@tearleads/client-sdk 0.1.26 → 0.1.27

package/internal/validators/operation/blobBytes.d.ts

@@ -306,7 +306,7 @@ export declare const uploadMultipartBlobPartBytesOperation: Omit<{
         }>>;
     };
     readonly runtimeRefinements: readonly [{
-        readonly description: "Declared multipart part byte length is at most 104857600";
+        readonly description: "Declared multipart part byte length is at most 33554432";
         readonly id: "blobs.multipartPart.declaredByteLengthMax";
     }];
 }, "failureResponses" | "failureStatuses"> & {

package/internal/validators/util/blob.d.ts

@@ -1,2 +1,7 @@
-/** Protocol ceiling for one buffered multipart blob part. */
+/**
+ * Protocol ceiling for one buffered multipart blob part. The API buffers a
+ * part before uploading it, and the Workers isolate that serves uploads has
+ * 128 MB of memory, so the ceiling leaves room for the copy the digest check
+ * makes.
+ */
 export declare const MAX_MULTIPART_BLOB_PART_BYTES: number;

package/internal/validators/util/blob.js

@@ -1,3 +1,8 @@
-/** Protocol ceiling for one buffered multipart blob part. */
-export const MAX_MULTIPART_BLOB_PART_BYTES = 100 * 1024 * 1024;
+/**
+ * Protocol ceiling for one buffered multipart blob part. The API buffers a
+ * part before uploading it, and the Workers isolate that serves uploads has
+ * 128 MB of memory, so the ceiling leaves room for the copy the digest check
+ * makes.
+ */
+export const MAX_MULTIPART_BLOB_PART_BYTES = 32 * 1024 * 1024;
 //# sourceMappingURL=blob.js.map

package/internal/validators/util/blob.js.map

@@ -1 +1 @@
-{"version":3,"file":"blob.js","sourceRoot":"","sources":["blob.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC","sourcesContent":["/** Protocol ceiling for one buffered multipart blob part. */\nexport const MAX_MULTIPART_BLOB_PART_BYTES = 100 * 1024 * 1024;\n"]}
+{"version":3,"file":"blob.js","sourceRoot":"","sources":["blob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC","sourcesContent":["/**\n * Protocol ceiling for one buffered multipart blob part. The API buffers a\n * part before uploading it, and the Workers isolate that serves uploads has\n * 128 MB of memory, so the ceiling leaves room for the copy the digest check\n * makes.\n */\nexport const MAX_MULTIPART_BLOB_PART_BYTES = 32 * 1024 * 1024;\n"]}

package/internal/validators/util/containerKekKeyringWire.d.ts

@@ -74,7 +74,7 @@ export declare const MAX_INLINE_CONTAINER_REKEYS = 16;
  * exceeding it: beyond the cap the remainder repairs lazily.
  *
  * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far
- * inside the API's 100 MiB request limit unless its containers average tens of
+ * inside the API's 32 MiB request limit unless its containers average tens of
  * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats
  * as a runaway rather than a use.
  */

package/internal/validators/util/containerKekKeyringWire.js

@@ -66,7 +66,7 @@ export const MAX_INLINE_CONTAINER_REKEYS = 16;
  * exceeding it: beyond the cap the remainder repairs lazily.
  *
  * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far
- * inside the API's 100 MiB request limit unless its containers average tens of
+ * inside the API's 32 MiB request limit unless its containers average tens of
  * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats
  * as a runaway rather than a use.
  */

package/internal/validators/util/containerKekKeyringWire.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerKekKeyringWire.js","sourceRoot":"","sources":["containerKekKeyringWire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,CAAC;AAC3D,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAE,CAAC;AAEnE,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,OAAO,CACL,yCAAyC;QACzC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,wCAAwC;QACzD,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8CAA8C,GAAG,YAAY,CACxE,8BAA8B,CAAC,uBAAuB,CAAC,CACxD,CAAC;AAEF,MAAM,wBAAwB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;AAClD,MAAM,gCAAgC,GAAG,0BAA0B,CACjE,CAAC,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EACxC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,EAAE,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;IACjD,MAAM,EAAE,mBAAmB,CAAC,8CAA8C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport { boundedStringSchema, loosePlainObject } from \"../schema\";\n\n/**\n * Shared wire arithmetic for sealed container KEK keyrings.\n *\n * These numbers define the exact-length equality every layer enforces: the\n * server rejects a rotation whose sealed keyring ciphertext differs from\n * `sealedContainerKekKeyringBytes(keyEpoch)`, and response guards reject any\n * blob over the `MAX_CONTAINER_KEY_EPOCH` ceiling before cryptographic work.\n * `@tearleads/crypto` consumes these same constants for seal/open, so the\n * equation has one definition. The overhead constant is the AES-GCM tag.\n */\nexport const MAX_CONTAINER_KEY_EPOCH = 65536;\nexport const SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES = 8;\nexport const SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES = 64;\nexport const SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES = 16;\n\nexport function sealedContainerKekKeyringBytes(keyEpoch: number): number {\n  return (\n    SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES +\n    (keyEpoch - 1) * SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES +\n    SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES\n  );\n}\n\nfunction base64Length(bytes: number): number {\n  return Math.ceil(bytes / 3) * 4;\n}\n\n/** Parse ceiling: the base64 length of a keyring sealed at the epoch cap. */\nexport const MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH = base64Length(\n  sealedContainerKekKeyringBytes(MAX_CONTAINER_KEY_EPOCH),\n);\n\nconst AES_GCM_IV_BASE64_LENGTH = base64Length(12);\nconst ContainerKekKeyringVersionSchema = registerJsonSchemaFragment(\n  z.custom<number>((value) => value === 1),\n  { const: 1, type: \"number\" },\n);\n\nexport const ContainerKekKeyringWireRecordSchema = loosePlainObject({\n  containerId: z.string(),\n  containerKeyEpochId: z.string(),\n  iv: boundedStringSchema(AES_GCM_IV_BASE64_LENGTH),\n  sealed: boundedStringSchema(MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH),\n  sealingSuite: z.string(),\n  version: ContainerKekKeyringVersionSchema,\n});\n\n/**\n * Structural bound applied before any allocation-heavy or cryptographic work.\n * Content verification (exact length for the epoch, AEAD, per-entry\n * commitments) happens in `@tearleads/crypto`; this guard only bounds a\n * hostile payload.\n */\nexport function isContainerKekKeyringWireRecord(\n  value: unknown,\n): value is Record<string, unknown> {\n  return ContainerKekKeyringWireRecordSchema.safeParse(value).success;\n}\n\n/**\n * Maximum epochs one kek-log page may serve. Recovery walks the log from the\n * newest page backward, so the page bound — not the container's lifetime\n * rotation count — determines a response's size.\n */\nexport const CONTAINER_KEK_LOG_PAGE_LIMIT = 256;\n\n/**\n * Maximum signed container rekeys one document/blob write may carry inline.\n * Each rotation ships a keyring, which is O(its epoch) bytes, so an unbounded\n * batch is an unbounded request body.\n */\nexport const MAX_INLINE_CONTAINER_REKEYS = 16;\n\n/**\n * Maximum descendant rekeys one container rotation may carry. A rotation must\n * re-key, in its own transaction, every descendant that sits above a directly\n * granted container, or a writer granted only further down would wait on\n * another device's write. The set is empty for almost every rotation, since\n * child containers carry no direct grant unless shared, so this bounds the\n * body rather than shaping ordinary traffic. A rotation is never refused for\n * exceeding it: beyond the cap the remainder repairs lazily.\n *\n * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far\n * inside the API's 100 MiB request limit unless its containers average tens of\n * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats\n * as a runaway rather than a use.\n */\nexport const MAX_ROTATION_CONTAINER_REKEYS = 64;\n\n/**\n * Maximum recipient envelopes one kek-log epoch may serve, applied PER EPOCH\n * so no epoch can be starved by another's width — a starved epoch is\n * indistinguishable from an unaddressed one and would surface as a false\n * `no-addressed-envelope` recovery failure.\n *\n * Recovery needs ONE openable anchor per epoch, not every envelope, and the\n * ranking puts the requester's own direct wrap first, so this cap never costs\n * a usable anchor. Together with the epoch page limit it bounds the response\n * at page x cap rows regardless of how many recipients a container has\n * accumulated.\n */\nexport const CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT = 16;\n\n/**\n * Maximum authorized principals a single kek-log read may scope wraps to.\n * A requester's principal set has no intrinsic ceiling and each entry adds a\n * clause, and bind parameters, to the statement.\n *\n * The requester's direct user envelope and their parent-container envelopes\n * are scoped outside this cap and rank ahead of principal wraps, so the bound\n * never costs the anchors openable without principal-policy state. Opening a\n * principal wrap needs that state regardless (see issue #1941).\n */\nexport const CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT = 64;\n"]}
+{"version":3,"file":"containerKekKeyringWire.js","sourceRoot":"","sources":["containerKekKeyringWire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,CAAC;AAC3D,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAE,CAAC;AAEnE,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,OAAO,CACL,yCAAyC;QACzC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,wCAAwC;QACzD,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8CAA8C,GAAG,YAAY,CACxE,8BAA8B,CAAC,uBAAuB,CAAC,CACxD,CAAC;AAEF,MAAM,wBAAwB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;AAClD,MAAM,gCAAgC,GAAG,0BAA0B,CACjE,CAAC,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EACxC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,EAAE,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;IACjD,MAAM,EAAE,mBAAmB,CAAC,8CAA8C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport { boundedStringSchema, loosePlainObject } from \"../schema\";\n\n/**\n * Shared wire arithmetic for sealed container KEK keyrings.\n *\n * These numbers define the exact-length equality every layer enforces: the\n * server rejects a rotation whose sealed keyring ciphertext differs from\n * `sealedContainerKekKeyringBytes(keyEpoch)`, and response guards reject any\n * blob over the `MAX_CONTAINER_KEY_EPOCH` ceiling before cryptographic work.\n * `@tearleads/crypto` consumes these same constants for seal/open, so the\n * equation has one definition. The overhead constant is the AES-GCM tag.\n */\nexport const MAX_CONTAINER_KEY_EPOCH = 65536;\nexport const SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES = 8;\nexport const SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES = 64;\nexport const SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES = 16;\n\nexport function sealedContainerKekKeyringBytes(keyEpoch: number): number {\n  return (\n    SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES +\n    (keyEpoch - 1) * SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES +\n    SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES\n  );\n}\n\nfunction base64Length(bytes: number): number {\n  return Math.ceil(bytes / 3) * 4;\n}\n\n/** Parse ceiling: the base64 length of a keyring sealed at the epoch cap. */\nexport const MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH = base64Length(\n  sealedContainerKekKeyringBytes(MAX_CONTAINER_KEY_EPOCH),\n);\n\nconst AES_GCM_IV_BASE64_LENGTH = base64Length(12);\nconst ContainerKekKeyringVersionSchema = registerJsonSchemaFragment(\n  z.custom<number>((value) => value === 1),\n  { const: 1, type: \"number\" },\n);\n\nexport const ContainerKekKeyringWireRecordSchema = loosePlainObject({\n  containerId: z.string(),\n  containerKeyEpochId: z.string(),\n  iv: boundedStringSchema(AES_GCM_IV_BASE64_LENGTH),\n  sealed: boundedStringSchema(MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH),\n  sealingSuite: z.string(),\n  version: ContainerKekKeyringVersionSchema,\n});\n\n/**\n * Structural bound applied before any allocation-heavy or cryptographic work.\n * Content verification (exact length for the epoch, AEAD, per-entry\n * commitments) happens in `@tearleads/crypto`; this guard only bounds a\n * hostile payload.\n */\nexport function isContainerKekKeyringWireRecord(\n  value: unknown,\n): value is Record<string, unknown> {\n  return ContainerKekKeyringWireRecordSchema.safeParse(value).success;\n}\n\n/**\n * Maximum epochs one kek-log page may serve. Recovery walks the log from the\n * newest page backward, so the page bound — not the container's lifetime\n * rotation count — determines a response's size.\n */\nexport const CONTAINER_KEK_LOG_PAGE_LIMIT = 256;\n\n/**\n * Maximum signed container rekeys one document/blob write may carry inline.\n * Each rotation ships a keyring, which is O(its epoch) bytes, so an unbounded\n * batch is an unbounded request body.\n */\nexport const MAX_INLINE_CONTAINER_REKEYS = 16;\n\n/**\n * Maximum descendant rekeys one container rotation may carry. A rotation must\n * re-key, in its own transaction, every descendant that sits above a directly\n * granted container, or a writer granted only further down would wait on\n * another device's write. The set is empty for almost every rotation, since\n * child containers carry no direct grant unless shared, so this bounds the\n * body rather than shaping ordinary traffic. A rotation is never refused for\n * exceeding it: beyond the cap the remainder repairs lazily.\n *\n * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far\n * inside the API's 32 MiB request limit unless its containers average tens of\n * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats\n * as a runaway rather than a use.\n */\nexport const MAX_ROTATION_CONTAINER_REKEYS = 64;\n\n/**\n * Maximum recipient envelopes one kek-log epoch may serve, applied PER EPOCH\n * so no epoch can be starved by another's width — a starved epoch is\n * indistinguishable from an unaddressed one and would surface as a false\n * `no-addressed-envelope` recovery failure.\n *\n * Recovery needs ONE openable anchor per epoch, not every envelope, and the\n * ranking puts the requester's own direct wrap first, so this cap never costs\n * a usable anchor. Together with the epoch page limit it bounds the response\n * at page x cap rows regardless of how many recipients a container has\n * accumulated.\n */\nexport const CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT = 16;\n\n/**\n * Maximum authorized principals a single kek-log read may scope wraps to.\n * A requester's principal set has no intrinsic ceiling and each entry adds a\n * clause, and bind parameters, to the statement.\n *\n * The requester's direct user envelope and their parent-container envelopes\n * are scoped outside this cap and rank ahead of principal wraps, so the bound\n * never costs the anchors openable without principal-policy state. Opening a\n * principal wrap needs that state regardless (see issue #1941).\n */\nexport const CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT = 64;\n"]}

package/internal/validators/util/documentSyncLimits.js

@@ -1,10 +1,12 @@
 import { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
 export const MAX_DOCUMENT_SYNC_REQUEST_BYTES = 16 * 1024 * 1024;
 // A response page must be able to carry the largest accepted atomic rotation
-// baseline (the 100 MiB route ceiling) plus its signed metadata and key-bundle
-// envelope. Ordinary sync updates remain constrained by the smaller request
-// ceiling above.
-export const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 128 * 1024 * 1024;
+// baseline (the 32 MiB route ceiling) plus its signed metadata and key-bundle
+// envelope, and no more: the API materializes a page and then serializes it,
+// so the page and its JSON copy must both fit the 128 MB Workers isolate.
+// Ordinary sync updates remain constrained by the smaller request ceiling
+// above.
+export const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 48 * 1024 * 1024;
 export const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES = 16 * 1024 * 1024;
 export const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES = MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES -
     MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES;

package/internal/validators/util/documentSyncLimits.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentSyncLimits.js","sourceRoot":"","sources":["documentSyncLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,iBAAiB;AACjB,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvE,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1E,MAAM,CAAC,MAAM,4CAA4C,GACvD,qCAAqC;IACrC,yCAAyC,CAAC;AAC5C,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAExD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AACrD,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AACxD,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,MAAM,CAAC,MAAM,yCAAyC,GACpD,qCAAqC,GAAG,yBAAyB,CAAC;AACpE,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC","sourcesContent":["import { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\n\nexport const MAX_DOCUMENT_SYNC_REQUEST_BYTES = 16 * 1024 * 1024;\n\n// A response page must be able to carry the largest accepted atomic rotation\n// baseline (the 100 MiB route ceiling) plus its signed metadata and key-bundle\n// envelope. Ordinary sync updates remain constrained by the smaller request\n// ceiling above.\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 128 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES = 16 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES =\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES -\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES = 64;\nexport const MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH = 512;\n\nexport const MAX_DOCUMENT_SYNC_OUTGOING_UPDATES = 64;\n// Individual updates may use the request's remaining budget. The SDK applies\n// the exact serialized-byte ceiling after encryption and trims the batch; a\n// smaller estimate here would permanently strand an otherwise valid update.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS = 64;\n// Derive the aggregate ceiling from the structural limits so every valid link\n// set remains syncable after later container moves deepen its paths. This is\n// still a finite verification bound; the serialized request has a separate\n// 16 MiB ceiling.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS =\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS * MAX_CONTAINER_PATH_LENGTH;\n// Flag-day product maximum for every document content-key bundle. Create/link\n// request validation and the client link preflight keep a greenfield database\n// from ever producing a document that cannot fit this sync contract.\nexport const MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS = 64;\n"]}
+{"version":3,"file":"documentSyncLimits.js","sourceRoot":"","sources":["documentSyncLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,SAAS;AACT,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACtE,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1E,MAAM,CAAC,MAAM,4CAA4C,GACvD,qCAAqC;IACrC,yCAAyC,CAAC;AAC5C,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAExD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AACrD,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AACxD,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,MAAM,CAAC,MAAM,yCAAyC,GACpD,qCAAqC,GAAG,yBAAyB,CAAC;AACpE,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC","sourcesContent":["import { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\n\nexport const MAX_DOCUMENT_SYNC_REQUEST_BYTES = 16 * 1024 * 1024;\n\n// A response page must be able to carry the largest accepted atomic rotation\n// baseline (the 32 MiB route ceiling) plus its signed metadata and key-bundle\n// envelope, and no more: the API materializes a page and then serializes it,\n// so the page and its JSON copy must both fit the 128 MB Workers isolate.\n// Ordinary sync updates remain constrained by the smaller request ceiling\n// above.\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 48 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES = 16 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES =\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES -\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES = 64;\nexport const MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH = 512;\n\nexport const MAX_DOCUMENT_SYNC_OUTGOING_UPDATES = 64;\n// Individual updates may use the request's remaining budget. The SDK applies\n// the exact serialized-byte ceiling after encryption and trims the batch; a\n// smaller estimate here would permanently strand an otherwise valid update.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS = 64;\n// Derive the aggregate ceiling from the structural limits so every valid link\n// set remains syncable after later container moves deepen its paths. This is\n// still a finite verification bound; the serialized request has a separate\n// 16 MiB ceiling.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS =\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS * MAX_CONTAINER_PATH_LENGTH;\n// Flag-day product maximum for every document content-key bundle. Create/link\n// request validation and the client link preflight keep a greenfield database\n// from ever producing a document that cannot fit this sync contract.\nexport const MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS = 64;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {