@tearleads/client-sdk 0.1.19 → 0.1.21

package/internal/api-client/apiRequestRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiRequestRuntime.js","sourceRoot":"","sources":["apiRequestRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAErB,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAiBlE,MAAM,OAAO,iBAAiB;IACpB,SAAS,GAAkB,IAAI,CAAC;IAChC,cAAc,GAAwC,IAAI,CAAC;IAClD,OAAO,CAAS;IACzB,OAAO,GAAuC,IAAI,CAAC;IACnD,cAAc,GAAwB,IAAI,CAAC;IAC3C,gBAAgB,GAAwB,IAAI,CAAC;IAC7C,YAAY,GAAuC,IAAI,CAAC;IACxD,gBAAgB,GAA0B,IAAI,CAAC;IAC/C,iBAAiB,GAAkC,IAAI,CAAC;IAC/C,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjE,OAAO,CAAqB;IAC5B,aAAa,CAA2B;IACxC,eAAe,CAA6B;IAErD,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5C,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;YAC7D,aAAa,EAAE,IAAI,CAAC,4BAA4B;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,YAAoB,EAAE,WAAmB;QAC1D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,mBAAmB,CAC7B,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAC7D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,yBAAyB,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,UAAU,CAAC,OAA2C;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,iBAAiB,CAAC,OAA4B;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,mBAAmB,CAAC,OAA4B;QAC9C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,kEAAkE;IAClE,eAAe,CAAC,OAA2C;QACzD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,mBAAmB,CAAC,OAA8B;QAChD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,oBAAoB,CAAC,OAAsC;QACzD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,KAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QACzC,IAAI,OAAO;YAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE;YACtC,IAAI,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CAAC,KAA2C;QAC3D,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;IACzE,CAAC;IAEO,YAAY,CAClB,IAA6B,EAC7B,OAA2C,EAC3C,SAAwB;QAExB,OAAO;YACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;gBACjE,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAY,EACZ,SAAyC,EACzC,MAAkB,EAClB,IAA6B,EAC7B,OAAyC,EACzC,gBAAmD;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACzC,IAAI,EACJ,SAAS,EACT,MAAM,EACN,IAAI,EACJ,OAAO,EACP,gBAAgB,CACjB,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,KAWtB;QACC,MAAM,OAAO,GAAmB;YAC9B,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,EAAE;gBACX,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,KAAK,CAAC,sBAAsB;gBAC9B,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,oBAAoB;gBAC5B,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAC3B,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAC7D,OAAO,CACR,CAAC;QAEF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,SAAyC,EACzC,MAAkB,EAClB,IAA6B,EAC7B,UAAgC,EAAE,EAClC,gBAAmD;QAEnD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACnD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,EAAE,EACF,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QACrC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAClD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE;gBAChD,MAAM;gBACN,IAAI;gBACJ,YAAY;gBACZ,sBAAsB,EAAE,SAAS;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,8BAA8B,IAAI,EAAE;gBAC7C,MAAM;gBACN,IAAI;gBACJ,YAAY;gBACZ,sBAAsB,EAAE,SAAS;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,IAAY,EACZ,MAAkB,EAClB,IAA6B,EAC7B,UAAgC,EAAE,EAClC,yBAA4C,EAC5C,gBAA2D;QAE3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACpD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,SAAS,CACV,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QACrC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAClD,QAAQ,EACR,gBAAgB,EAChB,OAAO,CAAC,qCAAqC,CAC9C,CAAC;QACF,IACE,MAAM,8BAA8B,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YACzC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE;YACrE,OAAO;YACP,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE;YACzC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC;YACjD,cAAc,EAAE,QAAQ,CAAC,MAAM;SAChC,CAAC,EACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,YAAY;gBAChD,OAAO,IAAI,CAAC,WAAW,CAAC;oBACtB,gBAAgB;oBAChB,gBAAgB;oBAChB,MAAM;oBACN,OAAO,EAAE;wBACP,GAAG,OAAO;wBACV,YAAY,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;qBAC9D;oBACD,IAAI;oBACJ,QAAQ;iBACT,CAAC,CAAC;YACL,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACjD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,SAAS,CACf,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC;YACvC,IAAI,oBAAoB,CAAC,aAAa,EAAE,yBAAyB,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO,IAAI,CAAC,WAAW,CAAC;gBACtB,gBAAgB,EAAE,MAAM,qBAAqB,CAC3C,aAAa,EACb,gBAAgB,EAChB,OAAO,CAAC,qCAAqC,CAC9C;gBACD,gBAAgB;gBAChB,MAAM;gBACN,OAAO;gBACP,IAAI;gBACJ,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,gBAAgB;YAChB,gBAAgB;YAChB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,IAAY,EACZ,MAAkB,EAClB,IAA6B,EAC7B,OAA6B,EAC7B,SAAwB;QAExB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAClD,MAAM,IAAI,GAAsC;YAC9C,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;YAC5D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,IAAI,YAAY,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;YACnD,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACzC,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;gBACpD,MAAM;gBACN,IAAI;gBACJ,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;gBAC9C,sBAAsB,EAAE,SAAS;gBACjC,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,eAAe,CAChC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC3C,CAAC;QACF,IAAI,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,KAOnB;QACC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;QACzD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QACxD,IACE,CAAC,SAAS;YACV,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;YAC7B,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC;YAC9C,KAAK,CAAC,gBAAgB,CAAC,6BAA6B,KAAK,SAAS;YAClE,KAAK,CAAC,gBAAgB,CAAC,6BAA6B;gBAClD,KAAK,CAAC,OAAO,CAAC,qCAAqC,EACrD,CAAC;YACD,IAAI,CAAC,iBAAiB,EAAE,CACtB,KAAK,CAAC,gBAAgB,CAAC,6BAA6B,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;gBAC7B,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,IAAI;oBACpC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YACtC,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC/H,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,CAAC,SAAS,IAAI,YAAY;YACxC,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,oBAAoB;YACjE,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAC,sBAAsB;YACrE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,4BAA4B,CAClC,KAA4C;QAE5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,GAAG,KAAK;YACR,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;YACjD,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import {\n  authChallengeSigningBytes,\n  canonicalAuthOrigin,\n} from \"@tearleads/crypto\";\nimport {\n  apiVersionHeaderName,\n  parseApiVersion,\n} from \"@tearleads/validators/operation\";\nimport {\n  bindPrototypeMethods,\n  describeErrorResponse,\n  type ErrorResponseDescription,\n  errorMessage,\n  hasHeader,\n  isSuccessfulResponse,\n  normalizeApiBaseUrl,\n  requestFailureKey,\n} from \"./requestInternals\";\nimport { responseBodyFailure } from \"./responseBodyFailure\";\nimport { shouldRetryAfterSessionExpired } from \"./sessionRefresh\";\nimport type {\n  HttpMethod,\n  OperationRequestFn,\n  OperationRequestResultFn,\n  OperationResponseRequestFn,\n  RequestBody,\n  RequestFailure,\n  RequestFailureKind,\n  RequestResult,\n  RequestResultOptions,\n  ResponseRequestValidationFailureInput,\n} from \"./types\";\n\ntype ExpiredHandler = () => boolean | Promise<boolean>;\ntype PaymentRequiredHandler = (organizationId: string | null) => void;\n\nexport class ApiRequestRuntime {\n  private authToken: string | null = null;\n  private sessionRenewal: { from: string; to: string } | null = null;\n  private readonly baseUrl: string;\n  private onError: ((message: string) => void) | null = null;\n  private onNetworkError: (() => void) | null = null;\n  private onNetworkSuccess: (() => void) | null = null;\n  private onApiVersion: ((version: number) => void) | null = null;\n  private onSessionExpired: ExpiredHandler | null = null;\n  private onPaymentRequired: PaymentRequiredHandler | null = null;\n  private readonly requestFailuresByKey = new Map<string, RequestFailure>();\n  readonly request: OperationRequestFn;\n  readonly requestResult: OperationRequestResultFn;\n  readonly responseRequest: OperationResponseRequestFn;\n\n  constructor(baseUrl?: string | null) {\n    this.baseUrl = normalizeApiBaseUrl(baseUrl);\n    bindPrototypeMethods(this, ApiRequestRuntime.prototype);\n    this.request = this.makeRequest;\n    this.requestResult = this.makeRequestResult;\n    this.responseRequest = Object.assign(this.makeResponseRequest, {\n      reportFailure: this.reportResponseRequestFailure,\n    });\n  }\n\n  /**\n   * The bytes a login challenge is signed as, bound to the API this client\n   * addresses. A relative base URL resolves against the page, as its requests\n   * do; with neither, there is no API origin to sign for.\n   */\n  authChallengeBytes(challengeHex: string, fingerprint: string): Uint8Array {\n    let apiOrigin: string;\n    try {\n      apiOrigin = canonicalAuthOrigin(\n        new URL(this.baseUrl || \"/\", globalThis.location?.href).href,\n      );\n    } catch {\n      throw new Error(\"The API origin is unavailable for authentication\");\n    }\n    return authChallengeSigningBytes({ apiOrigin, challengeHex, fingerprint });\n  }\n\n  setOnError(handler: ((message: string) => void) | null): void {\n    this.onError = handler;\n  }\n\n  setOnNetworkError(handler: (() => void) | null): void {\n    this.onNetworkError = handler;\n  }\n\n  setOnNetworkSuccess(handler: (() => void) | null): void {\n    this.onNetworkSuccess = handler;\n  }\n\n  /** Receives the build named by each response that carries one. */\n  setOnApiVersion(handler: ((version: number) => void) | null): void {\n    this.onApiVersion = handler;\n  }\n\n  setOnSessionExpired(handler: ExpiredHandler | null): void {\n    this.onSessionExpired = handler;\n  }\n\n  setOnPaymentRequired(handler: PaymentRequiredHandler | null): void {\n    this.onPaymentRequired = handler;\n  }\n\n  setAuthToken(token: string | null): boolean {\n    const changed = this.authToken !== token;\n    if (changed) this.sessionRenewal = null;\n    this.authToken = token;\n    return changed;\n  }\n\n  getAuthToken(): string | null {\n    return this.authToken;\n  }\n\n  private async renewSession(): Promise<boolean> {\n    const from = this.authToken;\n    const renewed = await (this.onSessionExpired?.() ?? false);\n    const to = this.authToken;\n    if (renewed && from && to && from !== to)\n      this.sessionRenewal = { from, to };\n    return renewed;\n  }\n\n  getRequestFailure(input: { method: HttpMethod; path: string }) {\n    return this.requestFailuresByKey.get(requestFailureKey(input)) ?? null;\n  }\n\n  private buildHeaders(\n    body: RequestBody | undefined,\n    headers: Record<string, string> | undefined,\n    authToken: string | null,\n  ): Record<string, string> {\n    return {\n      ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),\n      ...(typeof body === \"string\" && !hasHeader(headers, \"Content-Type\")\n        ? { \"Content-Type\": \"application/json\" }\n        : {}),\n      ...headers,\n    };\n  }\n\n  private async makeRequest<T>(\n    path: string,\n    validator: (value: unknown) => value is T,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions | undefined,\n    failureOperation: Parameters<OperationRequestFn>[5],\n  ): Promise<T | null> {\n    const result = await this.makeRequestResult(\n      path,\n      validator,\n      method,\n      body,\n      options,\n      failureOperation,\n    );\n    return result.ok ? result.data : null;\n  }\n\n  private requestFailure(input: {\n    code?: string | undefined;\n    kind: RequestFailureKind;\n    message: string;\n    method: HttpMethod;\n    path: string;\n    reportErrors: boolean;\n    requiredContainerIds?: RequestFailure[\"requiredContainerIds\"];\n    stalePrincipalPolicies: RequestFailure[\"stalePrincipalPolicies\"];\n    status: number | null;\n    statusText: string;\n  }): RequestFailure {\n    const failure: RequestFailure = {\n      ...(input.code === undefined ? {} : { code: input.code }),\n      kind: input.kind,\n      message: input.message,\n      method: input.method,\n      ok: false,\n      path: input.path,\n      report: () => {\n        if (input.kind !== \"cancelled\") this.onError?.(input.message);\n      },\n      status: input.status,\n      statusText: input.statusText,\n      ...(input.stalePrincipalPolicies\n        ? { stalePrincipalPolicies: input.stalePrincipalPolicies }\n        : {}),\n      ...(input.requiredContainerIds\n        ? { requiredContainerIds: input.requiredContainerIds }\n        : {}),\n    };\n    this.requestFailuresByKey.set(\n      requestFailureKey({ method: input.method, path: input.path }),\n      failure,\n    );\n\n    if (input.reportErrors) {\n      failure.report();\n    }\n\n    return failure;\n  }\n\n  private async makeRequestResult<T>(\n    path: string,\n    validator: (value: unknown) => value is T,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions = {},\n    failureOperation: Parameters<OperationRequestFn>[5],\n  ): Promise<RequestResult<T>> {\n    const responseResult = await this.makeResponseRequest(\n      path,\n      method,\n      body,\n      options,\n      [],\n      failureOperation,\n    );\n    if (!responseResult.ok) {\n      return responseResult;\n    }\n\n    const response = responseResult.data;\n    const reportErrors = options.reportErrors ?? true;\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      const failure = responseBodyFailure(error, errorMessage(error));\n      if (failure.kind === \"network\") {\n        this.onNetworkError?.();\n      }\n      return this.requestFailure({\n        kind: failure.kind,\n        message: `${method} ${path}: ${failure.message}`,\n        method,\n        path,\n        reportErrors,\n        stalePrincipalPolicies: undefined,\n        status: response.status,\n        statusText: response.statusText,\n      });\n    }\n\n    if (!validator(data)) {\n      return this.requestFailure({\n        kind: \"shape\",\n        message: `Invalid response shape for ${path}`,\n        method,\n        path,\n        reportErrors,\n        stalePrincipalPolicies: undefined,\n        status: response.status,\n        statusText: response.statusText,\n      });\n    }\n\n    return { data, ok: true };\n  }\n\n  private async makeResponseRequest(\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions = {},\n    additionalSuccessStatuses: readonly number[],\n    failureOperation: Parameters<OperationResponseRequestFn>[5],\n  ): Promise<RequestResult<Response>> {\n    const authToken = this.authToken;\n    const responseResult = await this.fetchResponseRequest(\n      path,\n      method,\n      body,\n      options,\n      authToken,\n    );\n    if (!responseResult.ok) {\n      return responseResult;\n    }\n    const response = responseResult.data;\n    if (isSuccessfulResponse(response, additionalSuccessStatuses)) {\n      this.requestFailuresByKey.delete(requestFailureKey({ method, path }));\n      return { data: response, ok: true };\n    }\n\n    const errorDescription = await describeErrorResponse(\n      response,\n      failureOperation,\n      options.expectedPaymentRequiredOrganizationId,\n    );\n    if (\n      await shouldRetryAfterSessionExpired({\n        authToken,\n        body,\n        code: errorDescription.code,\n        getCurrentAuthToken: () => this.authToken,\n        isKnownSessionRenewal: (from, to) =>\n          this.sessionRenewal?.from === from && this.sessionRenewal.to === to,\n        options,\n        refreshSession: () => this.renewSession(),\n        reportError: (message) => this.onError?.(message),\n        responseStatus: response.status,\n      })\n    ) {\n      if (options.retryOnSessionExpired === \"renew-only\")\n        return this.httpFailure({\n          errorDescription,\n          failureOperation,\n          method,\n          options: {\n            ...options,\n            reportErrors: method === \"GET\" ? false : options.reportErrors,\n          },\n          path,\n          response,\n        });\n      const retryResult = await this.fetchResponseRequest(\n        path,\n        method,\n        body,\n        options,\n        this.authToken,\n      );\n      if (!retryResult.ok) {\n        return retryResult;\n      }\n      const retryResponse = retryResult.data;\n      if (isSuccessfulResponse(retryResponse, additionalSuccessStatuses)) {\n        this.requestFailuresByKey.delete(requestFailureKey({ method, path }));\n        return { data: retryResponse, ok: true };\n      }\n\n      return this.httpFailure({\n        errorDescription: await describeErrorResponse(\n          retryResponse,\n          failureOperation,\n          options.expectedPaymentRequiredOrganizationId,\n        ),\n        failureOperation,\n        method,\n        options,\n        path,\n        response: retryResponse,\n      });\n    }\n\n    return this.httpFailure({\n      errorDescription,\n      failureOperation,\n      method,\n      options,\n      path,\n      response,\n    });\n  }\n\n  private async fetchResponseRequest(\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions,\n    authToken: string | null,\n  ): Promise<RequestResult<Response>> {\n    const reportErrors = options.reportErrors ?? true;\n    const init: RequestInit & { duplex?: \"half\" } = {\n      method,\n      headers: this.buildHeaders(body, options.headers, authToken),\n      ...(options.signal ? { signal: options.signal } : {}),\n    };\n    if (body !== undefined) {\n      init.body = body;\n      if (body instanceof ReadableStream) {\n        init.duplex = \"half\";\n      }\n    }\n\n    let response: Response;\n    try {\n      response = await fetch(`${this.baseUrl}${path}`, init);\n    } catch (error) {\n      const cancelled = options.signal?.aborted === true;\n      if (!cancelled) this.onNetworkError?.();\n      return this.requestFailure({\n        ...(cancelled ? { code: \"request_aborted\" } : {}),\n        kind: cancelled ? \"cancelled\" : \"network\",\n        message: `${method} ${path}: ${errorMessage(error)}`,\n        method,\n        path,\n        reportErrors: cancelled ? false : reportErrors,\n        stalePrincipalPolicies: undefined,\n        status: null,\n        statusText: \"\",\n      });\n    }\n\n    this.onNetworkSuccess?.();\n    const apiVersion = parseApiVersion(\n      response.headers.get(apiVersionHeaderName),\n    );\n    if (apiVersion !== null) this.onApiVersion?.(apiVersion);\n    return { data: response, ok: true };\n  }\n\n  private httpFailure(input: {\n    readonly errorDescription: ErrorResponseDescription;\n    readonly failureOperation: Parameters<OperationResponseRequestFn>[5];\n    readonly method: HttpMethod;\n    readonly options: RequestResultOptions;\n    readonly path: string;\n    readonly response: Response;\n  }): RequestFailure {\n    const cancelled = input.options.signal?.aborted === true;\n    const reportErrors = input.options.reportErrors ?? true;\n    if (\n      !cancelled &&\n      input.response.status === 402 &&\n      input.failureOperation.failureResponses?.[402] &&\n      input.errorDescription.paymentRequiredOrganizationId !== undefined &&\n      input.errorDescription.paymentRequiredOrganizationId ===\n        input.options.expectedPaymentRequiredOrganizationId\n    ) {\n      this.onPaymentRequired?.(\n        input.errorDescription.paymentRequiredOrganizationId,\n      );\n    }\n    return this.requestFailure({\n      ...(cancelled\n        ? { code: \"request_aborted\" }\n        : input.errorDescription.code === null\n          ? {}\n          : { code: input.errorDescription.code }),\n      kind: cancelled ? \"cancelled\" : \"http\",\n      message: `${input.method} ${input.path}: ${input.response.status} ${input.response.statusText}${input.errorDescription.detail}`,\n      method: input.method,\n      path: input.path,\n      reportErrors: !cancelled && reportErrors,\n      requiredContainerIds: input.errorDescription.requiredContainerIds,\n      stalePrincipalPolicies: input.errorDescription.stalePrincipalPolicies,\n      status: input.response.status,\n      statusText: input.response.statusText,\n    });\n  }\n\n  private reportResponseRequestFailure(\n    input: ResponseRequestValidationFailureInput,\n  ): RequestFailure {\n    if (input.kind === \"network\") {\n      this.onNetworkError?.();\n    }\n    return this.requestFailure({\n      ...input,\n      reportErrors: input.options?.reportErrors ?? true,\n      stalePrincipalPolicies: undefined,\n    });\n  }\n}\n"]}
+{"version":3,"file":"apiRequestRuntime.js","sourceRoot":"","sources":["apiRequestRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAErB,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAiBlE,MAAM,OAAO,iBAAiB;IACpB,SAAS,GAAkB,IAAI,CAAC;IAChC,cAAc,GAAwC,IAAI,CAAC;IAClD,OAAO,CAAS;IACzB,OAAO,GAAuC,IAAI,CAAC;IACnD,cAAc,GAAwB,IAAI,CAAC;IAC3C,gBAAgB,GAAwB,IAAI,CAAC;IAC7C,YAAY,GAAuC,IAAI,CAAC;IACxD,gBAAgB,GAA0B,IAAI,CAAC;IAC/C,iBAAiB,GAAkC,IAAI,CAAC;IAC/C,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjE,OAAO,CAAqB;IAC5B,aAAa,CAA2B;IACxC,eAAe,CAA6B;IAErD,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5C,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;YAC7D,aAAa,EAAE,IAAI,CAAC,4BAA4B;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,YAAoB,EAAE,WAAmB;QAC1D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,mBAAmB,CAC7B,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAC7D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,yBAAyB,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,UAAU,CAAC,OAA2C;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,iBAAiB,CAAC,OAA4B;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,mBAAmB,CAAC,OAA4B;QAC9C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,kEAAkE;IAClE,eAAe,CAAC,OAA2C;QACzD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,mBAAmB,CAAC,OAA8B;QAChD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,oBAAoB,CAAC,OAAsC;QACzD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,KAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QACzC,IAAI,OAAO;YAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE;YACtC,IAAI,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CAAC,KAA2C;QAC3D,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;IACzE,CAAC;IAEO,YAAY,CAClB,IAA6B,EAC7B,OAA2C,EAC3C,SAAwB;QAExB,OAAO;YACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;gBACjE,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAY,EACZ,SAAyC,EACzC,MAAkB,EAClB,IAA6B,EAC7B,OAAyC,EACzC,gBAAmD;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACzC,IAAI,EACJ,SAAS,EACT,MAAM,EACN,IAAI,EACJ,OAAO,EACP,gBAAgB,CACjB,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,KAWtB;QACC,MAAM,OAAO,GAAmB;YAC9B,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,EAAE;gBACX,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,KAAK,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,oBAAoB;gBAC5B,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAC3B,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAC7D,OAAO,CACR,CAAC;QAEF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,SAAyC,EACzC,MAAkB,EAClB,IAA6B,EAC7B,UAAgC,EAAE,EAClC,gBAAmD;QAEnD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACnD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,EAAE,EACF,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QACrC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAClD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE;gBAChD,MAAM;gBACN,IAAI;gBACJ,YAAY;gBACZ,mBAAmB,EAAE,SAAS;gBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,8BAA8B,IAAI,EAAE;gBAC7C,MAAM;gBACN,IAAI;gBACJ,YAAY;gBACZ,mBAAmB,EAAE,SAAS;gBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,IAAY,EACZ,MAAkB,EAClB,IAA6B,EAC7B,UAAgC,EAAE,EAClC,yBAA4C,EAC5C,gBAA2D;QAE3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACpD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,SAAS,CACV,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QACrC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAClD,QAAQ,EACR,gBAAgB,EAChB,OAAO,CAAC,qCAAqC,CAC9C,CAAC;QACF,IACE,MAAM,8BAA8B,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YACzC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE;YACrE,OAAO;YACP,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE;YACzC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC;YACjD,cAAc,EAAE,QAAQ,CAAC,MAAM;SAChC,CAAC,EACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,YAAY;gBAChD,OAAO,IAAI,CAAC,WAAW,CAAC;oBACtB,gBAAgB;oBAChB,gBAAgB;oBAChB,MAAM;oBACN,OAAO,EAAE;wBACP,GAAG,OAAO;wBACV,YAAY,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;qBAC9D;oBACD,IAAI;oBACJ,QAAQ;iBACT,CAAC,CAAC;YACL,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACjD,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,SAAS,CACf,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC;YACvC,IAAI,oBAAoB,CAAC,aAAa,EAAE,yBAAyB,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO,IAAI,CAAC,WAAW,CAAC;gBACtB,gBAAgB,EAAE,MAAM,qBAAqB,CAC3C,aAAa,EACb,gBAAgB,EAChB,OAAO,CAAC,qCAAqC,CAC9C;gBACD,gBAAgB;gBAChB,MAAM;gBACN,OAAO;gBACP,IAAI;gBACJ,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,gBAAgB;YAChB,gBAAgB;YAChB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,IAAY,EACZ,MAAkB,EAClB,IAA6B,EAC7B,OAA6B,EAC7B,SAAwB;QAExB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAClD,MAAM,IAAI,GAAsC;YAC9C,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;YAC5D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,IAAI,YAAY,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;YACnD,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACzC,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;gBACpD,MAAM;gBACN,IAAI;gBACJ,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;gBAC9C,mBAAmB,EAAE,SAAS;gBAC9B,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,eAAe,CAChC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC3C,CAAC;QACF,IAAI,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,KAOnB;QACC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;QACzD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QACxD,IACE,CAAC,SAAS;YACV,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;YAC7B,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC;YAC9C,KAAK,CAAC,gBAAgB,CAAC,6BAA6B,KAAK,SAAS;YAClE,KAAK,CAAC,gBAAgB,CAAC,6BAA6B;gBAClD,KAAK,CAAC,OAAO,CAAC,qCAAqC,EACrD,CAAC;YACD,IAAI,CAAC,iBAAiB,EAAE,CACtB,KAAK,CAAC,gBAAgB,CAAC,6BAA6B,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;gBAC7B,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,IAAI;oBACpC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YACtC,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC/H,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,CAAC,SAAS,IAAI,YAAY;YACxC,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,oBAAoB;YACjE,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;YAC/D,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,4BAA4B,CAClC,KAA4C;QAE5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,GAAG,KAAK;YACR,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;YACjD,mBAAmB,EAAE,SAAS;SAC/B,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import {\n  authChallengeSigningBytes,\n  canonicalAuthOrigin,\n} from \"@tearleads/crypto\";\nimport {\n  apiVersionHeaderName,\n  parseApiVersion,\n} from \"@tearleads/validators/operation\";\nimport {\n  bindPrototypeMethods,\n  describeErrorResponse,\n  type ErrorResponseDescription,\n  errorMessage,\n  hasHeader,\n  isSuccessfulResponse,\n  normalizeApiBaseUrl,\n  requestFailureKey,\n} from \"./requestInternals\";\nimport { responseBodyFailure } from \"./responseBodyFailure\";\nimport { shouldRetryAfterSessionExpired } from \"./sessionRefresh\";\nimport type {\n  HttpMethod,\n  OperationRequestFn,\n  OperationRequestResultFn,\n  OperationResponseRequestFn,\n  RequestBody,\n  RequestFailure,\n  RequestFailureKind,\n  RequestResult,\n  RequestResultOptions,\n  ResponseRequestValidationFailureInput,\n} from \"./types\";\n\ntype ExpiredHandler = () => boolean | Promise<boolean>;\ntype PaymentRequiredHandler = (organizationId: string | null) => void;\n\nexport class ApiRequestRuntime {\n  private authToken: string | null = null;\n  private sessionRenewal: { from: string; to: string } | null = null;\n  private readonly baseUrl: string;\n  private onError: ((message: string) => void) | null = null;\n  private onNetworkError: (() => void) | null = null;\n  private onNetworkSuccess: (() => void) | null = null;\n  private onApiVersion: ((version: number) => void) | null = null;\n  private onSessionExpired: ExpiredHandler | null = null;\n  private onPaymentRequired: PaymentRequiredHandler | null = null;\n  private readonly requestFailuresByKey = new Map<string, RequestFailure>();\n  readonly request: OperationRequestFn;\n  readonly requestResult: OperationRequestResultFn;\n  readonly responseRequest: OperationResponseRequestFn;\n\n  constructor(baseUrl?: string | null) {\n    this.baseUrl = normalizeApiBaseUrl(baseUrl);\n    bindPrototypeMethods(this, ApiRequestRuntime.prototype);\n    this.request = this.makeRequest;\n    this.requestResult = this.makeRequestResult;\n    this.responseRequest = Object.assign(this.makeResponseRequest, {\n      reportFailure: this.reportResponseRequestFailure,\n    });\n  }\n\n  /**\n   * The bytes a login challenge is signed as, bound to the API this client\n   * addresses. A relative base URL resolves against the page, as its requests\n   * do; with neither, there is no API origin to sign for.\n   */\n  authChallengeBytes(challengeHex: string, fingerprint: string): Uint8Array {\n    let apiOrigin: string;\n    try {\n      apiOrigin = canonicalAuthOrigin(\n        new URL(this.baseUrl || \"/\", globalThis.location?.href).href,\n      );\n    } catch {\n      throw new Error(\"The API origin is unavailable for authentication\");\n    }\n    return authChallengeSigningBytes({ apiOrigin, challengeHex, fingerprint });\n  }\n\n  setOnError(handler: ((message: string) => void) | null): void {\n    this.onError = handler;\n  }\n\n  setOnNetworkError(handler: (() => void) | null): void {\n    this.onNetworkError = handler;\n  }\n\n  setOnNetworkSuccess(handler: (() => void) | null): void {\n    this.onNetworkSuccess = handler;\n  }\n\n  /** Receives the build named by each response that carries one. */\n  setOnApiVersion(handler: ((version: number) => void) | null): void {\n    this.onApiVersion = handler;\n  }\n\n  setOnSessionExpired(handler: ExpiredHandler | null): void {\n    this.onSessionExpired = handler;\n  }\n\n  setOnPaymentRequired(handler: PaymentRequiredHandler | null): void {\n    this.onPaymentRequired = handler;\n  }\n\n  setAuthToken(token: string | null): boolean {\n    const changed = this.authToken !== token;\n    if (changed) this.sessionRenewal = null;\n    this.authToken = token;\n    return changed;\n  }\n\n  getAuthToken(): string | null {\n    return this.authToken;\n  }\n\n  private async renewSession(): Promise<boolean> {\n    const from = this.authToken;\n    const renewed = await (this.onSessionExpired?.() ?? false);\n    const to = this.authToken;\n    if (renewed && from && to && from !== to)\n      this.sessionRenewal = { from, to };\n    return renewed;\n  }\n\n  getRequestFailure(input: { method: HttpMethod; path: string }) {\n    return this.requestFailuresByKey.get(requestFailureKey(input)) ?? null;\n  }\n\n  private buildHeaders(\n    body: RequestBody | undefined,\n    headers: Record<string, string> | undefined,\n    authToken: string | null,\n  ): Record<string, string> {\n    return {\n      ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),\n      ...(typeof body === \"string\" && !hasHeader(headers, \"Content-Type\")\n        ? { \"Content-Type\": \"application/json\" }\n        : {}),\n      ...headers,\n    };\n  }\n\n  private async makeRequest<T>(\n    path: string,\n    validator: (value: unknown) => value is T,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions | undefined,\n    failureOperation: Parameters<OperationRequestFn>[5],\n  ): Promise<T | null> {\n    const result = await this.makeRequestResult(\n      path,\n      validator,\n      method,\n      body,\n      options,\n      failureOperation,\n    );\n    return result.ok ? result.data : null;\n  }\n\n  private requestFailure(input: {\n    code?: string | undefined;\n    kind: RequestFailureKind;\n    message: string;\n    method: HttpMethod;\n    path: string;\n    reportErrors: boolean;\n    requiredContainerIds?: RequestFailure[\"requiredContainerIds\"];\n    stalePrincipalHeads: RequestFailure[\"stalePrincipalHeads\"];\n    status: number | null;\n    statusText: string;\n  }): RequestFailure {\n    const failure: RequestFailure = {\n      ...(input.code === undefined ? {} : { code: input.code }),\n      kind: input.kind,\n      message: input.message,\n      method: input.method,\n      ok: false,\n      path: input.path,\n      report: () => {\n        if (input.kind !== \"cancelled\") this.onError?.(input.message);\n      },\n      status: input.status,\n      statusText: input.statusText,\n      ...(input.stalePrincipalHeads\n        ? { stalePrincipalHeads: input.stalePrincipalHeads }\n        : {}),\n      ...(input.requiredContainerIds\n        ? { requiredContainerIds: input.requiredContainerIds }\n        : {}),\n    };\n    this.requestFailuresByKey.set(\n      requestFailureKey({ method: input.method, path: input.path }),\n      failure,\n    );\n\n    if (input.reportErrors) {\n      failure.report();\n    }\n\n    return failure;\n  }\n\n  private async makeRequestResult<T>(\n    path: string,\n    validator: (value: unknown) => value is T,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions = {},\n    failureOperation: Parameters<OperationRequestFn>[5],\n  ): Promise<RequestResult<T>> {\n    const responseResult = await this.makeResponseRequest(\n      path,\n      method,\n      body,\n      options,\n      [],\n      failureOperation,\n    );\n    if (!responseResult.ok) {\n      return responseResult;\n    }\n\n    const response = responseResult.data;\n    const reportErrors = options.reportErrors ?? true;\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      const failure = responseBodyFailure(error, errorMessage(error));\n      if (failure.kind === \"network\") {\n        this.onNetworkError?.();\n      }\n      return this.requestFailure({\n        kind: failure.kind,\n        message: `${method} ${path}: ${failure.message}`,\n        method,\n        path,\n        reportErrors,\n        stalePrincipalHeads: undefined,\n        status: response.status,\n        statusText: response.statusText,\n      });\n    }\n\n    if (!validator(data)) {\n      return this.requestFailure({\n        kind: \"shape\",\n        message: `Invalid response shape for ${path}`,\n        method,\n        path,\n        reportErrors,\n        stalePrincipalHeads: undefined,\n        status: response.status,\n        statusText: response.statusText,\n      });\n    }\n\n    return { data, ok: true };\n  }\n\n  private async makeResponseRequest(\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions = {},\n    additionalSuccessStatuses: readonly number[],\n    failureOperation: Parameters<OperationResponseRequestFn>[5],\n  ): Promise<RequestResult<Response>> {\n    const authToken = this.authToken;\n    const responseResult = await this.fetchResponseRequest(\n      path,\n      method,\n      body,\n      options,\n      authToken,\n    );\n    if (!responseResult.ok) {\n      return responseResult;\n    }\n    const response = responseResult.data;\n    if (isSuccessfulResponse(response, additionalSuccessStatuses)) {\n      this.requestFailuresByKey.delete(requestFailureKey({ method, path }));\n      return { data: response, ok: true };\n    }\n\n    const errorDescription = await describeErrorResponse(\n      response,\n      failureOperation,\n      options.expectedPaymentRequiredOrganizationId,\n    );\n    if (\n      await shouldRetryAfterSessionExpired({\n        authToken,\n        body,\n        code: errorDescription.code,\n        getCurrentAuthToken: () => this.authToken,\n        isKnownSessionRenewal: (from, to) =>\n          this.sessionRenewal?.from === from && this.sessionRenewal.to === to,\n        options,\n        refreshSession: () => this.renewSession(),\n        reportError: (message) => this.onError?.(message),\n        responseStatus: response.status,\n      })\n    ) {\n      if (options.retryOnSessionExpired === \"renew-only\")\n        return this.httpFailure({\n          errorDescription,\n          failureOperation,\n          method,\n          options: {\n            ...options,\n            reportErrors: method === \"GET\" ? false : options.reportErrors,\n          },\n          path,\n          response,\n        });\n      const retryResult = await this.fetchResponseRequest(\n        path,\n        method,\n        body,\n        options,\n        this.authToken,\n      );\n      if (!retryResult.ok) {\n        return retryResult;\n      }\n      const retryResponse = retryResult.data;\n      if (isSuccessfulResponse(retryResponse, additionalSuccessStatuses)) {\n        this.requestFailuresByKey.delete(requestFailureKey({ method, path }));\n        return { data: retryResponse, ok: true };\n      }\n\n      return this.httpFailure({\n        errorDescription: await describeErrorResponse(\n          retryResponse,\n          failureOperation,\n          options.expectedPaymentRequiredOrganizationId,\n        ),\n        failureOperation,\n        method,\n        options,\n        path,\n        response: retryResponse,\n      });\n    }\n\n    return this.httpFailure({\n      errorDescription,\n      failureOperation,\n      method,\n      options,\n      path,\n      response,\n    });\n  }\n\n  private async fetchResponseRequest(\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions,\n    authToken: string | null,\n  ): Promise<RequestResult<Response>> {\n    const reportErrors = options.reportErrors ?? true;\n    const init: RequestInit & { duplex?: \"half\" } = {\n      method,\n      headers: this.buildHeaders(body, options.headers, authToken),\n      ...(options.signal ? { signal: options.signal } : {}),\n    };\n    if (body !== undefined) {\n      init.body = body;\n      if (body instanceof ReadableStream) {\n        init.duplex = \"half\";\n      }\n    }\n\n    let response: Response;\n    try {\n      response = await fetch(`${this.baseUrl}${path}`, init);\n    } catch (error) {\n      const cancelled = options.signal?.aborted === true;\n      if (!cancelled) this.onNetworkError?.();\n      return this.requestFailure({\n        ...(cancelled ? { code: \"request_aborted\" } : {}),\n        kind: cancelled ? \"cancelled\" : \"network\",\n        message: `${method} ${path}: ${errorMessage(error)}`,\n        method,\n        path,\n        reportErrors: cancelled ? false : reportErrors,\n        stalePrincipalHeads: undefined,\n        status: null,\n        statusText: \"\",\n      });\n    }\n\n    this.onNetworkSuccess?.();\n    const apiVersion = parseApiVersion(\n      response.headers.get(apiVersionHeaderName),\n    );\n    if (apiVersion !== null) this.onApiVersion?.(apiVersion);\n    return { data: response, ok: true };\n  }\n\n  private httpFailure(input: {\n    readonly errorDescription: ErrorResponseDescription;\n    readonly failureOperation: Parameters<OperationResponseRequestFn>[5];\n    readonly method: HttpMethod;\n    readonly options: RequestResultOptions;\n    readonly path: string;\n    readonly response: Response;\n  }): RequestFailure {\n    const cancelled = input.options.signal?.aborted === true;\n    const reportErrors = input.options.reportErrors ?? true;\n    if (\n      !cancelled &&\n      input.response.status === 402 &&\n      input.failureOperation.failureResponses?.[402] &&\n      input.errorDescription.paymentRequiredOrganizationId !== undefined &&\n      input.errorDescription.paymentRequiredOrganizationId ===\n        input.options.expectedPaymentRequiredOrganizationId\n    ) {\n      this.onPaymentRequired?.(\n        input.errorDescription.paymentRequiredOrganizationId,\n      );\n    }\n    return this.requestFailure({\n      ...(cancelled\n        ? { code: \"request_aborted\" }\n        : input.errorDescription.code === null\n          ? {}\n          : { code: input.errorDescription.code }),\n      kind: cancelled ? \"cancelled\" : \"http\",\n      message: `${input.method} ${input.path}: ${input.response.status} ${input.response.statusText}${input.errorDescription.detail}`,\n      method: input.method,\n      path: input.path,\n      reportErrors: !cancelled && reportErrors,\n      requiredContainerIds: input.errorDescription.requiredContainerIds,\n      stalePrincipalHeads: input.errorDescription.stalePrincipalHeads,\n      status: input.response.status,\n      statusText: input.response.statusText,\n    });\n  }\n\n  private reportResponseRequestFailure(\n    input: ResponseRequestValidationFailureInput,\n  ): RequestFailure {\n    if (input.kind === \"network\") {\n      this.onNetworkError?.();\n    }\n    return this.requestFailure({\n      ...input,\n      reportErrors: input.options?.reportErrors ?? true,\n      stalePrincipalHeads: undefined,\n    });\n  }\n}\n"]}

package/internal/api-client/documentPurge.js

@@ -0,0 +1,25 @@
+import { getDocumentPurgeProofOperation, purgeDocumentOperation, } from "../validators/operation/index.js";
+import { principalHistoryRequest } from "./principalHistoryRequest.js";
+import { documentPurge, documentPurgeProof, } from "./routes/documents/mutations.js";
+export async function purgeDocument(runtime, documentId, input, options) {
+    const result = await principalHistoryRequest(runtime, {
+        path: documentPurge.path(documentId),
+        validator: documentPurge.isResponse,
+        method: documentPurge.method,
+        body: JSON.stringify(input),
+        options,
+        operation: purgeDocumentOperation,
+    });
+    return result.ok ? result.data : null;
+}
+export async function getDocumentPurgeProof(runtime, documentId, options, requestOptions) {
+    const result = await principalHistoryRequest(runtime, {
+        path: documentPurgeProof.path(documentId, options),
+        validator: documentPurgeProof.isResponse,
+        method: documentPurgeProof.method,
+        options: requestOptions,
+        operation: getDocumentPurgeProofOperation,
+    });
+    return result.ok ? result.data : null;
+}
+//# sourceMappingURL=documentPurge.js.map

package/internal/api-client/documentPurge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentPurge.js","sourceRoot":"","sources":["documentPurge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAEL,aAAa,EACb,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAGtC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA0B,EAC1B,UAAkB,EAClB,KAA2B,EAC3B,OAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,aAAa,CAAC,UAAU;QACnC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,OAAO;QACP,SAAS,EAAE,sBAAsB;KAClC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA0B,EAC1B,UAAkB,EAClB,OAA8C,EAC9C,cAAoC;IAEpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;QAClD,SAAS,EAAE,kBAAkB,CAAC,UAAU;QACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;QACjC,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,8BAA8B;KAC1C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC","sourcesContent":["import {\n  getDocumentPurgeProofOperation,\n  purgeDocumentOperation,\n} from \"@tearleads/validators/operation\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  type DocumentPurgeProofOptions,\n  documentPurge,\n  documentPurgeProof,\n} from \"./routes/documents/mutations\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport async function purgeDocument(\n  runtime: ApiRequestRuntime,\n  documentId: string,\n  input: DocumentPurgeRequest,\n  options: RequestResultOptions,\n) {\n  const result = await principalHistoryRequest(runtime, {\n    path: documentPurge.path(documentId),\n    validator: documentPurge.isResponse,\n    method: documentPurge.method,\n    body: JSON.stringify(input),\n    options,\n    operation: purgeDocumentOperation,\n  });\n  return result.ok ? result.data : null;\n}\n\nexport async function getDocumentPurgeProof(\n  runtime: ApiRequestRuntime,\n  documentId: string,\n  options: DocumentPurgeProofOptions | undefined,\n  requestOptions: RequestResultOptions,\n) {\n  const result = await principalHistoryRequest(runtime, {\n    path: documentPurgeProof.path(documentId, options),\n    validator: documentPurgeProof.isResponse,\n    method: documentPurgeProof.method,\n    options: requestOptions,\n    operation: getDocumentPurgeProofOperation,\n  });\n  return result.ok ? result.data : null;\n}\n"]}

package/internal/api-client/organizationPolicyHistory.d.ts

@@ -0,0 +1,53 @@
+import type { ApiRequestRuntime } from "./apiRequestRuntime.js";
+import type { RequestResultOptions } from "./types.js";
+export declare function getOrganizationPolicyHistoryResult(runtime: ApiRequestRuntime, organizationId: string, stateHash: string, options?: RequestResultOptions & {
+    readonly beforeVersion?: number | undefined;
+}): Promise<import("./types.js").RequestResult<{
+    organizationId: string;
+    stateHash: string;
+    beforeVersion: number;
+    nextBeforeVersion: number | null;
+    evidence: {
+        organization: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        } | null;
+        organizationPayloads: {
+            reference: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            payload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+        }[];
+        groups: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        }[];
+    };
+}>>;

package/internal/api-client/organizationPolicyHistory.js

@@ -0,0 +1,15 @@
+import { getOrganizationPolicyHistoryOperation, operationRequestPathWithQuery, } from "../validators/operation/index.js";
+import { OrganizationPolicyHistoryResponseSchema, } from "../validators/response/index.js";
+import { principalHistoryRequest } from "./principalHistoryRequest.js";
+export function getOrganizationPolicyHistoryResult(runtime, organizationId, stateHash, options = {}) {
+    const { beforeVersion, ...requestOptions } = options;
+    const operation = getOrganizationPolicyHistoryOperation;
+    return principalHistoryRequest(runtime, {
+        path: operationRequestPathWithQuery(operation, { organizationId }, { stateHash, beforeVersion }),
+        method: "GET",
+        operation,
+        options: requestOptions,
+        validator: (value) => OrganizationPolicyHistoryResponseSchema.safeParse(value).success,
+    });
+}
+//# sourceMappingURL=organizationPolicyHistory.js.map

package/internal/api-client/organizationPolicyHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPolicyHistory.js","sourceRoot":"","sources":["organizationPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,uCAAuC,GACxC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,MAAM,UAAU,kCAAkC,CAChD,OAA0B,EAC1B,cAAsB,EACtB,SAAiB,EACjB,UAEI,EAAE;IAEN,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,SAAS,GAAG,qCAAqC,CAAC;IACxD,OAAO,uBAAuB,CAAC,OAAO,EAAE;QACtC,IAAI,EAAE,6BAA6B,CACjC,SAAS,EACT,EAAE,cAAc,EAAE,EAClB,EAAE,SAAS,EAAE,aAAa,EAAE,CAC7B;QACD,MAAM,EAAE,KAAK;QACb,SAAS;QACT,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,CAAC,KAAc,EAA8C,EAAE,CACxE,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;KACnE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  getOrganizationPolicyHistoryOperation,\n  operationRequestPathWithQuery,\n} from \"@tearleads/validators/operation\";\nimport {\n  type OrganizationPolicyHistoryResponse,\n  OrganizationPolicyHistoryResponseSchema,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport function getOrganizationPolicyHistoryResult(\n  runtime: ApiRequestRuntime,\n  organizationId: string,\n  stateHash: string,\n  options: RequestResultOptions & {\n    readonly beforeVersion?: number | undefined;\n  } = {},\n) {\n  const { beforeVersion, ...requestOptions } = options;\n  const operation = getOrganizationPolicyHistoryOperation;\n  return principalHistoryRequest(runtime, {\n    path: operationRequestPathWithQuery(\n      operation,\n      { organizationId },\n      { stateHash, beforeVersion },\n    ),\n    method: \"GET\",\n    operation,\n    options: requestOptions,\n    validator: (value: unknown): value is OrganizationPolicyHistoryResponse =>\n      OrganizationPolicyHistoryResponseSchema.safeParse(value).success,\n  });\n}\n"]}

package/internal/api-client/requestInternals.js

@@ -89,14 +89,14 @@ function parsedErrorResponseDescription(value, schema) {
         detail: error.length === 0 ? "" : `: ${error}`,
         error: error.length === 0 ? null : error,
         // Container mutations and document sync with inline container rekeys can
-        // carry signed policy bundles that make the failed write repairable.
+        // carry advisory heads whose signed evidence can be recovered in pages.
         ...(schema === ContainerMutationFailureResponseSchema &&
             isPrincipalPolicyStaleErrorResponse(value)
-            ? { stalePrincipalPolicies: value.principalPolicies }
+            ? { stalePrincipalHeads: value.principalHeads }
             : schema === DocumentSyncErrorResponseSchema &&
                 isDocumentSyncStateStaleErrorResponse(value) &&
-                value.principalPolicies !== undefined
-                ? { stalePrincipalPolicies: value.principalPolicies }
+                value.principalHeads !== undefined
+                ? { stalePrincipalHeads: value.principalHeads }
                 : {}),
         ...((code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||
             code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysInaccessible) &&

package/internal/api-client/requestInternals.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestInternals.js","sourceRoot":"","sources":["requestInternals.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,mCAAmC,EACnC,kCAAkC,EAClC,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAG3E;;;;;GAKG;AACH,SAAS,uCAAuC,CAC9C,UAA4C,EAC5C,QAA8B;IAE9B,OAAO,CACL,UAAU,CAAC,gBAAgB,EAAE,eAAe;QAC1C,QAAQ,CAAC,gBAAgB,EAAE,eAAe;QAC5C,UAAU,CAAC,gBAAgB,EAAE,mBAAmB;YAC9C,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB;QAChD,UAAU,CAAC,gBAAgB,EAAE,UAAU;YACrC,QAAQ,CAAC,gBAAgB,EAAE,UAAU;QACvC,UAAU,CAAC,kBAAkB,EAAE,mBAAmB;YAChD,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB;QAClD,UAAU,CAAC,kBAAkB,EAAE,qBAAqB;YAClD,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAqD,EACrD,UAAkB,EAClB,QAA8B,EAC9B,SAAsB;IAEtB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,SAAS,EAAE,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,uCAAuC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,SAAS,EAAE,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAaD,MAAM,6BAA6B,GAA6B;IAC9D,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF,MAAM,+BAA+B,GAA6B;IAChE,GAAG,6BAA6B;IAChC,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF,SAAS,oBAAoB,CAC3B,KAAa,EACb,MAA0E;IAE1E,IACE,CAAC,MAAM;QACP,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,IAAI,oBAAoB,CAAC;IAC3D,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO;QACnE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAc,EACd,MAA+D;IAE/D,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QACnB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE;QAC9C,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QACxC,yEAAyE;QACzE,qEAAqE;QACrE,GAAG,CAAC,MAAM,KAAK,sCAAsC;YACrD,mCAAmC,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YACrD,CAAC,CAAC,MAAM,KAAK,+BAA+B;gBACxC,qCAAqC,CAAC,KAAK,CAAC;gBAC5C,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,iBAAiB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;YACnE,IAAI,KAAK,8BAA8B,CAAC,4BAA4B,CAAC;YACvE,sBAAsB,IAAI,KAAK;YAC/B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACzC,KAAK,CAAC,oBAAoB,CAAC,MAAM,IAAI,6BAA6B;YAClE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAC9B,CAAC,WAAoB,EAAyB,EAAE,CAC9C,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D;YACC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,GAAG,CAAC,MAAM,KAAK,kCAAkC;YACjD,8BAA8B,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,CAAC,cAAc,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,SAAiB;IAEjB,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAkC;IAElC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3C,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,OAA2C,EAC3C,IAAY;IAEZ,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,cAAc,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,OAAO,GAAG,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAA2C;IAE3C,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAsC;IAEtC,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;KACnD,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW;QACX,GAAG,IAAI;QACP,SAAS,EAAE,uBAAuB,CAAC,SAAS,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,aAAa,CAC3B,KAAsB,EACtB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,OAAO,GAAG,OAAO,EAAE;SAChB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACL,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA6B;IAE7B,OAAO,CAAC,CACN,OAAO,cAAc,KAAK,UAAU,IAAI,IAAI,YAAY,cAAc,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,yBAA4C;IAE5C,OAAO,QAAQ,CAAC,EAAE,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,6BAA6B,CACpC,MAA0E,EAC1E,MAAe,EACf,sBAA0C;IAE1C,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IACE,CAAC,8BAA8B,CAAC,MAAM,CAAC;QACvC,CAAC,sBAAsB,KAAK,SAAS;YACnC,MAAM,CAAC,cAAc,KAAK,sBAAsB,CAAC,EACnD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,0BAA0B,CACjC,cAAkC;IAElC,OAAO,cAAc,KAAK,SAAS;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,6BAA6B;YAChC,6BAA6B,EAAE,cAAc;SAC9C,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAkB,EAClB,SAAyB,EACzB,qCAA8C;IAE9C,MAAM,MAAM,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,IAAI,CAAC;QACH,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,6BAA6B,CAAC;IACpC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,6BAA6B,CAAC;IACpC,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,EAAE,GAAG,6BAA6B,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,+BAA+B,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAG,6BAA6B,CACjD,MAAM,EACN,MAAM,EACN,qCAAqC,CACtC,CAAC;IACF,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,+BAA+B,CAAC;IACzC,CAAC;IAED,MAAM,WAAW,GACf,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC;QAC9C,0BAA0B,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,SAAS;QACd,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,EAAE,GAAG,6BAA6B,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,IAAmB;IAEnB,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,mBAAmB,CAAC,eAAe,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,yEAAyE;IACzE,oEAAoE;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC","sourcesContent":["import type { HttpOperation } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n  SyncWatermark,\n} from \"@tearleads/validators/response\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  ContainerMutationFailureResponseSchema,\n  DocumentSyncErrorResponseSchema,\n  isDocumentSyncStateStaleErrorResponse,\n  isPaymentRequiredErrorResponse,\n  isPrincipalPolicyStaleErrorResponse,\n  PaymentRequiredErrorResponseSchema,\n  SESSION_ERROR_CODES,\n} from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type { ListContainerDocumentsOptions, RequestBody } from \"./types\";\n\n/**\n * True when a sync response advances the document's write material past what a\n * cached/primed writer projection holds, so the projection must be re-fetched\n * before the next write. Compares the content-key bundle and KEK target hashes\n * the projection authorizes against the ones the server just committed.\n */\nfunction documentSyncInvalidatesWriterProjection(\n  projection: DocumentWriterProjectionResponse,\n  response: DocumentSyncResponse,\n): boolean {\n  return (\n    projection.contentKeyBundle?.contentKeyEpoch !==\n      response.contentKeyBundle?.contentKeyEpoch ||\n    projection.contentKeyBundle?.linkSetManifestHash !==\n      response.contentKeyBundle?.linkSetManifestHash ||\n    projection.contentKeyBundle?.targetHash !==\n      response.contentKeyBundle?.targetHash ||\n    projection.documentKekTargets?.linkSetManifestHash !==\n      response.documentKekTargets?.linkSetManifestHash ||\n    projection.documentKekTargets?.documentKeyTargetHash !==\n      response.documentKekTargets?.documentKeyTargetHash\n  );\n}\n\n/**\n * Evict a cached/primed document writer projection iff the just-committed sync\n * response moved its write material. Re-checks the cache slot after awaiting so\n * a concurrent invalidation or refetch is not clobbered. `onEvicted` fires\n * whenever an invalidation is issued, so callers can invalidate parallel\n * bookkeeping (e.g. an in-flight result fetch that predates the sync).\n */\nexport async function evictWriterProjectionIfSyncChanged(\n  cache: RequestCache<DocumentWriterProjectionResponse>,\n  documentId: string,\n  response: DocumentSyncResponse,\n  onEvicted?: () => void,\n): Promise<void> {\n  const cached = cache.get(documentId);\n  if (!cached) {\n    // No cached projection to compare against, so whether the sync moved the\n    // write material is undecidable here — but a concurrent in-flight GET may\n    // still predate it. Invalidate conservatively: deleting the (absent) slot\n    // bumps the cache's eviction generation so such a fetch's success is not\n    // cached, and onEvicted drops a shared in-flight result entry. The cost\n    // when nothing is in flight is a skipped cache warm, never wrong data.\n    cache.delete(documentId);\n    onEvicted?.();\n    return;\n  }\n  const projection = await cached.catch(() => null);\n  if (cache.get(documentId) !== cached || !projection) {\n    return;\n  }\n  if (documentSyncInvalidatesWriterProjection(projection, response)) {\n    cache.delete(documentId);\n    onEvicted?.();\n  }\n}\n\nexport interface ErrorResponseDescription {\n  readonly code: string | null;\n  readonly detail: string;\n  readonly error: string | null;\n  readonly stalePrincipalPolicies?: PrincipalPolicyBundleResponse[] | undefined;\n  /** Descendant rekeys a refused rotation must carry, parent-first. */\n  readonly requiredContainerIds?: readonly string[] | undefined;\n  /** Set on a 402 body — the organization whose billing blocked the sync write. */\n  readonly paymentRequiredOrganizationId?: string | undefined;\n}\n\nconst emptyErrorResponseDescription: ErrorResponseDescription = {\n  code: null,\n  detail: \"\",\n  error: null,\n};\n\nconst invalidErrorResponseDescription: ErrorResponseDescription = {\n  ...emptyErrorResponseDescription,\n  detail: \": Invalid failure response body\",\n};\n\nfunction validatedFailureCode(\n  value: object,\n  schema: NonNullable<HttpOperation[\"failureResponses\"]>[number] | undefined,\n): string | null {\n  if (\n    !schema ||\n    !(\"code\" in value) ||\n    typeof value.code !== \"string\" ||\n    value.code.length === 0\n  ) {\n    return null;\n  }\n\n  // Loose object schemas retain extension keys. A code is behavior-bearing\n  // only when changing that field to an unregistered value breaks the selected\n  // status schema, proving that the schema constrains rather than merely\n  // preserves it.\n  const unregisteredCode = `${value.code}\\u0000unregistered`;\n  return schema.safeParse({ ...value, code: unregisteredCode }).success\n    ? null\n    : value.code;\n}\n\nfunction parsedErrorResponseDescription(\n  value: unknown,\n  schema?: NonNullable<HttpOperation[\"failureResponses\"]>[number],\n): ErrorResponseDescription | null {\n  if (\n    !value ||\n    typeof value !== \"object\" ||\n    !(\"error\" in value) ||\n    typeof value.error !== \"string\"\n  ) {\n    return null;\n  }\n\n  const error = value.error.trim();\n  const code = validatedFailureCode(value, schema);\n  if (error.length === 0 && code === null) {\n    return null;\n  }\n  return {\n    code,\n    detail: error.length === 0 ? \"\" : `: ${error}`,\n    error: error.length === 0 ? null : error,\n    // Container mutations and document sync with inline container rekeys can\n    // carry signed policy bundles that make the failed write repairable.\n    ...(schema === ContainerMutationFailureResponseSchema &&\n    isPrincipalPolicyStaleErrorResponse(value)\n      ? { stalePrincipalPolicies: value.principalPolicies }\n      : schema === DocumentSyncErrorResponseSchema &&\n          isDocumentSyncStateStaleErrorResponse(value) &&\n          value.principalPolicies !== undefined\n        ? { stalePrincipalPolicies: value.principalPolicies }\n        : {}),\n    ...((code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n      code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysInaccessible) &&\n    \"requiredContainerIds\" in value &&\n    Array.isArray(value.requiredContainerIds) &&\n    value.requiredContainerIds.length <= MAX_ROTATION_CONTAINER_REKEYS &&\n    value.requiredContainerIds.every(\n      (containerId: unknown): containerId is string =>\n        typeof containerId === \"string\" && containerId.length > 0,\n    )\n      ? { requiredContainerIds: value.requiredContainerIds }\n      : {}),\n    // Sync-write 402s carry the target org for the billing prompt.\n    ...(schema === PaymentRequiredErrorResponseSchema &&\n    isPaymentRequiredErrorResponse(value)\n      ? { paymentRequiredOrganizationId: value.organizationId }\n      : {}),\n  };\n}\n\nexport function bindPrototypeMethods(\n  instance: object,\n  prototype: object,\n): void {\n  for (const propertyName of Object.getOwnPropertyNames(prototype)) {\n    if (propertyName === \"constructor\") {\n      continue;\n    }\n\n    const property = Reflect.get(prototype, propertyName);\n    if (typeof property === \"function\") {\n      Reflect.set(instance, propertyName, property.bind(instance));\n    }\n  }\n}\n\nexport function normalizeApiBaseUrl(\n  baseUrl: string | null | undefined,\n): string {\n  const trimmed = (baseUrl ?? \"\").trim();\n  if (trimmed === \"\" || trimmed === \"/\") {\n    return \"\";\n  }\n\n  // Scan from the end to avoid regex backtracking over internal slash runs.\n  let end = trimmed.length;\n  while (end > 0 && trimmed[end - 1] === \"/\") {\n    end -= 1;\n  }\n  return trimmed.slice(0, end);\n}\n\nexport function hasHeader(\n  headers: Record<string, string> | undefined,\n  name: string,\n): boolean {\n  const normalizedName = name.toLowerCase();\n  return Object.keys(headers ?? {}).some(\n    (headerName) => headerName.toLowerCase() === normalizedName,\n  );\n}\n\nexport function requestFailureKey(input: {\n  method: string;\n  path: string;\n}): string {\n  return `${input.method}\\u0000${input.path}`;\n}\n\nfunction syncWatermarkRequestKey(\n  watermark: SyncWatermark | null | undefined,\n): string {\n  return watermark ? `${watermark.updatedAt}\\u0000${watermark.id}` : \"\";\n}\n\nexport function listContainerParentLanesRequestKey(\n  input: ListContainerParentLanesRequest,\n): string {\n  return JSON.stringify(\n    input.lanes.map((lane) => ({\n      laneId: lane.laneId,\n      limit: lane.limit ?? null,\n      parentId: lane.parentId,\n      watermark: syncWatermarkRequestKey(lane.watermark),\n    })),\n  );\n}\n\nexport function listContainerDocumentsRequestKey(\n  containerId: string,\n  options: ListContainerDocumentsOptions = {},\n): string {\n  const { watermark, ...rest } = options;\n  return JSON.stringify({\n    containerId,\n    ...rest,\n    watermark: syncWatermarkRequestKey(watermark),\n  });\n}\n\n/**\n * Minimal cache surface shared by `Map` and `ApiCache.BoundedCache`, so the\n * request helpers work with either backing store.\n */\ninterface RequestCache<T> {\n  get(key: string): Promise<T | null> | undefined;\n  has(key: string): boolean;\n  set(key: string, value: Promise<T | null>): unknown;\n  delete(key: string): unknown;\n}\n\nexport function cachedRequest<T>(\n  cache: RequestCache<T>,\n  cacheKey: string,\n  request: () => Promise<T | null>,\n): Promise<T | null> {\n  const cached = cache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  let pending: Promise<T | null>;\n  pending = request()\n    .then((response) => {\n      if (!response && cache.get(cacheKey) === pending) {\n        cache.delete(cacheKey);\n      }\n      return response;\n    })\n    .catch((error: unknown) => {\n      if (cache.get(cacheKey) === pending) {\n        cache.delete(cacheKey);\n      }\n      throw error;\n    });\n  cache.set(cacheKey, pending);\n  return pending;\n}\n\nexport function dedupedRequest<T>(\n  cache: RequestCache<T>,\n  cacheKey: string,\n  request: () => Promise<T | null>,\n): Promise<T | null> {\n  const cached = cache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  let pending: Promise<T | null>;\n  pending = request().finally(() => {\n    if (cache.get(cacheKey) === pending) {\n      cache.delete(cacheKey);\n    }\n  });\n  cache.set(cacheKey, pending);\n  return pending;\n}\n\nexport function isReplayableRequestBody(\n  body: RequestBody | undefined,\n): boolean {\n  return !(\n    typeof ReadableStream === \"function\" && body instanceof ReadableStream\n  );\n}\n\nexport function isSuccessfulResponse(\n  response: Response,\n  additionalSuccessStatuses: readonly number[],\n): boolean {\n  return response.ok || additionalSuccessStatuses.includes(response.status);\n}\n\nfunction validatePaymentRequiredTarget(\n  schema: NonNullable<HttpOperation[\"failureResponses\"]>[number] | undefined,\n  parsed: unknown,\n  expectedOrganizationId: string | undefined,\n): { readonly invalid: boolean; readonly organizationId?: string } {\n  if (schema !== PaymentRequiredErrorResponseSchema) {\n    return { invalid: false };\n  }\n  if (\n    !isPaymentRequiredErrorResponse(parsed) ||\n    (expectedOrganizationId !== undefined &&\n      parsed.organizationId !== expectedOrganizationId)\n  ) {\n    return { invalid: true };\n  }\n  return { invalid: false, organizationId: parsed.organizationId };\n}\n\nfunction paymentRequiredDescription(\n  organizationId: string | undefined,\n): ErrorResponseDescription | null {\n  return organizationId === undefined\n    ? null\n    : {\n        ...emptyErrorResponseDescription,\n        paymentRequiredOrganizationId: organizationId,\n      };\n}\n\nexport async function describeErrorResponse(\n  response: Response,\n  operation?: HttpOperation,\n  expectedPaymentRequiredOrganizationId?: string,\n): Promise<ErrorResponseDescription> {\n  const schema = operation?.failureResponses?.[response.status];\n  if (operation && !schema) {\n    // A cloned response can wait for its other branch to finish cancelling.\n    // Cleanup must not delay reporting an already-invalid status.\n    void response.body?.cancel().catch(() => {});\n    return invalidErrorResponseDescription;\n  }\n  let responseText = \"\";\n\n  try {\n    responseText = (await response.text()).trim();\n  } catch {\n    return operation\n      ? invalidErrorResponseDescription\n      : emptyErrorResponseDescription;\n  }\n\n  if (responseText.length === 0) {\n    return operation\n      ? invalidErrorResponseDescription\n      : emptyErrorResponseDescription;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(responseText);\n  } catch {\n    return operation\n      ? invalidErrorResponseDescription\n      : { ...emptyErrorResponseDescription, detail: `: ${responseText}` };\n  }\n\n  if (schema) {\n    const result = schema.safeParse(parsed);\n    if (!result.success) {\n      return invalidErrorResponseDescription;\n    }\n    parsed = result.data;\n  }\n\n  const paymentTarget = validatePaymentRequiredTarget(\n    schema,\n    parsed,\n    expectedPaymentRequiredOrganizationId,\n  );\n  if (paymentTarget.invalid) {\n    return invalidErrorResponseDescription;\n  }\n\n  const description =\n    parsedErrorResponseDescription(parsed, schema) ??\n    paymentRequiredDescription(paymentTarget.organizationId);\n  if (description) {\n    return description;\n  }\n\n  return operation\n    ? emptyErrorResponseDescription\n    : { ...emptyErrorResponseDescription, detail: `: ${responseText}` };\n}\n\nexport function isRefreshableSessionError(\n  status: number,\n  code: string | null,\n): boolean {\n  return status === 401 && code === SESSION_ERROR_CODES.refreshRequired;\n}\n\nexport function errorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  // `instanceof Error` fails for errors thrown across realms (web workers,\n  // serialized payloads); fall back to a duck-typed string `message`.\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"message\" in error &&\n    typeof error.message === \"string\"\n  ) {\n    return error.message;\n  }\n  return String(error);\n}\n"]}
+{"version":3,"file":"requestInternals.js","sourceRoot":"","sources":["requestInternals.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,mCAAmC,EACnC,kCAAkC,EAClC,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAG3E;;;;;GAKG;AACH,SAAS,uCAAuC,CAC9C,UAA4C,EAC5C,QAA8B;IAE9B,OAAO,CACL,UAAU,CAAC,gBAAgB,EAAE,eAAe;QAC1C,QAAQ,CAAC,gBAAgB,EAAE,eAAe;QAC5C,UAAU,CAAC,gBAAgB,EAAE,mBAAmB;YAC9C,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB;QAChD,UAAU,CAAC,gBAAgB,EAAE,UAAU;YACrC,QAAQ,CAAC,gBAAgB,EAAE,UAAU;QACvC,UAAU,CAAC,kBAAkB,EAAE,mBAAmB;YAChD,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB;QAClD,UAAU,CAAC,kBAAkB,EAAE,qBAAqB;YAClD,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAqD,EACrD,UAAkB,EAClB,QAA8B,EAC9B,SAAsB;IAEtB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,SAAS,EAAE,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,uCAAuC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,SAAS,EAAE,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAaD,MAAM,6BAA6B,GAA6B;IAC9D,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF,MAAM,+BAA+B,GAA6B;IAChE,GAAG,6BAA6B;IAChC,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF,SAAS,oBAAoB,CAC3B,KAAa,EACb,MAA0E;IAE1E,IACE,CAAC,MAAM;QACP,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,IAAI,oBAAoB,CAAC;IAC3D,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO;QACnE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAc,EACd,MAA+D;IAE/D,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QACnB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE;QAC9C,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QACxC,yEAAyE;QACzE,wEAAwE;QACxE,GAAG,CAAC,MAAM,KAAK,sCAAsC;YACrD,mCAAmC,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,cAAc,EAAE;YAC/C,CAAC,CAAC,MAAM,KAAK,+BAA+B;gBACxC,qCAAqC,CAAC,KAAK,CAAC;gBAC5C,KAAK,CAAC,cAAc,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,cAAc,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;YACnE,IAAI,KAAK,8BAA8B,CAAC,4BAA4B,CAAC;YACvE,sBAAsB,IAAI,KAAK;YAC/B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACzC,KAAK,CAAC,oBAAoB,CAAC,MAAM,IAAI,6BAA6B;YAClE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAC9B,CAAC,WAAoB,EAAyB,EAAE,CAC9C,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D;YACC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,GAAG,CAAC,MAAM,KAAK,kCAAkC;YACjD,8BAA8B,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,CAAC,cAAc,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,SAAiB;IAEjB,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAkC;IAElC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3C,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,OAA2C,EAC3C,IAAY;IAEZ,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,cAAc,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,OAAO,GAAG,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAA2C;IAE3C,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAsC;IAEtC,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;KACnD,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW;QACX,GAAG,IAAI;QACP,SAAS,EAAE,uBAAuB,CAAC,SAAS,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,aAAa,CAC3B,KAAsB,EACtB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,OAAO,GAAG,OAAO,EAAE;SAChB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACL,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA6B;IAE7B,OAAO,CAAC,CACN,OAAO,cAAc,KAAK,UAAU,IAAI,IAAI,YAAY,cAAc,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,yBAA4C;IAE5C,OAAO,QAAQ,CAAC,EAAE,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,6BAA6B,CACpC,MAA0E,EAC1E,MAAe,EACf,sBAA0C;IAE1C,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IACE,CAAC,8BAA8B,CAAC,MAAM,CAAC;QACvC,CAAC,sBAAsB,KAAK,SAAS;YACnC,MAAM,CAAC,cAAc,KAAK,sBAAsB,CAAC,EACnD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,0BAA0B,CACjC,cAAkC;IAElC,OAAO,cAAc,KAAK,SAAS;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,6BAA6B;YAChC,6BAA6B,EAAE,cAAc;SAC9C,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAkB,EAClB,SAAyB,EACzB,qCAA8C;IAE9C,MAAM,MAAM,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,IAAI,CAAC;QACH,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,6BAA6B,CAAC;IACpC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,6BAA6B,CAAC;IACpC,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS;YACd,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,EAAE,GAAG,6BAA6B,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,+BAA+B,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAG,6BAA6B,CACjD,MAAM,EACN,MAAM,EACN,qCAAqC,CACtC,CAAC;IACF,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,+BAA+B,CAAC;IACzC,CAAC;IAED,MAAM,WAAW,GACf,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC;QAC9C,0BAA0B,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,SAAS;QACd,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,EAAE,GAAG,6BAA6B,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,IAAmB;IAEnB,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,mBAAmB,CAAC,eAAe,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,yEAAyE;IACzE,oEAAoE;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC","sourcesContent":["import type { HttpOperation } from \"@tearleads/validators/operation\";\nimport type { ListContainerParentLanesRequest } from \"@tearleads/validators/request\";\nimport type {\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n  SyncWatermark,\n} from \"@tearleads/validators/response\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  ContainerMutationFailureResponseSchema,\n  DocumentSyncErrorResponseSchema,\n  isDocumentSyncStateStaleErrorResponse,\n  isPaymentRequiredErrorResponse,\n  isPrincipalPolicyStaleErrorResponse,\n  PaymentRequiredErrorResponseSchema,\n  SESSION_ERROR_CODES,\n} from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type { ListContainerDocumentsOptions, RequestBody } from \"./types\";\n\n/**\n * True when a sync response advances the document's write material past what a\n * cached/primed writer projection holds, so the projection must be re-fetched\n * before the next write. Compares the content-key bundle and KEK target hashes\n * the projection authorizes against the ones the server just committed.\n */\nfunction documentSyncInvalidatesWriterProjection(\n  projection: DocumentWriterProjectionResponse,\n  response: DocumentSyncResponse,\n): boolean {\n  return (\n    projection.contentKeyBundle?.contentKeyEpoch !==\n      response.contentKeyBundle?.contentKeyEpoch ||\n    projection.contentKeyBundle?.linkSetManifestHash !==\n      response.contentKeyBundle?.linkSetManifestHash ||\n    projection.contentKeyBundle?.targetHash !==\n      response.contentKeyBundle?.targetHash ||\n    projection.documentKekTargets?.linkSetManifestHash !==\n      response.documentKekTargets?.linkSetManifestHash ||\n    projection.documentKekTargets?.documentKeyTargetHash !==\n      response.documentKekTargets?.documentKeyTargetHash\n  );\n}\n\n/**\n * Evict a cached/primed document writer projection iff the just-committed sync\n * response moved its write material. Re-checks the cache slot after awaiting so\n * a concurrent invalidation or refetch is not clobbered. `onEvicted` fires\n * whenever an invalidation is issued, so callers can invalidate parallel\n * bookkeeping (e.g. an in-flight result fetch that predates the sync).\n */\nexport async function evictWriterProjectionIfSyncChanged(\n  cache: RequestCache<DocumentWriterProjectionResponse>,\n  documentId: string,\n  response: DocumentSyncResponse,\n  onEvicted?: () => void,\n): Promise<void> {\n  const cached = cache.get(documentId);\n  if (!cached) {\n    // No cached projection to compare against, so whether the sync moved the\n    // write material is undecidable here — but a concurrent in-flight GET may\n    // still predate it. Invalidate conservatively: deleting the (absent) slot\n    // bumps the cache's eviction generation so such a fetch's success is not\n    // cached, and onEvicted drops a shared in-flight result entry. The cost\n    // when nothing is in flight is a skipped cache warm, never wrong data.\n    cache.delete(documentId);\n    onEvicted?.();\n    return;\n  }\n  const projection = await cached.catch(() => null);\n  if (cache.get(documentId) !== cached || !projection) {\n    return;\n  }\n  if (documentSyncInvalidatesWriterProjection(projection, response)) {\n    cache.delete(documentId);\n    onEvicted?.();\n  }\n}\n\nexport interface ErrorResponseDescription {\n  readonly code: string | null;\n  readonly detail: string;\n  readonly error: string | null;\n  readonly stalePrincipalHeads?: ReferencedPrincipalStateResponse[] | undefined;\n  /** Descendant rekeys a refused rotation must carry, parent-first. */\n  readonly requiredContainerIds?: readonly string[] | undefined;\n  /** Set on a 402 body — the organization whose billing blocked the sync write. */\n  readonly paymentRequiredOrganizationId?: string | undefined;\n}\n\nconst emptyErrorResponseDescription: ErrorResponseDescription = {\n  code: null,\n  detail: \"\",\n  error: null,\n};\n\nconst invalidErrorResponseDescription: ErrorResponseDescription = {\n  ...emptyErrorResponseDescription,\n  detail: \": Invalid failure response body\",\n};\n\nfunction validatedFailureCode(\n  value: object,\n  schema: NonNullable<HttpOperation[\"failureResponses\"]>[number] | undefined,\n): string | null {\n  if (\n    !schema ||\n    !(\"code\" in value) ||\n    typeof value.code !== \"string\" ||\n    value.code.length === 0\n  ) {\n    return null;\n  }\n\n  // Loose object schemas retain extension keys. A code is behavior-bearing\n  // only when changing that field to an unregistered value breaks the selected\n  // status schema, proving that the schema constrains rather than merely\n  // preserves it.\n  const unregisteredCode = `${value.code}\\u0000unregistered`;\n  return schema.safeParse({ ...value, code: unregisteredCode }).success\n    ? null\n    : value.code;\n}\n\nfunction parsedErrorResponseDescription(\n  value: unknown,\n  schema?: NonNullable<HttpOperation[\"failureResponses\"]>[number],\n): ErrorResponseDescription | null {\n  if (\n    !value ||\n    typeof value !== \"object\" ||\n    !(\"error\" in value) ||\n    typeof value.error !== \"string\"\n  ) {\n    return null;\n  }\n\n  const error = value.error.trim();\n  const code = validatedFailureCode(value, schema);\n  if (error.length === 0 && code === null) {\n    return null;\n  }\n  return {\n    code,\n    detail: error.length === 0 ? \"\" : `: ${error}`,\n    error: error.length === 0 ? null : error,\n    // Container mutations and document sync with inline container rekeys can\n    // carry advisory heads whose signed evidence can be recovered in pages.\n    ...(schema === ContainerMutationFailureResponseSchema &&\n    isPrincipalPolicyStaleErrorResponse(value)\n      ? { stalePrincipalHeads: value.principalHeads }\n      : schema === DocumentSyncErrorResponseSchema &&\n          isDocumentSyncStateStaleErrorResponse(value) &&\n          value.principalHeads !== undefined\n        ? { stalePrincipalHeads: value.principalHeads }\n        : {}),\n    ...((code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n      code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysInaccessible) &&\n    \"requiredContainerIds\" in value &&\n    Array.isArray(value.requiredContainerIds) &&\n    value.requiredContainerIds.length <= MAX_ROTATION_CONTAINER_REKEYS &&\n    value.requiredContainerIds.every(\n      (containerId: unknown): containerId is string =>\n        typeof containerId === \"string\" && containerId.length > 0,\n    )\n      ? { requiredContainerIds: value.requiredContainerIds }\n      : {}),\n    // Sync-write 402s carry the target org for the billing prompt.\n    ...(schema === PaymentRequiredErrorResponseSchema &&\n    isPaymentRequiredErrorResponse(value)\n      ? { paymentRequiredOrganizationId: value.organizationId }\n      : {}),\n  };\n}\n\nexport function bindPrototypeMethods(\n  instance: object,\n  prototype: object,\n): void {\n  for (const propertyName of Object.getOwnPropertyNames(prototype)) {\n    if (propertyName === \"constructor\") {\n      continue;\n    }\n\n    const property = Reflect.get(prototype, propertyName);\n    if (typeof property === \"function\") {\n      Reflect.set(instance, propertyName, property.bind(instance));\n    }\n  }\n}\n\nexport function normalizeApiBaseUrl(\n  baseUrl: string | null | undefined,\n): string {\n  const trimmed = (baseUrl ?? \"\").trim();\n  if (trimmed === \"\" || trimmed === \"/\") {\n    return \"\";\n  }\n\n  // Scan from the end to avoid regex backtracking over internal slash runs.\n  let end = trimmed.length;\n  while (end > 0 && trimmed[end - 1] === \"/\") {\n    end -= 1;\n  }\n  return trimmed.slice(0, end);\n}\n\nexport function hasHeader(\n  headers: Record<string, string> | undefined,\n  name: string,\n): boolean {\n  const normalizedName = name.toLowerCase();\n  return Object.keys(headers ?? {}).some(\n    (headerName) => headerName.toLowerCase() === normalizedName,\n  );\n}\n\nexport function requestFailureKey(input: {\n  method: string;\n  path: string;\n}): string {\n  return `${input.method}\\u0000${input.path}`;\n}\n\nfunction syncWatermarkRequestKey(\n  watermark: SyncWatermark | null | undefined,\n): string {\n  return watermark ? `${watermark.updatedAt}\\u0000${watermark.id}` : \"\";\n}\n\nexport function listContainerParentLanesRequestKey(\n  input: ListContainerParentLanesRequest,\n): string {\n  return JSON.stringify(\n    input.lanes.map((lane) => ({\n      laneId: lane.laneId,\n      limit: lane.limit ?? null,\n      parentId: lane.parentId,\n      watermark: syncWatermarkRequestKey(lane.watermark),\n    })),\n  );\n}\n\nexport function listContainerDocumentsRequestKey(\n  containerId: string,\n  options: ListContainerDocumentsOptions = {},\n): string {\n  const { watermark, ...rest } = options;\n  return JSON.stringify({\n    containerId,\n    ...rest,\n    watermark: syncWatermarkRequestKey(watermark),\n  });\n}\n\n/**\n * Minimal cache surface shared by `Map` and `ApiCache.BoundedCache`, so the\n * request helpers work with either backing store.\n */\ninterface RequestCache<T> {\n  get(key: string): Promise<T | null> | undefined;\n  has(key: string): boolean;\n  set(key: string, value: Promise<T | null>): unknown;\n  delete(key: string): unknown;\n}\n\nexport function cachedRequest<T>(\n  cache: RequestCache<T>,\n  cacheKey: string,\n  request: () => Promise<T | null>,\n): Promise<T | null> {\n  const cached = cache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  let pending: Promise<T | null>;\n  pending = request()\n    .then((response) => {\n      if (!response && cache.get(cacheKey) === pending) {\n        cache.delete(cacheKey);\n      }\n      return response;\n    })\n    .catch((error: unknown) => {\n      if (cache.get(cacheKey) === pending) {\n        cache.delete(cacheKey);\n      }\n      throw error;\n    });\n  cache.set(cacheKey, pending);\n  return pending;\n}\n\nexport function dedupedRequest<T>(\n  cache: RequestCache<T>,\n  cacheKey: string,\n  request: () => Promise<T | null>,\n): Promise<T | null> {\n  const cached = cache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  let pending: Promise<T | null>;\n  pending = request().finally(() => {\n    if (cache.get(cacheKey) === pending) {\n      cache.delete(cacheKey);\n    }\n  });\n  cache.set(cacheKey, pending);\n  return pending;\n}\n\nexport function isReplayableRequestBody(\n  body: RequestBody | undefined,\n): boolean {\n  return !(\n    typeof ReadableStream === \"function\" && body instanceof ReadableStream\n  );\n}\n\nexport function isSuccessfulResponse(\n  response: Response,\n  additionalSuccessStatuses: readonly number[],\n): boolean {\n  return response.ok || additionalSuccessStatuses.includes(response.status);\n}\n\nfunction validatePaymentRequiredTarget(\n  schema: NonNullable<HttpOperation[\"failureResponses\"]>[number] | undefined,\n  parsed: unknown,\n  expectedOrganizationId: string | undefined,\n): { readonly invalid: boolean; readonly organizationId?: string } {\n  if (schema !== PaymentRequiredErrorResponseSchema) {\n    return { invalid: false };\n  }\n  if (\n    !isPaymentRequiredErrorResponse(parsed) ||\n    (expectedOrganizationId !== undefined &&\n      parsed.organizationId !== expectedOrganizationId)\n  ) {\n    return { invalid: true };\n  }\n  return { invalid: false, organizationId: parsed.organizationId };\n}\n\nfunction paymentRequiredDescription(\n  organizationId: string | undefined,\n): ErrorResponseDescription | null {\n  return organizationId === undefined\n    ? null\n    : {\n        ...emptyErrorResponseDescription,\n        paymentRequiredOrganizationId: organizationId,\n      };\n}\n\nexport async function describeErrorResponse(\n  response: Response,\n  operation?: HttpOperation,\n  expectedPaymentRequiredOrganizationId?: string,\n): Promise<ErrorResponseDescription> {\n  const schema = operation?.failureResponses?.[response.status];\n  if (operation && !schema) {\n    // A cloned response can wait for its other branch to finish cancelling.\n    // Cleanup must not delay reporting an already-invalid status.\n    void response.body?.cancel().catch(() => {});\n    return invalidErrorResponseDescription;\n  }\n  let responseText = \"\";\n\n  try {\n    responseText = (await response.text()).trim();\n  } catch {\n    return operation\n      ? invalidErrorResponseDescription\n      : emptyErrorResponseDescription;\n  }\n\n  if (responseText.length === 0) {\n    return operation\n      ? invalidErrorResponseDescription\n      : emptyErrorResponseDescription;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(responseText);\n  } catch {\n    return operation\n      ? invalidErrorResponseDescription\n      : { ...emptyErrorResponseDescription, detail: `: ${responseText}` };\n  }\n\n  if (schema) {\n    const result = schema.safeParse(parsed);\n    if (!result.success) {\n      return invalidErrorResponseDescription;\n    }\n    parsed = result.data;\n  }\n\n  const paymentTarget = validatePaymentRequiredTarget(\n    schema,\n    parsed,\n    expectedPaymentRequiredOrganizationId,\n  );\n  if (paymentTarget.invalid) {\n    return invalidErrorResponseDescription;\n  }\n\n  const description =\n    parsedErrorResponseDescription(parsed, schema) ??\n    paymentRequiredDescription(paymentTarget.organizationId);\n  if (description) {\n    return description;\n  }\n\n  return operation\n    ? emptyErrorResponseDescription\n    : { ...emptyErrorResponseDescription, detail: `: ${responseText}` };\n}\n\nexport function isRefreshableSessionError(\n  status: number,\n  code: string | null,\n): boolean {\n  return status === 401 && code === SESSION_ERROR_CODES.refreshRequired;\n}\n\nexport function errorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  // `instanceof Error` fails for errors thrown across realms (web workers,\n  // serialized payloads); fall back to a duck-typed string `message`.\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"message\" in error &&\n    typeof error.message === \"string\"\n  ) {\n    return error.message;\n  }\n  return String(error);\n}\n"]}

package/internal/api-client/types.d.ts

@@ -1,5 +1,5 @@
 import type { DocumentAttributionRangesQuery, HttpOperation, HttpOperationMethod } from "../validators/operation/index.js";
-import type { PrincipalPolicyBundleResponse, SyncWatermark } from "../validators/response/index.js";
+import type { ReferencedPrincipalStateResponse, SyncWatermark } from "../validators/response/index.js";
 export type HttpMethod = HttpOperationMethod;
 export type RequestBody = BodyInit;
 export interface ListContainerDocumentsOptions {
@@ -32,7 +32,7 @@ export interface RequestFailure {
     readonly report: () => void;
     readonly status: number | null;
     readonly statusText: string;
-    readonly stalePrincipalPolicies?: PrincipalPolicyBundleResponse[] | undefined;
+    readonly stalePrincipalHeads?: ReferencedPrincipalStateResponse[] | undefined;
     /**
      * With `container_descendant_rekeys_required`, the full owed set, parent-first;
      * with `container_descendant_rekeys_inaccessible`, its unwritable subset.

package/internal/api-client/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  DocumentAttributionRangesQuery,\n  HttpOperation,\n  HttpOperationMethod,\n} from \"@tearleads/validators/operation\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  SyncWatermark,\n} from \"@tearleads/validators/response\";\n\nexport type HttpMethod = HttpOperationMethod;\nexport type RequestBody = BodyInit;\n\nexport interface ListContainerDocumentsOptions {\n  limit?: number;\n  watermark?: SyncWatermark | null;\n}\n\nexport type ListDocumentEditAttributionRangesOptions = Omit<\n  DocumentAttributionRangesQuery,\n  \"cursor\"\n> & {\n  cursor?: DocumentAttributionRangesQuery[\"cursor\"] | null;\n};\n\nexport interface RequestResultOptions {\n  readonly signal?: AbortSignal | undefined;\n  /** Expected target for a declared 402; mismatched response identities fail closed. */\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly headers?: Record<string, string> | undefined;\n  readonly reportErrors?: boolean | undefined;\n  /** Called after this request or a concurrent request renews the same session. */\n  readonly onSessionRenewed?: (() => void) | undefined;\n  readonly retryOnSessionExpired?: boolean | \"renew-only\" | undefined;\n}\n\nexport type OperationRequestFn = <T>(\n  path: string,\n  validator: (value: unknown) => value is T,\n  method: HttpMethod,\n  body: RequestBody | undefined,\n  options: RequestResultOptions | undefined,\n  failureOperation: HttpOperation,\n) => Promise<T | null>;\n\nexport type OperationRequestResultFn = <T>(\n  path: string,\n  validator: (value: unknown) => value is T,\n  method: HttpMethod,\n  body: RequestBody | undefined,\n  options: RequestResultOptions | undefined,\n  failureOperation: HttpOperation,\n) => Promise<RequestResult<T>>;\n\nexport type RequestFailureKind =\n  | \"http\"\n  | \"network\"\n  | \"json\"\n  | \"shape\"\n  | \"cancelled\"\n  | \"outcome-unknown\";\n\nexport interface RequestFailure {\n  readonly code?: string | undefined;\n  readonly kind: RequestFailureKind;\n  readonly message: string;\n  readonly method: HttpMethod;\n  readonly ok: false;\n  readonly path: string;\n  readonly report: () => void;\n  readonly status: number | null;\n  readonly statusText: string;\n  readonly stalePrincipalPolicies?: PrincipalPolicyBundleResponse[] | undefined;\n  /**\n   * With `container_descendant_rekeys_required`, the full owed set, parent-first;\n   * with `container_descendant_rekeys_inaccessible`, its unwritable subset.\n   * A hint, never authority; verify each container before signing for it.\n   */\n  readonly requiredContainerIds?: readonly string[] | undefined;\n}\n\nexport interface RequestSuccess<T> {\n  readonly data: T;\n  readonly ok: true;\n}\n\nexport type RequestResult<T> = RequestFailure | RequestSuccess<T>;\n\nexport interface ResponseRequestValidationFailureInput {\n  readonly code?: string | undefined;\n  readonly kind: RequestFailureKind;\n  readonly message: string;\n  readonly method: HttpMethod;\n  readonly options?: RequestResultOptions | undefined;\n  readonly path: string;\n  readonly status: number | null;\n  readonly statusText: string;\n}\n\nexport interface OperationResponseRequestFn {\n  (\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions | undefined,\n    additionalSuccessStatuses: readonly number[],\n    failureOperation: HttpOperation,\n  ): Promise<RequestResult<Response>>;\n  readonly reportFailure: (\n    input: ResponseRequestValidationFailureInput,\n  ) => RequestFailure;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  DocumentAttributionRangesQuery,\n  HttpOperation,\n  HttpOperationMethod,\n} from \"@tearleads/validators/operation\";\nimport type {\n  ReferencedPrincipalStateResponse,\n  SyncWatermark,\n} from \"@tearleads/validators/response\";\n\nexport type HttpMethod = HttpOperationMethod;\nexport type RequestBody = BodyInit;\n\nexport interface ListContainerDocumentsOptions {\n  limit?: number;\n  watermark?: SyncWatermark | null;\n}\n\nexport type ListDocumentEditAttributionRangesOptions = Omit<\n  DocumentAttributionRangesQuery,\n  \"cursor\"\n> & {\n  cursor?: DocumentAttributionRangesQuery[\"cursor\"] | null;\n};\n\nexport interface RequestResultOptions {\n  readonly signal?: AbortSignal | undefined;\n  /** Expected target for a declared 402; mismatched response identities fail closed. */\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly headers?: Record<string, string> | undefined;\n  readonly reportErrors?: boolean | undefined;\n  /** Called after this request or a concurrent request renews the same session. */\n  readonly onSessionRenewed?: (() => void) | undefined;\n  readonly retryOnSessionExpired?: boolean | \"renew-only\" | undefined;\n}\n\nexport type OperationRequestFn = <T>(\n  path: string,\n  validator: (value: unknown) => value is T,\n  method: HttpMethod,\n  body: RequestBody | undefined,\n  options: RequestResultOptions | undefined,\n  failureOperation: HttpOperation,\n) => Promise<T | null>;\n\nexport type OperationRequestResultFn = <T>(\n  path: string,\n  validator: (value: unknown) => value is T,\n  method: HttpMethod,\n  body: RequestBody | undefined,\n  options: RequestResultOptions | undefined,\n  failureOperation: HttpOperation,\n) => Promise<RequestResult<T>>;\n\nexport type RequestFailureKind =\n  | \"http\"\n  | \"network\"\n  | \"json\"\n  | \"shape\"\n  | \"cancelled\"\n  | \"outcome-unknown\";\n\nexport interface RequestFailure {\n  readonly code?: string | undefined;\n  readonly kind: RequestFailureKind;\n  readonly message: string;\n  readonly method: HttpMethod;\n  readonly ok: false;\n  readonly path: string;\n  readonly report: () => void;\n  readonly status: number | null;\n  readonly statusText: string;\n  readonly stalePrincipalHeads?: ReferencedPrincipalStateResponse[] | undefined;\n  /**\n   * With `container_descendant_rekeys_required`, the full owed set, parent-first;\n   * with `container_descendant_rekeys_inaccessible`, its unwritable subset.\n   * A hint, never authority; verify each container before signing for it.\n   */\n  readonly requiredContainerIds?: readonly string[] | undefined;\n}\n\nexport interface RequestSuccess<T> {\n  readonly data: T;\n  readonly ok: true;\n}\n\nexport type RequestResult<T> = RequestFailure | RequestSuccess<T>;\n\nexport interface ResponseRequestValidationFailureInput {\n  readonly code?: string | undefined;\n  readonly kind: RequestFailureKind;\n  readonly message: string;\n  readonly method: HttpMethod;\n  readonly options?: RequestResultOptions | undefined;\n  readonly path: string;\n  readonly status: number | null;\n  readonly statusText: string;\n}\n\nexport interface OperationResponseRequestFn {\n  (\n    path: string,\n    method: HttpMethod,\n    body: RequestBody | undefined,\n    options: RequestResultOptions | undefined,\n    additionalSuccessStatuses: readonly number[],\n    failureOperation: HttpOperation,\n  ): Promise<RequestResult<Response>>;\n  readonly reportFailure: (\n    input: ResponseRequestValidationFailureInput,\n  ) => RequestFailure;\n}\n"]}

package/internal/crypto/keying/accessEvent.js

@@ -149,6 +149,7 @@ export async function verifySignedAccessEvent({ body, event, signerPublicKey, })
     });
 }
 export function normalizeReferencedPrincipalHead(value) {
+    const label = "referenced principal head";
     const record = assertExactKeys(value, [
         "keyEpoch",
         "keyFingerprint",
@@ -156,17 +157,18 @@ export function normalizeReferencedPrincipalHead(value) {
         "principalType",
         "stateHash",
         "version",
-    ], "referenced principal head");
-    const version = readPositiveInteger(record, "version", "referenced principal head");
-    if (!Number.isSafeInteger(version))
-        throwVerification("invalid_shape", "referenced principal head version must be a safe integer");
+    ], label);
+    const version = readPositiveInteger(record, "version", label);
+    const keyEpoch = readPositiveInteger(record, "keyEpoch", label);
+    if (![version, keyEpoch].every(Number.isSafeInteger))
+        throwVerification("invalid_shape", "referenced principal head counters must be safe integers");
     return {
-        principalType: normalizeManagedPrincipalKind(record.principalType, "referenced principal head"),
-        principalId: readString(record, "principalId", "referenced principal head"),
+        principalType: normalizeManagedPrincipalKind(record.principalType, label),
+        principalId: readString(record, "principalId", label),
         version,
-        keyEpoch: readPositiveInteger(record, "keyEpoch", "referenced principal head"),
-        stateHash: readHashString(record, "stateHash", "referenced principal head"),
-        keyFingerprint: readHashString(record, "keyFingerprint", "referenced principal head"),
+        keyEpoch,
+        stateHash: readHashString(record, "stateHash", label),
+        keyFingerprint: readHashString(record, "keyFingerprint", label),
     };
 }
 export function referencedPrincipalKey(principal) {

package/internal/crypto/keying/accessEvent.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessEvent.js","sourceRoot":"","sources":["accessEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,sBAAsB,IAAI,MAAM,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,EAC5B,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,WAAW,EACX,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAclB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE9E,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,0BAA0B;QAC1B,SAAS;QACT,WAAW;QACX,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,UAAU;QACV,gBAAgB;QAChB,sBAAsB;QACtB,cAAc;QACd,SAAS;KACV,EACD,cAAc,CACf,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,yBAAyB,CAC1C,MAAM,CAAC,UAAU,EACjB,cAAc,CACf,CAAC;IACF,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,iBAAiB,CACf,iBAAiB,EACjB,gBAAgB,SAAS,wBAAwB,kBAAkB,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC;QAC5C,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC;QACtD,SAAS;QACT,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QACxD,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,cAAc,CAAC;QACpE,oBAAoB,EAAE,sBAAsB,CAC1C,MAAM,EACN,sBAAsB,EACtB,cAAc,CACf;QACD,wBAAwB,EAAE,4BAA4B,CACpD,eAAe,CAAC,MAAM,EAAE,0BAA0B,EAAE,cAAc,CAAC,EACnE,uCAAuC,CACxC;QACD,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5D,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,CAAC;QAChE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,cAAc,CAAC;QACpE,oBAAoB,EAAE,cAAc,CAClC,MAAM,EACN,sBAAsB,EACtB,cAAc,CACf;QACD,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,0BAA0B;QAC1B,SAAS;QACT,WAAW;QACX,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,sBAAsB;QACtB,cAAc;QACd,SAAS;KACV,EACD,cAAc,CACf,CAAC;IACF,MAAM,aAAa,GAAG,4BAA4B,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,aAAa;QAChB,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA0B;IAE1B,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA0B;IACzD,OAAO,mBAAmB,CACxB,uCAAuC,EACvC,0BAA0B,CAAC,KAAK,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAkB;IAC/C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB;IAEzB,OAAO,uBAAuB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA0B,EAC1B,iBAA6B;IAE7B,MAAM,eAAe,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CACpB,uBAAuB,CAAC,eAAe,CAAC,EACxC,iBAAiB,CAClB,CAAC;IAEF,OAAO;QACL,GAAG,eAAe;QAClB,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB;IAElB,MAAM,OAAO,GACX,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9B,OAAO,uBAAuB,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,IAAI,EACJ,KAAK,EACL,eAAe,GACQ;IAGvB,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAAI,EACJ,mBAAmB,CACpB,CAAC;QACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,cAAc,CAAC,CAAC;QAE1E,IAAI,gBAAgB,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAClD,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,oBAAoB,KAAK,eAAe,CAAC,oBAAoB,EAAE,CAAC;YAClE,iBAAiB,CACf,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QAED,IACE,CAAC,MAAM,CACL,SAAS,EACT,uBAAuB,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,EAC/D,eAAe,CAChB,EACD,CAAC;YACD,iBAAiB,CACf,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,uBAAuB,CAAC;YAC7B,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,MAAM,sBAAsB,CAAC,eAAe,CAAC;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,WAAW;QACX,SAAS;KACV,EACD,2BAA2B,CAC5B,CAAC;IAEF,MAAM,OAAO,GAAG,mBAAmB,CACjC,MAAM,EACN,SAAS,EACT,2BAA2B,CAC5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAChC,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;IACJ,OAAO;QACL,aAAa,EAAE,6BAA6B,CAC1C,MAAM,CAAC,aAAa,EACpB,2BAA2B,CAC5B;QACD,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,2BAA2B,CAAC;QAC3E,OAAO;QACP,QAAQ,EAAE,mBAAmB,CAC3B,MAAM,EACN,UAAU,EACV,2BAA2B,CAC5B;QACD,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,2BAA2B,CAAC;QAC3E,cAAc,EAAE,cAAc,CAC5B,MAAM,EACN,gBAAgB,EAChB,2BAA2B,CAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA0B;IAE1B,MAAM,gBAAgB,GAAG,MAAM;SAC5B,GAAG,CAAC,gCAAgC,CAAC;SACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CACrB,sBAAsB,CAAC,IAAI,CAAC,EAC5B,sBAAsB,CAAC,KAAK,CAAC,CAC9B,CACF,CAAC;IAEJ,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,aAAa,IAAI,gBAAgB,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,iBAAiB,CACf,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,YAAY,CAAC;IAC7B,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,OAAO;QACP,WAAW;QACX,WAAW;QACX,eAAe;QACf,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,0BAA0B;QAC1B,gBAAgB;QAChB,SAAS;KACV,EACD,iBAAiB,CAClB,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;IAEjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC7C,iBAAiB,CACf,eAAe,EACf,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAC/C,UAAU,EAAE,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC3E,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC;QAC3D,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QACvE,KAAK,EAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAC9D,oBAAoB,EAAE,sBAAsB,CAC1C,MAAM,EACN,sBAAsB,EACtB,iBAAiB,CAClB;QACD,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACjE,cAAc,EAAE,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QAC3E,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACjE,wBAAwB,EAAE,iCAAiC,CACzD,wBAAwB,CACzB;QACD,aAAa,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAwB;IAExB,MAAM,OAAO,GACX,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,uBAAuB,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,sBAAsB,EACtB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,4BAA4B,EAC5B,eAAe,EACf,QAAQ,GACkB;IAG1B,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QAEzE,IAAI,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC1C,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;YACrD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU;YACxD,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ;YACpD,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc,EAChE,CAAC;YACD,iBAAiB,CACf,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;YAChC,kBAAkB,CAAC,oBAAoB,EACvC,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,IACE,4BAA4B,KAAK,SAAS;YAC1C,4BAA4B,KAAK,kBAAkB,CAAC,oBAAoB,EACxE,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IACE,cAAc;YACd,CAAC,cAAc,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU;gBAC1D,cAAc,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ,CAAC,EAC1D,CAAC;YACD,iBAAiB,CACf,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,oCAAoC,CAAC;YACtD,QAAQ,EAAE,kBAAkB;YAC5B,YAAY;SACb,CAAC,CAAC;QACH,mCAAmC,CAAC;YAClC,OAAO,EAAE;gBACP,GAAG,UAAU;gBACb,oBAAoB,EAAE,kBAAkB,CAAC,oBAAoB;aAC9D;YACD,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;QAEH,OAAO,0BAA0B,CAAC;YAChC,QAAQ,EAAE,kBAAkB;YAC5B,YAAY;YACZ,KAAK;YACL,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { toFingerprint } from \"../fingerprint\";\nimport { sign } from \"../signing/sign\";\nimport { verifyHistorySignature as verify } from \"../signing/verifiedHistorySignature\";\nimport {\n  computeKeyingDomainHash,\n  encodeDomainPayload,\n  normalizeCanonicalJsonValue,\n} from \"./canonical\";\nimport {\n  accessManifestCheckpointFromManifest,\n  verifyAccessManifestLocalCheckpoint,\n} from \"./checkpoints\";\nimport {\n  assertExactKeys,\n  compareCanonicalStrings,\n  expectedObjectKindForEventType,\n  normalizeAccessEventType,\n  normalizeAccessObjectKind,\n  normalizeManagedPrincipalKind,\n  normalizeUniqueSortedStrings,\n  readHashString,\n  readNullableHashString,\n  readPositiveInteger,\n  readSignedAt,\n  readString,\n  readStringArray,\n  readVersion,\n  runVerifier,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  KeyingCanonicalJson,\n  KeyingCanonicalPayload,\n  KeyingVerificationResult,\n  ReferencedPrincipalHead,\n  UnsignedAccessEvent,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n} from \"./types\";\nimport { makeVerifiedAccessEvent, makeVerifiedAccessManifest } from \"./types\";\n\nfunction normalizeUnsignedAccessEvent(value: unknown): UnsignedAccessEvent {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bodyHash\",\n      \"dependencyManifestHashes\",\n      \"eventId\",\n      \"eventType\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"signedAt\",\n      \"signerDeviceId\",\n      \"signerKeyFingerprint\",\n      \"signerUserId\",\n      \"version\",\n    ],\n    \"access event\",\n  );\n  const eventType = normalizeAccessEventType(record.eventType, \"access event\");\n  const objectKind = normalizeAccessObjectKind(\n    record.objectKind,\n    \"access event\",\n  );\n  const expectedObjectKind = expectedObjectKindForEventType(eventType);\n\n  if (objectKind !== expectedObjectKind) {\n    throwVerification(\n      \"object_mismatch\",\n      `access event ${eventType} must use objectKind ${expectedObjectKind}`,\n    );\n  }\n\n  return {\n    version: readVersion(record, \"access event\"),\n    eventId: readString(record, \"eventId\", \"access event\"),\n    eventType,\n    objectKind,\n    objectId: readString(record, \"objectId\", \"access event\"),\n    organizationId: readString(record, \"organizationId\", \"access event\"),\n    previousManifestHash: readNullableHashString(\n      record,\n      \"previousManifestHash\",\n      \"access event\",\n    ),\n    dependencyManifestHashes: normalizeUniqueSortedStrings(\n      readStringArray(record, \"dependencyManifestHashes\", \"access event\"),\n      \"access event dependencyManifestHashes\",\n    ),\n    bodyHash: readHashString(record, \"bodyHash\", \"access event\"),\n    signerUserId: readString(record, \"signerUserId\", \"access event\"),\n    signerDeviceId: readString(record, \"signerDeviceId\", \"access event\"),\n    signerKeyFingerprint: readHashString(\n      record,\n      \"signerKeyFingerprint\",\n      \"access event\",\n    ),\n    signedAt: readSignedAt(record, \"signedAt\", \"access event\"),\n  };\n}\n\nfunction normalizeAccessEvent(value: unknown): AccessEvent {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bodyHash\",\n      \"dependencyManifestHashes\",\n      \"eventId\",\n      \"eventType\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"signature\",\n      \"signedAt\",\n      \"signerDeviceId\",\n      \"signerKeyFingerprint\",\n      \"signerUserId\",\n      \"version\",\n    ],\n    \"access event\",\n  );\n  const unsignedEvent = normalizeUnsignedAccessEvent({\n    version: record.version,\n    eventId: record.eventId,\n    eventType: record.eventType,\n    objectKind: record.objectKind,\n    objectId: record.objectId,\n    organizationId: record.organizationId,\n    previousManifestHash: record.previousManifestHash,\n    dependencyManifestHashes: record.dependencyManifestHashes,\n    bodyHash: record.bodyHash,\n    signerUserId: record.signerUserId,\n    signerDeviceId: record.signerDeviceId,\n    signerKeyFingerprint: record.signerKeyFingerprint,\n    signedAt: record.signedAt,\n  });\n\n  return {\n    ...unsignedEvent,\n    signature: readString(record, \"signature\", \"access event\"),\n  };\n}\n\nfunction unsignedAccessEventPayload(\n  event: UnsignedAccessEvent,\n): KeyingCanonicalPayload<UnsignedAccessEvent> {\n  return normalizeUnsignedAccessEvent(event);\n}\n\nfunction accessEventSigningBytes(event: UnsignedAccessEvent): Uint8Array {\n  return encodeDomainPayload(\n    \"tearleads.keying.access-event-signing\",\n    unsignedAccessEventPayload(event),\n  );\n}\n\nfunction toUnsignedAccessEvent(event: AccessEvent): UnsignedAccessEvent {\n  return {\n    version: event.version,\n    eventId: event.eventId,\n    eventType: event.eventType,\n    objectKind: event.objectKind,\n    objectId: event.objectId,\n    organizationId: event.organizationId,\n    previousManifestHash: event.previousManifestHash,\n    dependencyManifestHashes: event.dependencyManifestHashes,\n    bodyHash: event.bodyHash,\n    signerUserId: event.signerUserId,\n    signerDeviceId: event.signerDeviceId,\n    signerKeyFingerprint: event.signerKeyFingerprint,\n    signedAt: event.signedAt,\n  };\n}\n\nexport async function computeAccessEventBodyHash(\n  body: KeyingCanonicalJson,\n): Promise<string> {\n  return computeKeyingDomainHash(\"tearleads.keying.access-event-body\", body);\n}\n\nexport async function signAccessEvent(\n  event: UnsignedAccessEvent,\n  signingPrivateKey: Uint8Array,\n): Promise<AccessEvent> {\n  const normalizedEvent = normalizeUnsignedAccessEvent(event);\n  const signature = sign(\n    accessEventSigningBytes(normalizedEvent),\n    signingPrivateKey,\n  );\n\n  return {\n    ...normalizedEvent,\n    signature: bytesToBase64(signature),\n  };\n}\n\nexport async function computeAccessEventHash(\n  event: AccessEvent,\n): Promise<string> {\n  const payload: KeyingCanonicalPayload<AccessEvent> =\n    normalizeAccessEvent(event);\n\n  return computeKeyingDomainHash(\"tearleads.keying.access-event\", payload);\n}\n\nexport async function verifySignedAccessEvent({\n  body,\n  event,\n  signerPublicKey,\n}: VerifyAccessEventInput): Promise<\n  KeyingVerificationResult<VerifiedAccessEvent>\n> {\n  return runVerifier(async () => {\n    const normalizedBody = normalizeCanonicalJsonValue(\n      body,\n      \"access event body\",\n    );\n    const normalizedEvent = normalizeAccessEvent(event);\n    const computedBodyHash = await computeAccessEventBodyHash(normalizedBody);\n\n    if (computedBodyHash !== normalizedEvent.bodyHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access event body hash does not match body\",\n      );\n    }\n\n    const signerKeyFingerprint = await toFingerprint(signerPublicKey);\n    if (signerKeyFingerprint !== normalizedEvent.signerKeyFingerprint) {\n      throwVerification(\n        \"signer_mismatch\",\n        \"access event signer fingerprint does not match signer public key\",\n      );\n    }\n\n    let signature: Uint8Array;\n    try {\n      signature = base64ToBytes(normalizedEvent.signature);\n    } catch {\n      throwVerification(\"signature_mismatch\", \"access event signature invalid\");\n    }\n\n    if (\n      !verify(\n        signature,\n        accessEventSigningBytes(toUnsignedAccessEvent(normalizedEvent)),\n        signerPublicKey,\n      )\n    ) {\n      throwVerification(\n        \"signature_mismatch\",\n        \"access event signature verification failed\",\n      );\n    }\n\n    return makeVerifiedAccessEvent({\n      event: normalizedEvent,\n      body: normalizedBody,\n      eventHash: await computeAccessEventHash(normalizedEvent),\n    });\n  });\n}\n\nexport function normalizeReferencedPrincipalHead(\n  value: unknown,\n): ReferencedPrincipalHead {\n  const record = assertExactKeys(\n    value,\n    [\n      \"keyEpoch\",\n      \"keyFingerprint\",\n      \"principalId\",\n      \"principalType\",\n      \"stateHash\",\n      \"version\",\n    ],\n    \"referenced principal head\",\n  );\n\n  const version = readPositiveInteger(\n    record,\n    \"version\",\n    \"referenced principal head\",\n  );\n  if (!Number.isSafeInteger(version))\n    throwVerification(\n      \"invalid_shape\",\n      \"referenced principal head version must be a safe integer\",\n    );\n  return {\n    principalType: normalizeManagedPrincipalKind(\n      record.principalType,\n      \"referenced principal head\",\n    ),\n    principalId: readString(record, \"principalId\", \"referenced principal head\"),\n    version,\n    keyEpoch: readPositiveInteger(\n      record,\n      \"keyEpoch\",\n      \"referenced principal head\",\n    ),\n    stateHash: readHashString(record, \"stateHash\", \"referenced principal head\"),\n    keyFingerprint: readHashString(\n      record,\n      \"keyFingerprint\",\n      \"referenced principal head\",\n    ),\n  };\n}\n\nexport function referencedPrincipalKey(\n  principal: ReferencedPrincipalHead,\n): string {\n  return `${principal.principalType}:${principal.principalId}`;\n}\n\nexport function normalizeReferencedPrincipalHeads(\n  values: readonly unknown[],\n): ReferencedPrincipalHead[] {\n  const normalizedValues = values\n    .map(normalizeReferencedPrincipalHead)\n    .sort((left, right) =>\n      compareCanonicalStrings(\n        referencedPrincipalKey(left),\n        referencedPrincipalKey(right),\n      ),\n    );\n\n  let previousKey: string | null = null;\n  for (const principalHead of normalizedValues) {\n    const principalKey = referencedPrincipalKey(principalHead);\n    if (previousKey === principalKey) {\n      throwVerification(\n        \"duplicate_entry\",\n        \"access manifest referencedPrincipalHeads contains a duplicate\",\n      );\n    }\n    previousKey = principalKey;\n  }\n\n  return normalizedValues;\n}\n\nexport function normalizeAccessManifest(value: unknown): AccessManifest {\n  const record = assertExactKeys(\n    value,\n    [\n      \"epoch\",\n      \"eventHash\",\n      \"grantRoot\",\n      \"keyTargetHash\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"referencedPrincipalHeads\",\n      \"structuralHash\",\n      \"version\",\n    ],\n    \"access manifest\",\n  );\n  const referencedPrincipalHeads = record.referencedPrincipalHeads;\n\n  if (!Array.isArray(referencedPrincipalHeads)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"access manifest.referencedPrincipalHeads must be an array\",\n    );\n  }\n\n  return {\n    version: readVersion(record, \"access manifest\"),\n    objectKind: normalizeAccessObjectKind(record.objectKind, \"access manifest\"),\n    objectId: readString(record, \"objectId\", \"access manifest\"),\n    organizationId: readString(record, \"organizationId\", \"access manifest\"),\n    epoch: readPositiveInteger(record, \"epoch\", \"access manifest\"),\n    previousManifestHash: readNullableHashString(\n      record,\n      \"previousManifestHash\",\n      \"access manifest\",\n    ),\n    eventHash: readHashString(record, \"eventHash\", \"access manifest\"),\n    structuralHash: readHashString(record, \"structuralHash\", \"access manifest\"),\n    grantRoot: readHashString(record, \"grantRoot\", \"access manifest\"),\n    referencedPrincipalHeads: normalizeReferencedPrincipalHeads(\n      referencedPrincipalHeads,\n    ),\n    keyTargetHash: readHashString(record, \"keyTargetHash\", \"access manifest\"),\n  };\n}\n\nexport async function computeAccessManifestHash(\n  manifest: AccessManifest,\n): Promise<string> {\n  const payload: KeyingCanonicalPayload<AccessManifest> =\n    normalizeAccessManifest(manifest);\n\n  return computeKeyingDomainHash(\"tearleads.keying.access-manifest\", payload);\n}\n\nexport async function verifyAccessManifest({\n  checkpointPredecessors,\n  event,\n  expectedManifestHash,\n  expectedObject,\n  expectedPreviousManifestHash,\n  localCheckpoint,\n  manifest,\n}: VerifyAccessManifestInput): Promise<\n  KeyingVerificationResult<VerifiedAccessManifest>\n> {\n  return runVerifier(async () => {\n    const normalizedManifest = normalizeAccessManifest(manifest);\n    const manifestHash = await computeAccessManifestHash(normalizedManifest);\n\n    if (manifestHash !== expectedManifestHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access manifest hash does not match expected hash\",\n      );\n    }\n\n    if (event.eventHash !== normalizedManifest.eventHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access manifest event hash does not match verified event\",\n      );\n    }\n\n    if (\n      event.event.objectKind !== normalizedManifest.objectKind ||\n      event.event.objectId !== normalizedManifest.objectId ||\n      event.event.organizationId !== normalizedManifest.organizationId\n    ) {\n      throwVerification(\n        \"object_mismatch\",\n        \"access manifest object does not match verified event\",\n      );\n    }\n\n    if (\n      event.event.previousManifestHash !==\n      normalizedManifest.previousManifestHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"access manifest predecessor does not match verified event\",\n      );\n    }\n\n    if (\n      expectedPreviousManifestHash !== undefined &&\n      expectedPreviousManifestHash !== normalizedManifest.previousManifestHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"access manifest predecessor does not match expected predecessor\",\n      );\n    }\n\n    if (\n      expectedObject &&\n      (expectedObject.objectKind !== normalizedManifest.objectKind ||\n        expectedObject.objectId !== normalizedManifest.objectId)\n    ) {\n      throwVerification(\n        \"object_mismatch\",\n        \"access manifest object does not match expected object\",\n      );\n    }\n\n    const checkpoint = accessManifestCheckpointFromManifest({\n      manifest: normalizedManifest,\n      manifestHash,\n    });\n    verifyAccessManifestLocalCheckpoint({\n      current: {\n        ...checkpoint,\n        previousManifestHash: normalizedManifest.previousManifestHash,\n      },\n      localCheckpoint,\n      checkpointPredecessors,\n    });\n\n    return makeVerifiedAccessManifest({\n      manifest: normalizedManifest,\n      manifestHash,\n      event,\n      checkpoint,\n    });\n  });\n}\n"]}
+{"version":3,"file":"accessEvent.js","sourceRoot":"","sources":["accessEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,sBAAsB,IAAI,MAAM,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,EAC5B,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,WAAW,EACX,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAclB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE9E,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,0BAA0B;QAC1B,SAAS;QACT,WAAW;QACX,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,UAAU;QACV,gBAAgB;QAChB,sBAAsB;QACtB,cAAc;QACd,SAAS;KACV,EACD,cAAc,CACf,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,yBAAyB,CAC1C,MAAM,CAAC,UAAU,EACjB,cAAc,CACf,CAAC;IACF,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,iBAAiB,CACf,iBAAiB,EACjB,gBAAgB,SAAS,wBAAwB,kBAAkB,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC;QAC5C,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC;QACtD,SAAS;QACT,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QACxD,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,cAAc,CAAC;QACpE,oBAAoB,EAAE,sBAAsB,CAC1C,MAAM,EACN,sBAAsB,EACtB,cAAc,CACf;QACD,wBAAwB,EAAE,4BAA4B,CACpD,eAAe,CAAC,MAAM,EAAE,0BAA0B,EAAE,cAAc,CAAC,EACnE,uCAAuC,CACxC;QACD,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5D,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,CAAC;QAChE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,cAAc,CAAC;QACpE,oBAAoB,EAAE,cAAc,CAClC,MAAM,EACN,sBAAsB,EACtB,cAAc,CACf;QACD,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,0BAA0B;QAC1B,SAAS;QACT,WAAW;QACX,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,sBAAsB;QACtB,cAAc;QACd,SAAS;KACV,EACD,cAAc,CACf,CAAC;IACF,MAAM,aAAa,GAAG,4BAA4B,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,aAAa;QAChB,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA0B;IAE1B,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA0B;IACzD,OAAO,mBAAmB,CACxB,uCAAuC,EACvC,0BAA0B,CAAC,KAAK,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAkB;IAC/C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB;IAEzB,OAAO,uBAAuB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA0B,EAC1B,iBAA6B;IAE7B,MAAM,eAAe,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CACpB,uBAAuB,CAAC,eAAe,CAAC,EACxC,iBAAiB,CAClB,CAAC;IAEF,OAAO;QACL,GAAG,eAAe;QAClB,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB;IAElB,MAAM,OAAO,GACX,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9B,OAAO,uBAAuB,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,IAAI,EACJ,KAAK,EACL,eAAe,GACQ;IAGvB,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAAI,EACJ,mBAAmB,CACpB,CAAC;QACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,cAAc,CAAC,CAAC;QAE1E,IAAI,gBAAgB,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAClD,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,oBAAoB,KAAK,eAAe,CAAC,oBAAoB,EAAE,CAAC;YAClE,iBAAiB,CACf,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QAED,IACE,CAAC,MAAM,CACL,SAAS,EACT,uBAAuB,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,EAC/D,eAAe,CAChB,EACD,CAAC;YACD,iBAAiB,CACf,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,uBAAuB,CAAC;YAC7B,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,MAAM,sBAAsB,CAAC,eAAe,CAAC;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,MAAM,KAAK,GAAG,2BAA2B,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,UAAU;QACV,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,WAAW;QACX,SAAS;KACV,EACD,KAAK,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QAClD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;IACJ,OAAO;QACL,aAAa,EAAE,6BAA6B,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC;QACzE,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC;QACrD,OAAO;QACP,QAAQ;QACR,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC;QACrD,cAAc,EAAE,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA0B;IAE1B,MAAM,gBAAgB,GAAG,MAAM;SAC5B,GAAG,CAAC,gCAAgC,CAAC;SACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CACrB,sBAAsB,CAAC,IAAI,CAAC,EAC5B,sBAAsB,CAAC,KAAK,CAAC,CAC9B,CACF,CAAC;IAEJ,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,aAAa,IAAI,gBAAgB,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,iBAAiB,CACf,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,YAAY,CAAC;IAC7B,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,OAAO;QACP,WAAW;QACX,WAAW;QACX,eAAe;QACf,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,sBAAsB;QACtB,0BAA0B;QAC1B,gBAAgB;QAChB,SAAS;KACV,EACD,iBAAiB,CAClB,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;IAEjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC7C,iBAAiB,CACf,eAAe,EACf,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAC/C,UAAU,EAAE,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC3E,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC;QAC3D,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QACvE,KAAK,EAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAC9D,oBAAoB,EAAE,sBAAsB,CAC1C,MAAM,EACN,sBAAsB,EACtB,iBAAiB,CAClB;QACD,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACjE,cAAc,EAAE,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QAC3E,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACjE,wBAAwB,EAAE,iCAAiC,CACzD,wBAAwB,CACzB;QACD,aAAa,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAwB;IAExB,MAAM,OAAO,GACX,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,uBAAuB,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,sBAAsB,EACtB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,4BAA4B,EAC5B,eAAe,EACf,QAAQ,GACkB;IAG1B,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QAEzE,IAAI,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC1C,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;YACrD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU;YACxD,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ;YACpD,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc,EAChE,CAAC;YACD,iBAAiB,CACf,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,KAAK,CAAC,oBAAoB;YAChC,kBAAkB,CAAC,oBAAoB,EACvC,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,IACE,4BAA4B,KAAK,SAAS;YAC1C,4BAA4B,KAAK,kBAAkB,CAAC,oBAAoB,EACxE,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IACE,cAAc;YACd,CAAC,cAAc,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU;gBAC1D,cAAc,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ,CAAC,EAC1D,CAAC;YACD,iBAAiB,CACf,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,oCAAoC,CAAC;YACtD,QAAQ,EAAE,kBAAkB;YAC5B,YAAY;SACb,CAAC,CAAC;QACH,mCAAmC,CAAC;YAClC,OAAO,EAAE;gBACP,GAAG,UAAU;gBACb,oBAAoB,EAAE,kBAAkB,CAAC,oBAAoB;aAC9D;YACD,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;QAEH,OAAO,0BAA0B,CAAC;YAChC,QAAQ,EAAE,kBAAkB;YAC5B,YAAY;YACZ,KAAK;YACL,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { toFingerprint } from \"../fingerprint\";\nimport { sign } from \"../signing/sign\";\nimport { verifyHistorySignature as verify } from \"../signing/verifiedHistorySignature\";\nimport {\n  computeKeyingDomainHash,\n  encodeDomainPayload,\n  normalizeCanonicalJsonValue,\n} from \"./canonical\";\nimport {\n  accessManifestCheckpointFromManifest,\n  verifyAccessManifestLocalCheckpoint,\n} from \"./checkpoints\";\nimport {\n  assertExactKeys,\n  compareCanonicalStrings,\n  expectedObjectKindForEventType,\n  normalizeAccessEventType,\n  normalizeAccessObjectKind,\n  normalizeManagedPrincipalKind,\n  normalizeUniqueSortedStrings,\n  readHashString,\n  readNullableHashString,\n  readPositiveInteger,\n  readSignedAt,\n  readString,\n  readStringArray,\n  readVersion,\n  runVerifier,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  KeyingCanonicalJson,\n  KeyingCanonicalPayload,\n  KeyingVerificationResult,\n  ReferencedPrincipalHead,\n  UnsignedAccessEvent,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n} from \"./types\";\nimport { makeVerifiedAccessEvent, makeVerifiedAccessManifest } from \"./types\";\n\nfunction normalizeUnsignedAccessEvent(value: unknown): UnsignedAccessEvent {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bodyHash\",\n      \"dependencyManifestHashes\",\n      \"eventId\",\n      \"eventType\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"signedAt\",\n      \"signerDeviceId\",\n      \"signerKeyFingerprint\",\n      \"signerUserId\",\n      \"version\",\n    ],\n    \"access event\",\n  );\n  const eventType = normalizeAccessEventType(record.eventType, \"access event\");\n  const objectKind = normalizeAccessObjectKind(\n    record.objectKind,\n    \"access event\",\n  );\n  const expectedObjectKind = expectedObjectKindForEventType(eventType);\n\n  if (objectKind !== expectedObjectKind) {\n    throwVerification(\n      \"object_mismatch\",\n      `access event ${eventType} must use objectKind ${expectedObjectKind}`,\n    );\n  }\n\n  return {\n    version: readVersion(record, \"access event\"),\n    eventId: readString(record, \"eventId\", \"access event\"),\n    eventType,\n    objectKind,\n    objectId: readString(record, \"objectId\", \"access event\"),\n    organizationId: readString(record, \"organizationId\", \"access event\"),\n    previousManifestHash: readNullableHashString(\n      record,\n      \"previousManifestHash\",\n      \"access event\",\n    ),\n    dependencyManifestHashes: normalizeUniqueSortedStrings(\n      readStringArray(record, \"dependencyManifestHashes\", \"access event\"),\n      \"access event dependencyManifestHashes\",\n    ),\n    bodyHash: readHashString(record, \"bodyHash\", \"access event\"),\n    signerUserId: readString(record, \"signerUserId\", \"access event\"),\n    signerDeviceId: readString(record, \"signerDeviceId\", \"access event\"),\n    signerKeyFingerprint: readHashString(\n      record,\n      \"signerKeyFingerprint\",\n      \"access event\",\n    ),\n    signedAt: readSignedAt(record, \"signedAt\", \"access event\"),\n  };\n}\n\nfunction normalizeAccessEvent(value: unknown): AccessEvent {\n  const record = assertExactKeys(\n    value,\n    [\n      \"bodyHash\",\n      \"dependencyManifestHashes\",\n      \"eventId\",\n      \"eventType\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"signature\",\n      \"signedAt\",\n      \"signerDeviceId\",\n      \"signerKeyFingerprint\",\n      \"signerUserId\",\n      \"version\",\n    ],\n    \"access event\",\n  );\n  const unsignedEvent = normalizeUnsignedAccessEvent({\n    version: record.version,\n    eventId: record.eventId,\n    eventType: record.eventType,\n    objectKind: record.objectKind,\n    objectId: record.objectId,\n    organizationId: record.organizationId,\n    previousManifestHash: record.previousManifestHash,\n    dependencyManifestHashes: record.dependencyManifestHashes,\n    bodyHash: record.bodyHash,\n    signerUserId: record.signerUserId,\n    signerDeviceId: record.signerDeviceId,\n    signerKeyFingerprint: record.signerKeyFingerprint,\n    signedAt: record.signedAt,\n  });\n\n  return {\n    ...unsignedEvent,\n    signature: readString(record, \"signature\", \"access event\"),\n  };\n}\n\nfunction unsignedAccessEventPayload(\n  event: UnsignedAccessEvent,\n): KeyingCanonicalPayload<UnsignedAccessEvent> {\n  return normalizeUnsignedAccessEvent(event);\n}\n\nfunction accessEventSigningBytes(event: UnsignedAccessEvent): Uint8Array {\n  return encodeDomainPayload(\n    \"tearleads.keying.access-event-signing\",\n    unsignedAccessEventPayload(event),\n  );\n}\n\nfunction toUnsignedAccessEvent(event: AccessEvent): UnsignedAccessEvent {\n  return {\n    version: event.version,\n    eventId: event.eventId,\n    eventType: event.eventType,\n    objectKind: event.objectKind,\n    objectId: event.objectId,\n    organizationId: event.organizationId,\n    previousManifestHash: event.previousManifestHash,\n    dependencyManifestHashes: event.dependencyManifestHashes,\n    bodyHash: event.bodyHash,\n    signerUserId: event.signerUserId,\n    signerDeviceId: event.signerDeviceId,\n    signerKeyFingerprint: event.signerKeyFingerprint,\n    signedAt: event.signedAt,\n  };\n}\n\nexport async function computeAccessEventBodyHash(\n  body: KeyingCanonicalJson,\n): Promise<string> {\n  return computeKeyingDomainHash(\"tearleads.keying.access-event-body\", body);\n}\n\nexport async function signAccessEvent(\n  event: UnsignedAccessEvent,\n  signingPrivateKey: Uint8Array,\n): Promise<AccessEvent> {\n  const normalizedEvent = normalizeUnsignedAccessEvent(event);\n  const signature = sign(\n    accessEventSigningBytes(normalizedEvent),\n    signingPrivateKey,\n  );\n\n  return {\n    ...normalizedEvent,\n    signature: bytesToBase64(signature),\n  };\n}\n\nexport async function computeAccessEventHash(\n  event: AccessEvent,\n): Promise<string> {\n  const payload: KeyingCanonicalPayload<AccessEvent> =\n    normalizeAccessEvent(event);\n\n  return computeKeyingDomainHash(\"tearleads.keying.access-event\", payload);\n}\n\nexport async function verifySignedAccessEvent({\n  body,\n  event,\n  signerPublicKey,\n}: VerifyAccessEventInput): Promise<\n  KeyingVerificationResult<VerifiedAccessEvent>\n> {\n  return runVerifier(async () => {\n    const normalizedBody = normalizeCanonicalJsonValue(\n      body,\n      \"access event body\",\n    );\n    const normalizedEvent = normalizeAccessEvent(event);\n    const computedBodyHash = await computeAccessEventBodyHash(normalizedBody);\n\n    if (computedBodyHash !== normalizedEvent.bodyHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access event body hash does not match body\",\n      );\n    }\n\n    const signerKeyFingerprint = await toFingerprint(signerPublicKey);\n    if (signerKeyFingerprint !== normalizedEvent.signerKeyFingerprint) {\n      throwVerification(\n        \"signer_mismatch\",\n        \"access event signer fingerprint does not match signer public key\",\n      );\n    }\n\n    let signature: Uint8Array;\n    try {\n      signature = base64ToBytes(normalizedEvent.signature);\n    } catch {\n      throwVerification(\"signature_mismatch\", \"access event signature invalid\");\n    }\n\n    if (\n      !verify(\n        signature,\n        accessEventSigningBytes(toUnsignedAccessEvent(normalizedEvent)),\n        signerPublicKey,\n      )\n    ) {\n      throwVerification(\n        \"signature_mismatch\",\n        \"access event signature verification failed\",\n      );\n    }\n\n    return makeVerifiedAccessEvent({\n      event: normalizedEvent,\n      body: normalizedBody,\n      eventHash: await computeAccessEventHash(normalizedEvent),\n    });\n  });\n}\n\nexport function normalizeReferencedPrincipalHead(\n  value: unknown,\n): ReferencedPrincipalHead {\n  const label = \"referenced principal head\";\n  const record = assertExactKeys(\n    value,\n    [\n      \"keyEpoch\",\n      \"keyFingerprint\",\n      \"principalId\",\n      \"principalType\",\n      \"stateHash\",\n      \"version\",\n    ],\n    label,\n  );\n\n  const version = readPositiveInteger(record, \"version\", label);\n  const keyEpoch = readPositiveInteger(record, \"keyEpoch\", label);\n  if (![version, keyEpoch].every(Number.isSafeInteger))\n    throwVerification(\n      \"invalid_shape\",\n      \"referenced principal head counters must be safe integers\",\n    );\n  return {\n    principalType: normalizeManagedPrincipalKind(record.principalType, label),\n    principalId: readString(record, \"principalId\", label),\n    version,\n    keyEpoch,\n    stateHash: readHashString(record, \"stateHash\", label),\n    keyFingerprint: readHashString(record, \"keyFingerprint\", label),\n  };\n}\n\nexport function referencedPrincipalKey(\n  principal: ReferencedPrincipalHead,\n): string {\n  return `${principal.principalType}:${principal.principalId}`;\n}\n\nexport function normalizeReferencedPrincipalHeads(\n  values: readonly unknown[],\n): ReferencedPrincipalHead[] {\n  const normalizedValues = values\n    .map(normalizeReferencedPrincipalHead)\n    .sort((left, right) =>\n      compareCanonicalStrings(\n        referencedPrincipalKey(left),\n        referencedPrincipalKey(right),\n      ),\n    );\n\n  let previousKey: string | null = null;\n  for (const principalHead of normalizedValues) {\n    const principalKey = referencedPrincipalKey(principalHead);\n    if (previousKey === principalKey) {\n      throwVerification(\n        \"duplicate_entry\",\n        \"access manifest referencedPrincipalHeads contains a duplicate\",\n      );\n    }\n    previousKey = principalKey;\n  }\n\n  return normalizedValues;\n}\n\nexport function normalizeAccessManifest(value: unknown): AccessManifest {\n  const record = assertExactKeys(\n    value,\n    [\n      \"epoch\",\n      \"eventHash\",\n      \"grantRoot\",\n      \"keyTargetHash\",\n      \"objectId\",\n      \"objectKind\",\n      \"organizationId\",\n      \"previousManifestHash\",\n      \"referencedPrincipalHeads\",\n      \"structuralHash\",\n      \"version\",\n    ],\n    \"access manifest\",\n  );\n  const referencedPrincipalHeads = record.referencedPrincipalHeads;\n\n  if (!Array.isArray(referencedPrincipalHeads)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"access manifest.referencedPrincipalHeads must be an array\",\n    );\n  }\n\n  return {\n    version: readVersion(record, \"access manifest\"),\n    objectKind: normalizeAccessObjectKind(record.objectKind, \"access manifest\"),\n    objectId: readString(record, \"objectId\", \"access manifest\"),\n    organizationId: readString(record, \"organizationId\", \"access manifest\"),\n    epoch: readPositiveInteger(record, \"epoch\", \"access manifest\"),\n    previousManifestHash: readNullableHashString(\n      record,\n      \"previousManifestHash\",\n      \"access manifest\",\n    ),\n    eventHash: readHashString(record, \"eventHash\", \"access manifest\"),\n    structuralHash: readHashString(record, \"structuralHash\", \"access manifest\"),\n    grantRoot: readHashString(record, \"grantRoot\", \"access manifest\"),\n    referencedPrincipalHeads: normalizeReferencedPrincipalHeads(\n      referencedPrincipalHeads,\n    ),\n    keyTargetHash: readHashString(record, \"keyTargetHash\", \"access manifest\"),\n  };\n}\n\nexport async function computeAccessManifestHash(\n  manifest: AccessManifest,\n): Promise<string> {\n  const payload: KeyingCanonicalPayload<AccessManifest> =\n    normalizeAccessManifest(manifest);\n\n  return computeKeyingDomainHash(\"tearleads.keying.access-manifest\", payload);\n}\n\nexport async function verifyAccessManifest({\n  checkpointPredecessors,\n  event,\n  expectedManifestHash,\n  expectedObject,\n  expectedPreviousManifestHash,\n  localCheckpoint,\n  manifest,\n}: VerifyAccessManifestInput): Promise<\n  KeyingVerificationResult<VerifiedAccessManifest>\n> {\n  return runVerifier(async () => {\n    const normalizedManifest = normalizeAccessManifest(manifest);\n    const manifestHash = await computeAccessManifestHash(normalizedManifest);\n\n    if (manifestHash !== expectedManifestHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access manifest hash does not match expected hash\",\n      );\n    }\n\n    if (event.eventHash !== normalizedManifest.eventHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"access manifest event hash does not match verified event\",\n      );\n    }\n\n    if (\n      event.event.objectKind !== normalizedManifest.objectKind ||\n      event.event.objectId !== normalizedManifest.objectId ||\n      event.event.organizationId !== normalizedManifest.organizationId\n    ) {\n      throwVerification(\n        \"object_mismatch\",\n        \"access manifest object does not match verified event\",\n      );\n    }\n\n    if (\n      event.event.previousManifestHash !==\n      normalizedManifest.previousManifestHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"access manifest predecessor does not match verified event\",\n      );\n    }\n\n    if (\n      expectedPreviousManifestHash !== undefined &&\n      expectedPreviousManifestHash !== normalizedManifest.previousManifestHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"access manifest predecessor does not match expected predecessor\",\n      );\n    }\n\n    if (\n      expectedObject &&\n      (expectedObject.objectKind !== normalizedManifest.objectKind ||\n        expectedObject.objectId !== normalizedManifest.objectId)\n    ) {\n      throwVerification(\n        \"object_mismatch\",\n        \"access manifest object does not match expected object\",\n      );\n    }\n\n    const checkpoint = accessManifestCheckpointFromManifest({\n      manifest: normalizedManifest,\n      manifestHash,\n    });\n    verifyAccessManifestLocalCheckpoint({\n      current: {\n        ...checkpoint,\n        previousManifestHash: normalizedManifest.previousManifestHash,\n      },\n      localCheckpoint,\n      checkpointPredecessors,\n    });\n\n    return makeVerifiedAccessManifest({\n      manifest: normalizedManifest,\n      manifestHash,\n      event,\n      checkpoint,\n    });\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyChainEntry.js

@@ -38,6 +38,9 @@ export function verifyPrincipalPolicyChainEntryIdentity(input) {
 }
 export function verifyInitialPrincipalPolicyChainEntry(input) {
     const { normalizedEntry } = input;
+    if (normalizedEntry.state.keyEpoch !== 1) {
+        throwVerification("key_epoch_reuse", "initial principal policy key epoch must be 1");
+    }
     if (normalizedEntry.state.prevStateHash !== null) {
         throwVerification("stale_predecessor", "initial principal policy chain entry has a previous state hash");
     }