBlob(\n  input: DecryptDocumentAttachmentBlobInput,\n): Promise<BlobBytes> {\n  return (await decryptDocumentAttachmentBlobWithKey(input)).bytes;\n}\n\nfunction assertStringSetEquals(input: {\n  readonly actual: readonly string[];\n  readonly expected: readonly string[];\n  readonly label: string;\n}): void {\n  const actual = uniqueSortedStrings(input.actual);\n  const expected = uniqueSortedStrings(input.expected);\n  if (\n    actual.length !== expected.length ||\n    actual.some((value, index) => value !== expected[index])\n  ) {\n    throw new Error(`${input.label} is inconsistent`);\n  }\n}\n\nasync function verifiedBlobKekTargetsForBinding(input: {\n  readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n  readonly requireBindingMembership: boolean;\n  readonly projection: BlobKekTargetsResponse | undefined;\n}) {\n  const { binding, projection } = input;\n  if (!projection) {\n    throw new Error(\"Attachment binding lacks blob KEK verification material\");\n  }\n  const targets = sortBlobTargets(\n    projection.targets.map((target, index) =>\n      readBlobKekTarget(target, `Attachment blob KEK target[${index}]`),\n    ),\n  );\n  const targetHash = await computeBlobContentKeyTargetHash(targets);\n  if (\n    targetHash !== projection.blobKeyTargetHash ||\n    projection.blobId !== binding.blobId\n  ) {\n    throw new Error(\"Attachment blob KEK target hash is inconsistent\");\n  }\n  if (\n    input.requireBindingMembership &&\n    (!projection.activeBindingIds.includes(binding.bindingId) ||\n      !targets.some(\n        (target) =>\n          target.bindingId === binding.bindingId &&\n          target.documentId === attachmentBindingDocumentId(binding),\n      ))\n  ) {\n    throw new Error(\"Attachment binding is absent from blob KEK targets\");\n  }\n  assertStringSetEquals({\n    actual: projection.linkedContainerManifestHashes,\n    expected: targets.map((target) => target.containerManifestHash),\n    label: \"Attachment blob container manifests\",\n  });\n  assertStringSetEquals({\n    actual: projection.linkedContainerKeyEpochIds,\n    expected: targets.map((target) => target.containerKeyEpochId),\n    label: \"Attachment blob container KEKs\",\n  });\n  const accessManifestHash = await computeBlobAccessManifestHash({\n    version: 1,\n    blobId: projection.blobId,\n    organizationId: projection.organizationId,\n    activeBindingIds: projection.activeBindingIds,\n    documentManifestHashes: projection.documentManifestHashes,\n    linkedContainerManifestHashes: projection.linkedContainerManifestHashes,\n    linkedContainerKeyEpochIds: projection.linkedContainerKeyEpochIds,\n    blobKeyTargetHash: projection.blobKeyTargetHash,\n  });\n  if (accessManifestHash !== projection.blobAccessManifestHash) {\n    throw new Error(\"Attachment blob access manifest hash is inconsistent\");\n  }\n  return makeVerifiedBlobKekTargets({ ...projection, targets });\n}\n\nfunction attachmentBindingDocumentId(\n  binding: DecryptDocumentAttachmentBlobInput[\"binding\"],\n): string {\n  if (!binding.bindingEvent) {\n    throw new Error(\"Attachment binding lacks a signed event\");\n  }\n  return readRecordString(\n    readCanonicalRecord(\n      binding.bindingEvent.body,\n      \"Attachment binding event body\",\n    ),\n    \"documentId\",\n    \"Attachment binding event body\",\n  );\n}\n\nasync function assertBlobWriteHeaderVerified(input: {\n  readonly authorization: DocumentWriterProjectionAuthorization | undefined;\n  readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n  readonly encrypted: BlobEncryptedBytesHeader;\n  readonly organizationId: string;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof requireProjectionUserKeyResolver\n  >;\n}): Promise<void> {\n  if (!input.authorization || !input.binding.writeHeader) {\n    throw new Error(\"Attachment blob lacks verified write authority\");\n  }\n  const header = readWriteHeader(\n    input.binding.writeHeader,\n    \"Attachment blob write header\",\n  );\n  const writer = await input.resolveProjectionUserKey(header.writerUserId);\n  if (!writer) {\n    throw new Error(\"Attachment blob writer identity is unavailable\");\n  }\n  await verifiedBlobKekTargetsForBinding({\n    binding: input.binding,\n    projection: input.binding.blobKekTargets,\n    requireBindingMembership: true,\n  });\n  const blobKekTargets = await verifiedBlobKekTargetsForBinding({\n    binding: input.binding,\n    projection: input.binding.writeAuthorization,\n    // The signed binding proves which slot exposes the blob now. Writer\n    // authorization describes the older target set committed when the bytes\n    // were written, so a later valid binding need not appear in that set.\n    requireBindingMembership: false,\n  });\n  if (\n    header.metadataHash !== input.encrypted.metadataHash ||\n    header.contentKeyEpoch !== input.encrypted.contentKeyEpoch ||\n    header.contentRecordId !== input.encrypted.contentRecordId ||\n    header.nonceDomainHash !== input.encrypted.nonceDomainHash\n  ) {\n    throw new Error(\"Attachment blob write header does not match ciphertext\");\n  }\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    blobAuthorization: {\n      authorizingContainerPaths: resolveEventContainerPaths({\n        containerPathByManifestHash:\n          input.authorization.containerPathByManifestHash,\n        dependencyManifestHashes: header.dependencyManifestHashes,\n      }).dependencyContainerPaths,\n      blobKekTargets,\n      principalPolicies: input.authorization.principalPolicies,\n    },\n    expectedAccessManifestHash: blobKekTargets.blobAccessManifestHash,\n    expectedObject: {\n      objectKind: \"blob\",\n      objectId: input.binding.blobId,\n      organizationId: input.organizationId,\n    },\n    expectedTargetHash: blobKekTargets.blobKeyTargetHash,\n    header,\n    writerPublicKey: writer.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n"]}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAKlG,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAE7G,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC9E,IACE,SAAS,CAAC,MAAM,KAAK,cAAc;QACnC,SAAS,CAAC,eAAe,KAAK,cAAc,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,SAAS,CAAC,eAAe,KAAK,gBAAgB,CAAC,eAAe;QAC9D,gBAAgB,CAAC,MAAM,KAAK,cAAc,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAE7D,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,cAAc;QACxB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC;QACzD,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,EAC5D,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAK9B,MAAM,gCAAgC,GAAG,gCAAgC,CACvE,wBAAwB,EACxB,kCAAkC,CACnC,CAAC;IACF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;QACxD,OAAO;QACP,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,IAAI,qBAAwE,CAAC;IAC7E,MAAM,wCAAwC,CAAC,gBAAgB,EAAE;QAC/D,0BAA0B,EAAE,IAAI;QAChC,OAAO;QACP,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,qBAAqB,GAAG,aAAa,CAAC;QACxC,CAAC;QACD,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAClC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,4BAA4B,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,kBAAkB;QAClB,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC;QAClC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,SAAS;QACT,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,2BAA2B,CAAC;QAC1B,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU;QACV,SAAS;QACT,OAAO;QACP,iBAAiB,EAAE,OAAO,CAAC,SAAS;QACpC,SAAS,EAAE,eAAe;QAC1B,GAAG,mBAAmB;QACtB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,kBAAkB;QAClB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,cAAc;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oCAAoC,CACjD,KAAyC;IAEzC,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,uCAAuC,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAC/B,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CACvC,CACF,CACF,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,GAAG,OAAO;QACV,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC;IAEzC,OAAO,CAAC,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAI/C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,MAAM,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAClE,CACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,IACE,UAAU,KAAK,UAAU,CAAC,iBAAiB;QAC3C,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,KAAK,CAAC,wBAAwB;QAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACvD,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACtC,MAAM,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAC7D,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,6BAA6B;QAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC/D,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,0BAA0B;QAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7D,KAAK,EAAE,gCAAgC;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,6BAA6B,CAAC;QAC7D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,6BAA6B,EAAE,UAAU,CAAC,6BAA6B;QACvE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,kBAAkB,KAAK,UAAU,CAAC,sBAAsB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAsD;IAEtD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,gBAAgB,CACrB,mBAAmB,CACjB,OAAO,CAAC,YAAY,CAAC,IAAI,EACzB,+BAA+B,CAChC,EACD,YAAY,EACZ,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAQ5C;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QACxC,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QAC5C,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;IACH,IACE,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,YAAY;QACpD,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,iBAAiB,EAAE;YACjB,yBAAyB,EAAE,0BAA0B,CAAC;gBACpD,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;gBACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;aAC1D,CAAC,CAAC,wBAAwB;YAC3B,cAAc;YACd,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;SACzD;QACD,0BAA0B,EAAE,cAAc,CAAC,sBAAsB;QACjE,cAAc,EAAE;YACd,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,kBAAkB,EAAE,cAAc,CAAC,iBAAiB;QACpD,MAAM;QACN,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import {\n  bytesToHex,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContentRecordNonceDomainHash,\n  makeVerifiedBlobKekTargets,\n  verifyWriteHeader,\n} from \"@tearleads/crypto\";\nimport type { BlobKekTargetsResponse } from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../data/blobContracts\";\nimport {\n  blobContentMetadataHash,\n  deriveBlobContentRecordKey,\n} from \"../../data/documents/blob/shared/crypto\";\nimport { unwrapBlobContentKey } from \"../../data/documents/blob/shared/projection\";\nimport {\n  parseBlobEncryptedBytes,\n  readBlobKekTarget,\n  readDocumentManifestIdentity,\n  sortBlobTargets,\n} from \"../../data/documents/blob/shared/readers\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../data/documents/blob/shared/responses\";\nimport type {\n  BlobEncryptedBytesHeader,\n  DecryptDocumentAttachmentBlobInput,\n} from \"../../data/documents/blob/shared/types\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport {\n  asWebCryptoBytes,\n  readWriteHeader,\n  uniqueSortedStrings,\n} from \"../../data/documents/shared/readers\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../data/keyingCanonicalJson\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../data/keyingProjectionVerification\";\nimport {\n  readRecordString,\n  requireProjectionUserKeyResolver,\n} from \"../../data/keyingProjectionVerification\";\nimport { resolveEventContainerPaths } from \"../../data/keyingProjectionVerification/documentDependencyPaths\";\n\nimport { assertAttachmentBindingVerified } from \"./attachmentBindingVerification\";\nimport { decryptBlobChunks } from \"./blobChunkDecryption\";\nimport { assertBlobWrapScopeVerified } from \"./verifiedWrapScope\";\n\nasync function assertBlobEncryptionMetadata(input: {\n  readonly contentKeyBundle: DecryptDocumentAttachmentBlobInput[\"binding\"][\"contentKeyBundle\"];\n  readonly encrypted: BlobEncryptedBytesHeader;\n  readonly expectedBlobId: string;\n  readonly organizationId: string;\n}): Promise<void> {\n  const { contentKeyBundle, encrypted, expectedBlobId, organizationId } = input;\n  if (\n    encrypted.blobId !== expectedBlobId ||\n    encrypted.contentRecordId !== expectedBlobId\n  ) {\n    throw new Error(\"Blob encrypted bytes blob id mismatch\");\n  }\n  if (\n    encrypted.contentKeyEpoch !== contentKeyBundle.contentKeyEpoch ||\n    contentKeyBundle.blobId !== expectedBlobId\n  ) {\n    throw new Error(\"Blob encrypted bytes content-key bundle mismatch\");\n  }\n  await assertBlobContentKeyBundleTargetHash(contentKeyBundle);\n\n  const expectedNonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId,\n    objectKind: \"blob\",\n    objectId: expectedBlobId,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (encrypted.nonceDomainHash !== expectedNonceDomainHash) {\n    throw new Error(\"Blob encrypted bytes nonce domain mismatch\");\n  }\n  const expectedMetadataHash = await blobContentMetadataHash({\n    blobId: expectedBlobId,\n    byteLength: encrypted.byteLength,\n    chunkCount: encrypted.chunkCount,\n    chunkSize: encrypted.chunkSize,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n  });\n  if (encrypted.metadataHash !== expectedMetadataHash) {\n    throw new Error(\"Blob encrypted bytes metadata hash mismatch\");\n  }\n}\n\nexport type AttachmentBlobDecryptionInput = Omit<\n  DecryptDocumentAttachmentBlobInput,\n  \"encryptedBytes\"\n> & {\n  encrypted: BlobEncryptedBytesHeader;\n};\n\n/** Verifies metadata and authority; the caller must still authenticate ciphertext. */\nexport async function prepareDocumentAttachmentBlobDecryption({\n  binding,\n  encrypted,\n  expectedDocumentId,\n  expectedSlotId,\n  execSql,\n  resolveProjectionUserKey,\n  targetSecretKey,\n  stillCurrent,\n  warmReferencedPrincipalPolicies,\n  writerProjection,\n}: AttachmentBlobDecryptionInput): Promise<{\n  contentKey: Uint8Array;\n  recordKey: CryptoKey;\n  organizationId: string;\n}> {\n  const requiredResolveProjectionUserKey = requireProjectionUserKeyResolver(\n    resolveProjectionUserKey,\n    \"Document attachment blob decrypt\",\n  );\n  const verificationOptions = projectionVerificationOptions({\n    execSql,\n    stillCurrent,\n    warmReferencedPrincipalPolicies,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n  let documentAuthorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(writerProjection, {\n    allowStaleContentKeyBundle: true,\n    execSql,\n    onVerifiedAuthorization: (authorization) => {\n      documentAuthorization = authorization;\n    },\n    ...verificationOptions,\n  });\n  const { documentId, organizationId } =\n    readDocumentManifestIdentity(writerProjection);\n  await assertBlobEncryptionMetadata({\n    contentKeyBundle: binding.contentKeyBundle,\n    encrypted,\n    expectedBlobId: binding.blobId,\n    organizationId,\n  });\n  await assertAttachmentBindingVerified({\n    authorization: documentAuthorization,\n    binding,\n    expectedDocumentId,\n    expectedSlotId,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n  await assertBlobWriteHeaderVerified({\n    authorization: documentAuthorization,\n    binding,\n    encrypted,\n    organizationId,\n    resolveProjectionUserKey: requiredResolveProjectionUserKey,\n  });\n\n  if (!documentAuthorization)\n    throw new Error(\"Blob document authorization is unavailable\");\n  assertBlobWrapScopeVerified({\n    authorization: documentAuthorization,\n    binding,\n    documentId,\n  });\n  const contentKey = await unwrapBlobContentKey({\n    blobId: binding.blobId,\n    contentKeyBundle: binding.contentKeyBundle,\n    documentId,\n    encrypted,\n    execSql,\n    expectedBindingId: binding.bindingId,\n    secretKey: targetSecretKey,\n    ...verificationOptions,\n    writerProjection,\n  });\n  const contentKeyMaterial = await importContentKeyMaterial(contentKey);\n  const recordKey = await deriveBlobContentRecordKey({\n    blobId: binding.blobId,\n    contentKeyEpoch: encrypted.contentKeyEpoch,\n    contentKeyMaterial,\n    contentRecordId: encrypted.contentRecordId,\n    organizationId,\n    usage: \"decrypt\",\n  });\n  return { contentKey, recordKey, organizationId };\n}\n\nasync function decryptDocumentAttachmentBlobWithKey(\n  input: DecryptDocumentAttachmentBlobInput,\n): Promise<{ bytes: BlobBytes; contentKey: Uint8Array }> {\n  const encrypted = parseBlobEncryptedBytes(input.encryptedBytes);\n  const context = await prepareDocumentAttachmentBlobDecryption({\n    ...input,\n    encrypted,\n  });\n  const header = readWriteHeader(\n    input.binding.writeHeader,\n    \"Attachment blob write header\",\n  );\n  const ciphertextHash = bytesToHex(\n    new Uint8Array(\n      await crypto.subtle.digest(\n        \"SHA-256\",\n        asWebCryptoBytes(input.encryptedBytes),\n      ),\n    ),\n  );\n  if (header.ciphertextHash !== ciphertextHash)\n    throw new Error(\"Attachment blob write header does not match ciphertext\");\n  const bytes = await decryptBlobChunks({\n    ...context,\n    encrypted,\n    expectedBlobId: input.binding.blobId,\n  });\n  return { bytes, contentKey: context.contentKey };\n}\n\nexport async function decryptDocumentAttachmentBlob(\n  input: DecryptDocumentAttachmentBlobInput,\n): Promise<BlobBytes> {\n  return (await decryptDocumentAttachmentBlobWithKey(input)).bytes;\n}\n\nfunction assertStringSetEquals(input: {\n  readonly actual: readonly string[];\n  readonly expected: readonly string[];\n  readonly label: string;\n}): void {\n  const actual = uniqueSortedStrings(input.actual);\n  const expected = uniqueSortedStrings(input.expected);\n  if (\n    actual.length !== expected.length ||\n    actual.some((value, index) => value !== expected[index])\n  ) {\n    throw new Error(`${input.label} is inconsistent`);\n  }\n}\n\nasync function verifiedBlobKekTargetsForBinding(input: {\n  readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n  readonly requireBindingMembership: boolean;\n  readonly projection: BlobKekTargetsResponse | undefined;\n}) {\n  const { binding, projection } = input;\n  if (!projection) {\n    throw new Error(\"Attachment binding lacks blob KEK verification material\");\n  }\n  const targets = sortBlobTargets(\n    projection.targets.map((target, index) =>\n      readBlobKekTarget(target, `Attachment blob KEK target[${index}]`),\n    ),\n  );\n  const targetHash = await computeBlobContentKeyTargetHash(targets);\n  if (\n    targetHash !== projection.blobKeyTargetHash ||\n    projection.blobId !== binding.blobId\n  ) {\n    throw new Error(\"Attachment blob KEK target hash is inconsistent\");\n  }\n  if (\n    input.requireBindingMembership &&\n    (!projection.activeBindingIds.includes(binding.bindingId) ||\n      !targets.some(\n        (target) =>\n          target.bindingId === binding.bindingId &&\n          target.documentId === attachmentBindingDocumentId(binding),\n      ))\n  ) {\n    throw new Error(\"Attachment binding is absent from blob KEK targets\");\n  }\n  assertStringSetEquals({\n    actual: projection.linkedContainerManifestHashes,\n    expected: targets.map((target) => target.containerManifestHash),\n    label: \"Attachment blob container manifests\",\n  });\n  assertStringSetEquals({\n    actual: projection.linkedContainerKeyEpochIds,\n    expected: targets.map((target) => target.containerKeyEpochId),\n    label: \"Attachment blob container KEKs\",\n  });\n  const accessManifestHash = await computeBlobAccessManifestHash({\n    version: 1,\n    blobId: projection.blobId,\n    organizationId: projection.organizationId,\n    activeBindingIds: projection.activeBindingIds,\n    documentManifestHashes: projection.documentManifestHashes,\n    linkedContainerManifestHashes: projection.linkedContainerManifestHashes,\n    linkedContainerKeyEpochIds: projection.linkedContainerKeyEpochIds,\n    blobKeyTargetHash: projection.blobKeyTargetHash,\n  });\n  if (accessManifestHash !== projection.blobAccessManifestHash) {\n    throw new Error(\"Attachment blob access manifest hash is inconsistent\");\n  }\n  return makeVerifiedBlobKekTargets({ ...projection, targets });\n}\n\nfunction attachmentBindingDocumentId(\n  binding: DecryptDocumentAttachmentBlobInput[\"binding\"],\n): string {\n  if (!binding.bindingEvent) {\n    throw new Error(\"Attachment binding lacks a signed event\");\n  }\n  return readRecordString(\n    readCanonicalRecord(\n      binding.bindingEvent.body,\n      \"Attachment binding event body\",\n    ),\n    \"documentId\",\n    \"Attachment binding event body\",\n  );\n}\n\nasync function assertBlobWriteHeaderVerified(input: {\n  readonly authorization: DocumentWriterProjectionAuthorization | undefined;\n  readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n  readonly encrypted: BlobEncryptedBytesHeader;\n  readonly organizationId: string;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof requireProjectionUserKeyResolver\n  >;\n}): Promise<void> {\n  if (!input.authorization || !input.binding.writeHeader) {\n    throw new Error(\"Attachment blob lacks verified write authority\");\n  }\n  const header = readWriteHeader(\n    input.binding.writeHeader,\n    \"Attachment blob write header\",\n  );\n  const writer = await input.resolveProjectionUserKey(header.writerUserId);\n  if (!writer) {\n    throw new Error(\"Attachment blob writer identity is unavailable\");\n  }\n  await verifiedBlobKekTargetsForBinding({\n    binding: input.binding,\n    projection: input.binding.blobKekTargets,\n    requireBindingMembership: true,\n  });\n  const blobKekTargets = await verifiedBlobKekTargetsForBinding({\n    binding: input.binding,\n    projection: input.binding.writeAuthorization,\n    // The signed binding proves which slot exposes the blob now. Writer\n    // authorization describes the older target set committed when the bytes\n    // were written, so a later valid binding need not appear in that set.\n    requireBindingMembership: false,\n  });\n  if (\n    header.metadataHash !== input.encrypted.metadataHash ||\n    header.contentKeyEpoch !== input.encrypted.contentKeyEpoch ||\n    header.contentRecordId !== input.encrypted.contentRecordId ||\n    header.nonceDomainHash !== input.encrypted.nonceDomainHash\n  ) {\n    throw new Error(\"Attachment blob write header does not match ciphertext\");\n  }\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    blobAuthorization: {\n      authorizingContainerPaths: resolveEventContainerPaths({\n        containerPathByManifestHash:\n          input.authorization.containerPathByManifestHash,\n        dependencyManifestHashes: header.dependencyManifestHashes,\n      }).dependencyContainerPaths,\n      blobKekTargets,\n      principalPolicies: input.authorization.principalPolicies,\n    },\n    expectedAccessManifestHash: blobKekTargets.blobAccessManifestHash,\n    expectedObject: {\n      objectKind: \"blob\",\n      objectId: input.binding.blobId,\n      organizationId: input.organizationId,\n    },\n    expectedTargetHash: blobKekTargets.blobKeyTargetHash,\n    header,\n    writerPublicKey: writer.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n"]}

package/workflows/blobs/detach.js

@@ -3,14 +3,17 @@ import { assertBlobAttachmentDetachResponse } from "../../data/documents/blob/sh
 import { authorizingContainerPathRefs } from "../../data/documents/shared/projection.js";
 import { readCanonicalRecord } from "../../data/keyingCanonicalJson.js";
 import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { resolveBlobMutationWriterProjection } from "./writerProjection.js";
-export async function detachDocumentAttachment({ apiClient, author, bindingId, blobId, documentId, eventId = crypto.randomUUID(), execSql, isRemoteSyncBlocked, resolveProjectionUserKey, signedAt = new Date().toISOString(), slotId, writerProjection, }) {
+export async function detachDocumentAttachment({ apiClient, author, bindingId, blobId, documentId, eventId = crypto.randomUUID(), execSql, isRemoteSyncBlocked, resolveProjectionUserKey, signedAt = new Date().toISOString(), slotId, stillCurrent, warmReferencedPrincipalPolicies, writerProjection, }) {
     const resolved = await resolveBlobMutationWriterProjection({
         apiClient,
         documentId,
         errorLabel: "Blob attachment detach",
         execSql,
         isRemoteSyncBlocked,
+        stillCurrent,
+        warmReferencedPrincipalPolicies,
         resolveProjectionUserKey: requireProjectionUserKeyResolver(resolveProjectionUserKey, "Document attachment detach"),
         writerProjection,
     });
@@ -35,12 +38,14 @@ export async function detachDocumentAttachment({ apiClient, author, bindingId, b
         body: readCanonicalRecord(body, "Blob attachment detach body"),
         authorizingContainerPathRefs: pathRefs,
     };
+    assertProjectionVerificationCurrent(stillCurrent);
     const response = await apiClient.detachBlobAttachment(blobId, bindingId, request, {
         expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,
     });
     if (!response) {
         return null;
     }
+    assertProjectionVerificationCurrent(stillCurrent);
     assertBlobAttachmentDetachResponse({
         bindingId,
         blobId,

package/workflows/blobs/detach.js.map

@@ -1 +1 @@
-{"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAKhG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/documents/blob/shared/events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/documents/blob/shared/responses\";\nimport type {\n  DetachDocumentAttachmentInput,\n  DetachDocumentAttachmentResult,\n} from \"../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keyingCanonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { resolveBlobMutationWriterProjection } from \"./writerProjection\";\n\nexport async function detachDocumentAttachment({\n  apiClient,\n  author,\n  bindingId,\n  blobId,\n  documentId,\n  eventId = crypto.randomUUID(),\n  execSql,\n  isRemoteSyncBlocked,\n  resolveProjectionUserKey,\n  signedAt = new Date().toISOString(),\n  slotId,\n  writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult | null> {\n  const resolved = await resolveBlobMutationWriterProjection({\n    apiClient,\n    documentId,\n    errorLabel: \"Blob attachment detach\",\n    execSql,\n    isRemoteSyncBlocked,\n    resolveProjectionUserKey: requireProjectionUserKeyResolver(\n      resolveProjectionUserKey,\n      \"Document attachment detach\",\n    ),\n    writerProjection,\n  });\n  if (!resolved) {\n    return null;\n  }\n  const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n    resolved;\n\n  const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n  const { body, event } = await signBlobAttachmentDetachEvent({\n    author,\n    bindingId,\n    blobId,\n    documentId,\n    eventId,\n    manifestIdentity,\n    signedAt,\n    slotId,\n    authorizingContainerPathRefs: pathRefs,\n  });\n  const request: BlobAttachmentDetachRequest = {\n    event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n    body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n    authorizingContainerPathRefs: pathRefs,\n  };\n  const response = await apiClient.detachBlobAttachment(\n    blobId,\n    bindingId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n\n  assertBlobAttachmentDetachResponse({\n    bindingId,\n    blobId,\n    documentId,\n    response,\n    slotId,\n  });\n\n  return {\n    request,\n    response,\n    writerProjection: resolvedWriterProjection,\n  };\n}\n"]}
+{"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAKhG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAElD,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/documents/blob/shared/events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/documents/blob/shared/responses\";\nimport type {\n  DetachDocumentAttachmentInput,\n  DetachDocumentAttachmentResult,\n} from \"../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keyingCanonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { resolveBlobMutationWriterProjection } from \"./writerProjection\";\n\nexport async function detachDocumentAttachment({\n  apiClient,\n  author,\n  bindingId,\n  blobId,\n  documentId,\n  eventId = crypto.randomUUID(),\n  execSql,\n  isRemoteSyncBlocked,\n  resolveProjectionUserKey,\n  signedAt = new Date().toISOString(),\n  slotId,\n  stillCurrent,\n  warmReferencedPrincipalPolicies,\n  writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult | null> {\n  const resolved = await resolveBlobMutationWriterProjection({\n    apiClient,\n    documentId,\n    errorLabel: \"Blob attachment detach\",\n    execSql,\n    isRemoteSyncBlocked,\n    stillCurrent,\n    warmReferencedPrincipalPolicies,\n    resolveProjectionUserKey: requireProjectionUserKeyResolver(\n      resolveProjectionUserKey,\n      \"Document attachment detach\",\n    ),\n    writerProjection,\n  });\n  if (!resolved) {\n    return null;\n  }\n  const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n    resolved;\n\n  const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n  const { body, event } = await signBlobAttachmentDetachEvent({\n    author,\n    bindingId,\n    blobId,\n    documentId,\n    eventId,\n    manifestIdentity,\n    signedAt,\n    slotId,\n    authorizingContainerPathRefs: pathRefs,\n  });\n  const request: BlobAttachmentDetachRequest = {\n    event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n    body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n    authorizingContainerPathRefs: pathRefs,\n  };\n  assertProjectionVerificationCurrent(stillCurrent);\n  const response = await apiClient.detachBlobAttachment(\n    blobId,\n    bindingId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  assertProjectionVerificationCurrent(stillCurrent);\n\n  assertBlobAttachmentDetachResponse({\n    bindingId,\n    blobId,\n    documentId,\n    response,\n    slotId,\n  });\n\n  return {\n    request,\n    response,\n    writerProjection: resolvedWriterProjection,\n  };\n}\n"]}

package/workflows/blobs/hydrate.d.ts

@@ -2,7 +2,7 @@ import type { BlobBytesResponse } from "../../internal/api-client/index.js";
 import type { BlobAttachmentSummary, DocumentWriterProjectionResponse, ListDocumentAttachmentsResponse } from "../../internal/validators/response/index.js";
 import type { BlobBytes } from "../../data/blobContracts.js";
 import type { DocumentAttachment } from "../../data/documents/documentContent.js";
-import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification.js";
 import type { SecurityIncidentReporter } from "../../data/securityIncidents.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 interface DocumentAttachmentHydrationApi {
@@ -45,6 +45,8 @@ interface DocumentAttachmentHydrationContext {
     resolveProjectionUserKey: ProjectionUserKeyResolver;
     reportSecurityIncident?: SecurityIncidentReporter | undefined;
     targetSecretKey: Uint8Array;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
 }
 export declare function hydrateDocumentAttachmentBlobs(input: DocumentAttachmentHydrationContext & {
     attachments: ReadonlyArray<DocumentAttachment>;

package/workflows/blobs/hydrate.js

@@ -97,6 +97,8 @@ async function decryptLoadedDocumentAttachmentBlob(input) {
         execSql: input.execSql,
         resolveProjectionUserKey: input.resolveProjectionUserKey,
         targetSecretKey: input.targetSecretKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
         writerProjection: input.writerProjection,
     });
     const { attachment, binding } = input.loaded;

package/workflows/blobs/hydrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"hydrate.js","sourceRoot":"","sources":["hydrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAoD7D,SAAS,yBAAyB,CAChC,UAA8B,EAC9B,OAA8B;IAE9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,CAAC,MAAM;QACjB,OAAO,CAAC,SAAS;QACjB,UAAU,CAAC,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAiBD,KAAK,UAAU,mBAAmB,CAChC,IAAuB;IAEvB,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAuB,EACvB,cAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CACtD,CAAC;IAEF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAUhC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAC3D,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAEC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,uCAAuC,YAAY,CACrF,KAAK,CACN,EAAE,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,yCAAyC,CAC9E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,oCAAoC,CACzE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAEC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;SACpE,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CACZ,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,gBAAkE,EAClE,mBAA2E;IAE3E,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM;YACX,CAAC,CAAC;gBACE;oBACE,GAAG,MAAM;oBACT,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,KAIC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,aAAa,CAAC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,IAAI,cAAc,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,qEAAqE;QACrE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,4FAA4F,CACzG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,2FAA2F,CACxG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,OAAO;QACP,KAAK;QACL,aAAa;QACb,cAAc;QACd,UAAU,EAAE,QAAQ,OAAO,CAAC,MAAM,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAEC;IAED,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CACtE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC/D,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,OAAO;YACZ,uBAAuB,CAAC;gBACtB,UAAU;gBACV,OAAO;gBACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;gBACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;aACrD,CAAC;YACF,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACL,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,sCAAsC,CACxD,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;QACtC,GAAG,KAAK;QACR,gBAAgB;KACjB,CAAC,CACH,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,2BAA2B,CACxE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;QACjD,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,6CAA6C,KAAK,CAAC,UAAU,+BAA+B,CACzG,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,GAAG,KAAK;QACR,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,mCAAmC,CAAC;gBAClC,GAAG,KAAK;gBACR,iBAAiB;gBACjB,MAAM;gBACN,gBAAgB;aACjB,CAAC;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,IAAI,CAChE,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport { bytesToHex } from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentSummary,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../data/blobContracts\";\nimport { attachmentContentSha256 } from \"../../data/documents/attachmentContentIdentity\";\nimport type { DocumentAttachment } from \"../../data/documents/documentContent\";\nimport { errorMessage } from \"../../data/errorMessage\";\nimport type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { createAttachmentDecryptor } from \"./attachmentDecryptor\";\nimport { collectHydrationResults } from \"./hydrationResults\";\n\ninterface DocumentAttachmentHydrationApi {\n  evictDocumentWriterProjection?(documentId: string): void;\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n}\n\ninterface HydratedDocumentAttachmentBlob {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  bytes: BlobBytes;\n  /** Plaintext digest of `bytes`. */\n  contentSha256: string;\n  /**\n   * The served binding is validly signed but its plaintext digest differs\n   * from the digest the document content records for the slot. Set only when\n   * the slot held no local bytes: the bind and the content update carrying\n   * its digest are two server writes, and an uploader lost between them must\n   * not leave the attachment permanently invisible. Never a security incident;\n   * an honest crash window is indistinguishable from a served rollback.\n   */\n  intentMismatch: boolean;\n  storageKey: string;\n}\n\ninterface DocumentAttachmentHydrationContext {\n  apiClient: DocumentAttachmentHydrationApi;\n  documentId: string;\n  execSql: ExecSql;\n  localBlobIdBySlotId?:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId?: Readonly<Record<string, string | undefined>>;\n  log?: ((message: string) => void) | undefined;\n  logPrefix?: string | undefined;\n  /**\n   * Served bindings already downloaded and refused for a held copy, keyed per\n   * (slot, binding, intent). Populated here; a later pass skips the download\n   * until the binding or the document intent changes.\n   */\n  rejectedServedBindings?: Set<string> | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  targetSecretKey: Uint8Array;\n}\n\nfunction servedBindingRejectionKey(\n  attachment: DocumentAttachment,\n  binding: BlobAttachmentSummary,\n): string {\n  return JSON.stringify([\n    attachment.slotId,\n    binding.bindingId,\n    attachment.contentSha256,\n  ]);\n}\n\ninterface DocumentAttachmentHydrationTarget {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n}\n\ninterface LoadedDocumentAttachmentBlob\n  extends DocumentAttachmentHydrationTarget {\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\ninterface LoadedDocumentAttachmentBlobBytes {\n  blobId: string;\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\nasync function readBlobStreamBytes(\n  blob: BlobBytesResponse,\n): Promise<Uint8Array<ArrayBuffer>> {\n  return new Uint8Array(await new Response(blob.encryptedBytes).arrayBuffer());\n}\n\nasync function hasExpectedBlobSha256(\n  blob: BlobBytesResponse,\n  encryptedBytes: Uint8Array<ArrayBuffer>,\n): Promise<boolean> {\n  const blobDigest = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", encryptedBytes),\n  );\n\n  return bytesToHex(blobDigest) === blob.sha256;\n}\n\nfunction shouldHydrateAttachment(input: {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  localBlobIdBySlotId:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId:\n    | Readonly<Record<string, string | undefined>>\n    | undefined;\n  rejectedServedBindings: ReadonlySet<string> | undefined;\n}): boolean {\n  const slotId = input.attachment.slotId;\n  const localStorageKey = input.localStorageKeyBySlotId?.[slotId];\n  // An empty slot always hydrates: a rejection only ever protected a held\n  // copy, so once that copy is gone the served binding is shown (flagged).\n  if (!localStorageKey) {\n    return true;\n  }\n  if (\n    input.rejectedServedBindings?.has(\n      servedBindingRejectionKey(input.attachment, input.binding),\n    )\n  ) {\n    return false;\n  }\n\n  const localBlobId = input.localBlobIdBySlotId?.[slotId];\n  return localBlobId !== null && localBlobId !== input.binding.blobId;\n}\n\nasync function loadDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    binding: BlobAttachmentSummary;\n  },\n): Promise<LoadedDocumentAttachmentBlobBytes | null> {\n  const { apiClient, binding, log } = input;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  const blob = await apiClient.getBlobBytes(binding.blobId);\n  if (!blob) {\n    return null;\n  }\n\n  let encryptedBytes: Uint8Array<ArrayBuffer>;\n  try {\n    encryptedBytes = await readBlobStreamBytes(blob);\n  } catch (error) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} failed to stream during hydration: ${errorMessage(\n        error,\n      )}`,\n    );\n    return null;\n  }\n\n  if (encryptedBytes.byteLength !== blob.byteLength) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} byte length mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  if (!(await hasExpectedBlobSha256(blob, encryptedBytes))) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} sha256 mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  return {\n    blobId: binding.blobId,\n    encryptedBytes,\n  };\n}\n\nasync function loadUniqueDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>;\n  },\n): Promise<ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>> {\n  const targetsByBlobId = new Map<string, DocumentAttachmentHydrationTarget>();\n  for (const target of input.hydrationTargets) {\n    if (!targetsByBlobId.has(target.binding.blobId)) {\n      targetsByBlobId.set(target.binding.blobId, target);\n    }\n  }\n\n  const loadedBlobs = await collectHydrationResults({\n    ...input,\n    tasks: Array.from(targetsByBlobId.values()).map((target) => ({\n      blobId: target.binding.blobId,\n      run: () =>\n        loadDocumentAttachmentBlob({ ...input, binding: target.binding }),\n    })),\n  });\n\n  return new Map(\n    loadedBlobs.flatMap((loaded) =>\n      loaded ? [[loaded.blobId, loaded] as const] : [],\n    ),\n  );\n}\n\nfunction applyLoadedBlobBytesToHydrationTargets(\n  hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>,\n  loadedBlobsByBlobId: ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>,\n): LoadedDocumentAttachmentBlob[] {\n  return hydrationTargets.flatMap((target) => {\n    const loaded = loadedBlobsByBlobId.get(target.binding.blobId);\n    return loaded\n      ? [\n          {\n            ...target,\n            encryptedBytes: loaded.encryptedBytes,\n          },\n        ]\n      : [];\n  });\n}\n\nasync function decryptLoadedDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    loaded: LoadedDocumentAttachmentBlob;\n    decryptAttachment: ReturnType<typeof createAttachmentDecryptor>;\n    writerProjection: DocumentWriterProjectionResponse;\n  },\n): Promise<HydratedDocumentAttachmentBlob | null> {\n  const bytes = await input.decryptAttachment({\n    binding: input.loaded.binding,\n    encryptedBytes: input.loaded.encryptedBytes,\n    expectedDocumentId: input.documentId,\n    expectedSlotId: input.loaded.attachment.slotId,\n    execSql: input.execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    targetSecretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n  });\n\n  const { attachment, binding } = input.loaded;\n  const contentSha256 = await attachmentContentSha256(bytes);\n  const intentMismatch = contentSha256 !== attachment.contentSha256;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  if (intentMismatch && input.localStorageKeyBySlotId?.[attachment.slotId]) {\n    // Never replace a held copy with bytes the document does not record.\n    input.rejectedServedBindings?.add(\n      servedBindingRejectionKey(attachment, binding),\n    );\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; keeping the held copy.`,\n    );\n    return null;\n  }\n  if (intentMismatch) {\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; showing them flagged.`,\n    );\n  }\n  return {\n    attachment,\n    binding,\n    bytes,\n    contentSha256,\n    intentMismatch,\n    storageKey: `blob-${binding.blobId}`,\n  };\n}\n\nexport async function hydrateDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    attachments: ReadonlyArray<DocumentAttachment>;\n  },\n): Promise<HydratedDocumentAttachmentBlob[] | null> {\n  const attachmentBindings = await input.apiClient.listDocumentAttachments(\n    input.documentId,\n  );\n  if (!attachmentBindings) {\n    return null;\n  }\n\n  const bindingBySlotId = new Map(\n    attachmentBindings.map((binding) => [binding.slotId, binding]),\n  );\n  const hydrationTargets: DocumentAttachmentHydrationTarget[] =\n    input.attachments.flatMap((attachment) => {\n      const binding = bindingBySlotId.get(attachment.slotId);\n      return binding &&\n        shouldHydrateAttachment({\n          attachment,\n          binding,\n          localBlobIdBySlotId: input.localBlobIdBySlotId,\n          localStorageKeyBySlotId: input.localStorageKeyBySlotId,\n          rejectedServedBindings: input.rejectedServedBindings,\n        })\n        ? [{ attachment, binding }]\n        : [];\n    });\n  if (hydrationTargets.length === 0) {\n    return [];\n  }\n\n  const loadedBlobs = applyLoadedBlobBytesToHydrationTargets(\n    hydrationTargets,\n    await loadUniqueDocumentAttachmentBlobs({\n      ...input,\n      hydrationTargets,\n    }),\n  );\n  if (loadedBlobs.length === 0) {\n    return [];\n  }\n\n  const writerProjection = await input.apiClient.getDocumentWriterProjection(\n    input.documentId,\n  );\n  if (!writerProjection) {\n    const logPrefix = input.logPrefix ?? \"Documents\";\n    input.log?.(\n      `${logPrefix}: cannot hydrate attachments for document ${input.documentId} without a writer projection.`,\n    );\n    return [];\n  }\n\n  const decryptAttachment = createAttachmentDecryptor(\n    input.apiClient,\n    input.documentId,\n  );\n  const hydrated = await collectHydrationResults({\n    ...input,\n    tasks: loadedBlobs.map((loaded) => ({\n      blobId: loaded.binding.blobId,\n      run: () =>\n        decryptLoadedDocumentAttachmentBlob({\n          ...input,\n          decryptAttachment,\n          loaded,\n          writerProjection,\n        }),\n    })),\n  });\n  return hydrated.filter(\n    (item): item is HydratedDocumentAttachmentBlob => item !== null,\n  );\n}\n"]}
+{"version":3,"file":"hydrate.js","sourceRoot":"","sources":["hydrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAOvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAsD7D,SAAS,yBAAyB,CAChC,UAA8B,EAC9B,OAA8B;IAE9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,CAAC,MAAM;QACjB,OAAO,CAAC,SAAS;QACjB,UAAU,CAAC,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAiBD,KAAK,UAAU,mBAAmB,CAChC,IAAuB;IAEvB,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAuB,EACvB,cAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CACtD,CAAC;IAEF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAUhC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAC3D,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAEC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,uCAAuC,YAAY,CACrF,KAAK,CACN,EAAE,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,yCAAyC,CAC9E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,oCAAoC,CACzE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAEC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;SACpE,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CACZ,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,gBAAkE,EAClE,mBAA2E;IAE3E,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM;YACX,CAAC,CAAC;gBACE;oBACE,GAAG,MAAM;oBACT,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,KAIC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,aAAa,CAAC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,IAAI,cAAc,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,qEAAqE;QACrE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,4FAA4F,CACzG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,2FAA2F,CACxG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,OAAO;QACP,KAAK;QACL,aAAa;QACb,cAAc;QACd,UAAU,EAAE,QAAQ,OAAO,CAAC,MAAM,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAEC;IAED,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CACtE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC/D,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,OAAO;YACZ,uBAAuB,CAAC;gBACtB,UAAU;gBACV,OAAO;gBACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;gBACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;aACrD,CAAC;YACF,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACL,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,sCAAsC,CACxD,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;QACtC,GAAG,KAAK;QACR,gBAAgB;KACjB,CAAC,CACH,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,2BAA2B,CACxE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;QACjD,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,6CAA6C,KAAK,CAAC,UAAU,+BAA+B,CACzG,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,GAAG,KAAK;QACR,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,mCAAmC,CAAC;gBAClC,GAAG,KAAK;gBACR,iBAAiB;gBACjB,MAAM;gBACN,gBAAgB;aACjB,CAAC;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,IAAI,CAChE,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport { bytesToHex } from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentSummary,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../data/blobContracts\";\nimport { attachmentContentSha256 } from \"../../data/documents/attachmentContentIdentity\";\nimport type { DocumentAttachment } from \"../../data/documents/documentContent\";\nimport { errorMessage } from \"../../data/errorMessage\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { createAttachmentDecryptor } from \"./attachmentDecryptor\";\nimport { collectHydrationResults } from \"./hydrationResults\";\n\ninterface DocumentAttachmentHydrationApi {\n  evictDocumentWriterProjection?(documentId: string): void;\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n}\n\ninterface HydratedDocumentAttachmentBlob {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  bytes: BlobBytes;\n  /** Plaintext digest of `bytes`. */\n  contentSha256: string;\n  /**\n   * The served binding is validly signed but its plaintext digest differs\n   * from the digest the document content records for the slot. Set only when\n   * the slot held no local bytes: the bind and the content update carrying\n   * its digest are two server writes, and an uploader lost between them must\n   * not leave the attachment permanently invisible. Never a security incident;\n   * an honest crash window is indistinguishable from a served rollback.\n   */\n  intentMismatch: boolean;\n  storageKey: string;\n}\n\ninterface DocumentAttachmentHydrationContext {\n  apiClient: DocumentAttachmentHydrationApi;\n  documentId: string;\n  execSql: ExecSql;\n  localBlobIdBySlotId?:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId?: Readonly<Record<string, string | undefined>>;\n  log?: ((message: string) => void) | undefined;\n  logPrefix?: string | undefined;\n  /**\n   * Served bindings already downloaded and refused for a held copy, keyed per\n   * (slot, binding, intent). Populated here; a later pass skips the download\n   * until the binding or the document intent changes.\n   */\n  rejectedServedBindings?: Set<string> | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  targetSecretKey: Uint8Array;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nfunction servedBindingRejectionKey(\n  attachment: DocumentAttachment,\n  binding: BlobAttachmentSummary,\n): string {\n  return JSON.stringify([\n    attachment.slotId,\n    binding.bindingId,\n    attachment.contentSha256,\n  ]);\n}\n\ninterface DocumentAttachmentHydrationTarget {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n}\n\ninterface LoadedDocumentAttachmentBlob\n  extends DocumentAttachmentHydrationTarget {\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\ninterface LoadedDocumentAttachmentBlobBytes {\n  blobId: string;\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\nasync function readBlobStreamBytes(\n  blob: BlobBytesResponse,\n): Promise<Uint8Array<ArrayBuffer>> {\n  return new Uint8Array(await new Response(blob.encryptedBytes).arrayBuffer());\n}\n\nasync function hasExpectedBlobSha256(\n  blob: BlobBytesResponse,\n  encryptedBytes: Uint8Array<ArrayBuffer>,\n): Promise<boolean> {\n  const blobDigest = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", encryptedBytes),\n  );\n\n  return bytesToHex(blobDigest) === blob.sha256;\n}\n\nfunction shouldHydrateAttachment(input: {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  localBlobIdBySlotId:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId:\n    | Readonly<Record<string, string | undefined>>\n    | undefined;\n  rejectedServedBindings: ReadonlySet<string> | undefined;\n}): boolean {\n  const slotId = input.attachment.slotId;\n  const localStorageKey = input.localStorageKeyBySlotId?.[slotId];\n  // An empty slot always hydrates: a rejection only ever protected a held\n  // copy, so once that copy is gone the served binding is shown (flagged).\n  if (!localStorageKey) {\n    return true;\n  }\n  if (\n    input.rejectedServedBindings?.has(\n      servedBindingRejectionKey(input.attachment, input.binding),\n    )\n  ) {\n    return false;\n  }\n\n  const localBlobId = input.localBlobIdBySlotId?.[slotId];\n  return localBlobId !== null && localBlobId !== input.binding.blobId;\n}\n\nasync function loadDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    binding: BlobAttachmentSummary;\n  },\n): Promise<LoadedDocumentAttachmentBlobBytes | null> {\n  const { apiClient, binding, log } = input;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  const blob = await apiClient.getBlobBytes(binding.blobId);\n  if (!blob) {\n    return null;\n  }\n\n  let encryptedBytes: Uint8Array<ArrayBuffer>;\n  try {\n    encryptedBytes = await readBlobStreamBytes(blob);\n  } catch (error) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} failed to stream during hydration: ${errorMessage(\n        error,\n      )}`,\n    );\n    return null;\n  }\n\n  if (encryptedBytes.byteLength !== blob.byteLength) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} byte length mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  if (!(await hasExpectedBlobSha256(blob, encryptedBytes))) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} sha256 mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  return {\n    blobId: binding.blobId,\n    encryptedBytes,\n  };\n}\n\nasync function loadUniqueDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>;\n  },\n): Promise<ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>> {\n  const targetsByBlobId = new Map<string, DocumentAttachmentHydrationTarget>();\n  for (const target of input.hydrationTargets) {\n    if (!targetsByBlobId.has(target.binding.blobId)) {\n      targetsByBlobId.set(target.binding.blobId, target);\n    }\n  }\n\n  const loadedBlobs = await collectHydrationResults({\n    ...input,\n    tasks: Array.from(targetsByBlobId.values()).map((target) => ({\n      blobId: target.binding.blobId,\n      run: () =>\n        loadDocumentAttachmentBlob({ ...input, binding: target.binding }),\n    })),\n  });\n\n  return new Map(\n    loadedBlobs.flatMap((loaded) =>\n      loaded ? [[loaded.blobId, loaded] as const] : [],\n    ),\n  );\n}\n\nfunction applyLoadedBlobBytesToHydrationTargets(\n  hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>,\n  loadedBlobsByBlobId: ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>,\n): LoadedDocumentAttachmentBlob[] {\n  return hydrationTargets.flatMap((target) => {\n    const loaded = loadedBlobsByBlobId.get(target.binding.blobId);\n    return loaded\n      ? [\n          {\n            ...target,\n            encryptedBytes: loaded.encryptedBytes,\n          },\n        ]\n      : [];\n  });\n}\n\nasync function decryptLoadedDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    loaded: LoadedDocumentAttachmentBlob;\n    decryptAttachment: ReturnType<typeof createAttachmentDecryptor>;\n    writerProjection: DocumentWriterProjectionResponse;\n  },\n): Promise<HydratedDocumentAttachmentBlob | null> {\n  const bytes = await input.decryptAttachment({\n    binding: input.loaded.binding,\n    encryptedBytes: input.loaded.encryptedBytes,\n    expectedDocumentId: input.documentId,\n    expectedSlotId: input.loaded.attachment.slotId,\n    execSql: input.execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    targetSecretKey: input.targetSecretKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    writerProjection: input.writerProjection,\n  });\n\n  const { attachment, binding } = input.loaded;\n  const contentSha256 = await attachmentContentSha256(bytes);\n  const intentMismatch = contentSha256 !== attachment.contentSha256;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  if (intentMismatch && input.localStorageKeyBySlotId?.[attachment.slotId]) {\n    // Never replace a held copy with bytes the document does not record.\n    input.rejectedServedBindings?.add(\n      servedBindingRejectionKey(attachment, binding),\n    );\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; keeping the held copy.`,\n    );\n    return null;\n  }\n  if (intentMismatch) {\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; showing them flagged.`,\n    );\n  }\n  return {\n    attachment,\n    binding,\n    bytes,\n    contentSha256,\n    intentMismatch,\n    storageKey: `blob-${binding.blobId}`,\n  };\n}\n\nexport async function hydrateDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    attachments: ReadonlyArray<DocumentAttachment>;\n  },\n): Promise<HydratedDocumentAttachmentBlob[] | null> {\n  const attachmentBindings = await input.apiClient.listDocumentAttachments(\n    input.documentId,\n  );\n  if (!attachmentBindings) {\n    return null;\n  }\n\n  const bindingBySlotId = new Map(\n    attachmentBindings.map((binding) => [binding.slotId, binding]),\n  );\n  const hydrationTargets: DocumentAttachmentHydrationTarget[] =\n    input.attachments.flatMap((attachment) => {\n      const binding = bindingBySlotId.get(attachment.slotId);\n      return binding &&\n        shouldHydrateAttachment({\n          attachment,\n          binding,\n          localBlobIdBySlotId: input.localBlobIdBySlotId,\n          localStorageKeyBySlotId: input.localStorageKeyBySlotId,\n          rejectedServedBindings: input.rejectedServedBindings,\n        })\n        ? [{ attachment, binding }]\n        : [];\n    });\n  if (hydrationTargets.length === 0) {\n    return [];\n  }\n\n  const loadedBlobs = applyLoadedBlobBytesToHydrationTargets(\n    hydrationTargets,\n    await loadUniqueDocumentAttachmentBlobs({\n      ...input,\n      hydrationTargets,\n    }),\n  );\n  if (loadedBlobs.length === 0) {\n    return [];\n  }\n\n  const writerProjection = await input.apiClient.getDocumentWriterProjection(\n    input.documentId,\n  );\n  if (!writerProjection) {\n    const logPrefix = input.logPrefix ?? \"Documents\";\n    input.log?.(\n      `${logPrefix}: cannot hydrate attachments for document ${input.documentId} without a writer projection.`,\n    );\n    return [];\n  }\n\n  const decryptAttachment = createAttachmentDecryptor(\n    input.apiClient,\n    input.documentId,\n  );\n  const hydrated = await collectHydrationResults({\n    ...input,\n    tasks: loadedBlobs.map((loaded) => ({\n      blobId: loaded.binding.blobId,\n      run: () =>\n        decryptLoadedDocumentAttachmentBlob({\n          ...input,\n          decryptAttachment,\n          loaded,\n          writerProjection,\n        }),\n    })),\n  });\n  return hydrated.filter(\n    (item): item is HydratedDocumentAttachmentBlob => item !== null,\n  );\n}\n"]}

package/workflows/blobs/retainedAttachmentVerification.js

@@ -13,6 +13,8 @@ export async function verifyRetainedAttachment(input) {
         allowStaleContentKeyBundle: true,
         ...projectionVerificationOptions({
             execSql: input.execSql,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
             resolveProjectionUserKey,
         }),
         onVerifiedAuthorization: (value) => {

package/workflows/blobs/retainedAttachmentVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"retainedAttachmentVerification.js","sourceRoot":"","sources":["retainedAttachmentVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAElG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAEL,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAGC;IAED,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IAAI,aAAgE,CAAC;IACrE,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,GAAG,6BAA6B,CAAC;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB;SACzB,CAAC;QACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAChE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,MAAM,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,MAAM,+BAA+B,CAAC;QACpC,GAAG,KAAK;QACR,aAAa;QACb,wBAAwB;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,2BAA2B,CAAC;QAC1B,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../data/documents/blob/shared/responses\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../data/documents/blob/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  requireProjectionUserKeyResolver,\n} from \"../../data/keyingProjectionVerification\";\nimport { assertAttachmentBindingVerified } from \"./attachmentBindingVerification\";\nimport { assertBlobWrapScopeVerified } from \"./verifiedWrapScope\";\n\n/** Retaining an existing envelope does not propagate a key to a new recipient. */\nexport async function verifyRetainedAttachment(\n  input: Omit<\n    DecryptDocumentAttachmentBlobInput,\n    \"encryptedBytes\" | \"targetSecretKey\"\n  >,\n): Promise<void> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Retained attachment scope\",\n  );\n  let authorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    allowStaleContentKeyBundle: true,\n    ...projectionVerificationOptions({\n      execSql: input.execSql,\n      resolveProjectionUserKey,\n    }),\n    onVerifiedAuthorization: (value) => {\n      authorization = value;\n    },\n  });\n  if (input.binding.contentKeyBundle.blobId !== input.binding.blobId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retained attachment bundle names another blob\",\n    );\n  await assertBlobContentKeyBundleTargetHash(input.binding.contentKeyBundle);\n  await assertAttachmentBindingVerified({\n    ...input,\n    authorization,\n    resolveProjectionUserKey,\n  });\n  if (!authorization) throw new Error(\"Attachment authority is unavailable\");\n  assertBlobWrapScopeVerified({\n    authorization,\n    binding: input.binding,\n    documentId: input.expectedDocumentId,\n  });\n}\n"]}
+{"version":3,"file":"retainedAttachmentVerification.js","sourceRoot":"","sources":["retainedAttachmentVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAElG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAEL,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAGC;IAED,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IAAI,aAAgE,CAAC;IACrE,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,GAAG,6BAA6B,CAAC;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,wBAAwB;SACzB,CAAC;QACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAChE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,MAAM,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,MAAM,+BAA+B,CAAC;QACpC,GAAG,KAAK;QACR,aAAa;QACb,wBAAwB;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,2BAA2B,CAAC;QAC1B,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../data/documents/blob/shared/responses\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../data/documents/blob/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  requireProjectionUserKeyResolver,\n} from \"../../data/keyingProjectionVerification\";\nimport { assertAttachmentBindingVerified } from \"./attachmentBindingVerification\";\nimport { assertBlobWrapScopeVerified } from \"./verifiedWrapScope\";\n\n/** Retaining an existing envelope does not propagate a key to a new recipient. */\nexport async function verifyRetainedAttachment(\n  input: Omit<\n    DecryptDocumentAttachmentBlobInput,\n    \"encryptedBytes\" | \"targetSecretKey\"\n  >,\n): Promise<void> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Retained attachment scope\",\n  );\n  let authorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    allowStaleContentKeyBundle: true,\n    ...projectionVerificationOptions({\n      execSql: input.execSql,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      resolveProjectionUserKey,\n    }),\n    onVerifiedAuthorization: (value) => {\n      authorization = value;\n    },\n  });\n  if (input.binding.contentKeyBundle.blobId !== input.binding.blobId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retained attachment bundle names another blob\",\n    );\n  await assertBlobContentKeyBundleTargetHash(input.binding.contentKeyBundle);\n  await assertAttachmentBindingVerified({\n    ...input,\n    authorization,\n    resolveProjectionUserKey,\n  });\n  if (!authorization) throw new Error(\"Attachment authority is unavailable\");\n  assertBlobWrapScopeVerified({\n    authorization,\n    binding: input.binding,\n    documentId: input.expectedDocumentId,\n  });\n}\n"]}

package/workflows/container-contents/container-state/createAdoption.js

@@ -3,6 +3,7 @@ import { errorMessage } from "../../../data/errorMessage.js";
 import { verifiedContainerCreateManifest } from "../../../data/keyingProjectionVerification/containerCreateManifest.js";
 import { verifyContainerDestinationProjection } from "../../../data/keyingProjectionVerification/containerDestinationVerification.js";
 import { isKeyingVerificationError, reportKeyingVerificationErrorInCauseChain, } from "../../../data/keyingProjectionVerification/error.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
 import { settleContainerCreateIntent } from "./createIntentSettlement.js";
 const LABEL = "Container create conflict";
 /** The recorded error that parks an intent whose listed create is foreign. */
@@ -29,6 +30,7 @@ async function verifyAdoptableProjection(input) {
         execSql: input.state.runtime.infra.execSql,
         projection,
         resolveUserKey: input.state.resolveProjectionUserKey,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.state.runtime),
     });
     const head = path.at(-1);
     // One read naming another container says nothing signed about this id.