@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/syncPlan/syncPlanIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPlanIdentity.js","sourceRoot":"","sources":["syncPlanIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,mCAAmC,EACnC,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,SAAS,8BAA8B,CACrC,KAAiD;IAEjD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAiC;IAOjC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB;QAC9B,KAAK,EAAE,wBAAwB;KAChC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAChD,KAAK,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU;QAClD,gBAAgB,CAAC,UAAU,KAAK,UAAU,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACjC,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;QAC5C,KAAK,CAAC,kBAAkB,CAAC,mBAAmB;YAC1C,KAAK,CAAC,gBAAgB,CAAC,mBAAmB,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,CAAC,qBAAqB;QAC9C,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,kCAAkC,CACnD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,iBAAiB,GAAG,mBAAmB,CAC3C,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAC5D,CAAC;IACF,IACE,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC;QAC7C,kBAAkB,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,UAAU;QACV,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;QACvE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QACrD,cAAc,EAAE,gBAAgB,CAAC,cAAc;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,IAA8D;IAE9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,0CAA0C,SAAS,YAAY,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAUhD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe;KACP,CAAC;IACX,MAAM,cAAc,GAAwB;QAC1C,GAAG,WAAW;QACd,wBAAwB,EAAE;YACxB,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC,CACF;SACF,CAAC,IAAI,EAAE;QACR,kBAAkB,EAAE,KAAK,CAAC,2BAA2B;QACrD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,eAAe,EAAE,MAAM,mCAAmC,CAAC,WAAW,CAAC;QACvE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;KAClD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,cAAc,EACd,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,WAAW,EAAE,mBAAmB,CAC9B,WAAW,EACX,gCAAgC,CACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,OAA8C;IAE9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEzB,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAiC,EACjC,kBAA2B,EAC3B,kBAA2B;IAE3B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,IAAI,kBAAkB,CAAC;IAC3D,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,KAAK,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,EACJ,UAAU,EACV,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,GACf,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,oBAAoB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,6BAA6B,CAC3B,KAAK,EACL,eAAe,CAAC,MAAM,GAAG,CAAC,EAC1B,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,mCAAmC,CAAC,oBAAoB,CAAC,CAAC;IAE1D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CACvC,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,0BAA0B,CAAC;QACzB,4BAA4B,EAAE,qCAAqC,CACjE,KAAK,CAAC,4BAA4B,CACnC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,UAAU;QACV,2BAA2B;QAC3B,kBAAkB;QAClB,cAAc;QACd,QAAQ;QACR,MAAM;KACP,CAAC,CACH,CACF,CAAC;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,6BAA6B,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACjE,MAAM,OAAO,GAAwB;QACnC,GAAG,CAAC,6BAA6B;YAC/B,CAAC,CAAC;gBACE,gBAAgB,EAAE,8BAA8B,CAC9C,KAAK,CAAC,gBAAgB,CACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,4BAA4B,EAAE,qCAAqC,CACjE,KAAK,CAAC,4BAA4B,CACnC;aACF,CAAC;QACN,2BAA2B;QAC3B,kBAAkB;QAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACvD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,sBAAsB,EAAE,IAAI;KAC7B,CAAC;IAEF,OAAO;QACL,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,UAAU;QACV,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,2BAA2B;QAC3B,kBAAkB;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc;QACd,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,gBAAgB;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  signWriteHeader,\n  type UnsignedWriteHeader,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type { DocumentCreateResponse } from \"@tearleads/validators/response\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  normalizeDocumentKekTargetResponse,\n  serializeCanonical,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n} from \"../../../data/documents/shared/readers\";\nimport type {\n  BuildDocumentSyncPlanInput,\n  DocumentCreateAuthor,\n  DocumentSyncPlan,\n  DocumentSyncPreparedUpdate,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\n\nfunction contentKeyBundleForSyncRequest(\n  input: DocumentCreateResponse[\"contentKeyBundle\"],\n): NonNullable<DocumentSyncRequest[\"contentKeyBundle\"]> {\n  const { documentId: _omit, ...bundle } = input;\n  return bundle;\n}\n\nasync function resolveDocumentSyncIdentity(\n  input: BuildDocumentSyncPlanInput,\n): Promise<{\n  documentId: string;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  organizationId: string;\n}> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.documentManifest,\n    label: \"Document sync manifest\",\n  });\n  const documentId = input.documentId ?? input.contentKeyBundle.documentId;\n  if (documentId.length === 0) {\n    throw new Error(\"Document sync document id is empty\");\n  }\n  if (\n    input.contentKeyBundle.documentId !== documentId ||\n    input.documentKekTargets.documentId !== documentId ||\n    manifestIdentity.documentId !== documentId\n  ) {\n    throw new Error(\"Document sync state document id mismatch\");\n  }\n  if (manifestIdentity.organizationId !== input.author.organizationId) {\n    throw new Error(\"Document sync author organization mismatch\");\n  }\n  if (\n    input.documentManifest.manifestHash !==\n      input.contentKeyBundle.linkSetManifestHash ||\n    input.documentKekTargets.linkSetManifestHash !==\n      input.contentKeyBundle.linkSetManifestHash\n  ) {\n    throw new Error(\"Document sync link manifest mismatch\");\n  }\n  if (\n    input.documentKekTargets.documentKeyTargetHash !==\n    input.contentKeyBundle.targetHash\n  ) {\n    throw new Error(\"Document sync target hash mismatch\");\n  }\n\n  const kekTargets = normalizeDocumentKekTargetResponse(\n    input.documentKekTargets,\n  );\n  const contentKeyTargets = sortDocumentTargets(\n    input.contentKeyBundle.targets.map(targetEnvelopeReference),\n  );\n  if (\n    serializeCanonical(kekTargets, \"KEK targets\") !==\n    serializeCanonical(contentKeyTargets, \"content-key targets\")\n  ) {\n    throw new Error(\"Document sync content-key targets mismatch\");\n  }\n\n  const targetHash = await computeDocumentContentKeyTargetHash(kekTargets);\n  if (targetHash !== input.contentKeyBundle.targetHash) {\n    throw new Error(\"Document sync target hash is not canonical\");\n  }\n\n  return {\n    documentId,\n    expectedLinkSetManifestHash: input.contentKeyBundle.linkSetManifestHash,\n    expectedTargetHash: input.contentKeyBundle.targetHash,\n    organizationId: manifestIdentity.organizationId,\n  };\n}\n\nfunction normalizeAuthorizingContainerPathRefs(\n  refs: readonly (readonly ContainerManifestRef[])[] | undefined,\n): ContainerManifestRef[][] {\n  if (!refs || refs.length === 0) {\n    throw new Error(\"Document sync write authorization path refs are missing\");\n  }\n\n  return refs.map((path, pathIndex) => {\n    if (path.length === 0) {\n      throw new Error(\n        `Document sync write authorization path[${pathIndex}] is empty`,\n      );\n    }\n    return [...path];\n  });\n}\n\nexport async function signDocumentOutgoingUpdate(input: {\n  authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  documentId: string;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  organizationId: string;\n  signedAt: string;\n  update: DocumentSyncPreparedUpdate;\n}): Promise<DocumentOutgoingUpdate> {\n  const contentRecordId = input.update.contentRecordId ?? input.update.id;\n  const nonceDomain = {\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId,\n  } as const;\n  const unsignedHeader: UnsignedWriteHeader = {\n    ...nonceDomain,\n    dependencyManifestHashes: [\n      ...new Set(\n        input.authorizingContainerPathRefs.flatMap((path) =>\n          path.map((ref) => ref.manifestHash),\n        ),\n      ),\n    ].sort(),\n    accessManifestHash: input.expectedLinkSetManifestHash,\n    targetHash: input.expectedTargetHash,\n    nonceDomainHash: await computeContentRecordNonceDomainHash(nonceDomain),\n    metadataHash: input.update.metadataHash,\n    ciphertextHash: input.update.ciphertextHash,\n    writerUserId: input.author.signerUserId,\n    writerDeviceId: input.author.signerDeviceId,\n    writerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.update.signedAt ?? input.signedAt,\n  };\n  const writeHeader = await signWriteHeader(\n    unsignedHeader,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    encryptedData: input.update.encryptedData,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    plaintextHash: input.update.plaintextHash,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    writeHeader: readCanonicalRecord(\n      writeHeader,\n      \"Document outgoing write header\",\n    ),\n  };\n}\n\nfunction assertUniqueDocumentOutgoingUpdates(\n  updates: readonly DocumentSyncPreparedUpdate[],\n): void {\n  const updateIds = new Set<string>();\n  const contentRecordIds = new Set<string>();\n  for (const update of updates) {\n    if (updateIds.has(update.id)) {\n      throw new Error(\"Document sync update id is duplicated\");\n    }\n    updateIds.add(update.id);\n\n    const contentRecordId = (update.contentRecordId ?? update.id).toLowerCase();\n    if (contentRecordIds.has(contentRecordId)) {\n      throw new Error(\"Document sync content record id is duplicated\");\n    }\n    contentRecordIds.add(contentRecordId);\n  }\n}\n\nfunction assertDocumentSyncRequestMode(\n  input: BuildDocumentSyncPlanInput,\n  hasContainerRekeys: boolean,\n  hasOutgoingUpdates: boolean,\n): void {\n  if (input.historyMode === \"raw\" && input.localVersionVector !== null) {\n    throw new Error(\n      \"Document raw-history sync must start from a null version vector\",\n    );\n  }\n  const hasWrites = hasOutgoingUpdates || hasContainerRekeys;\n  if (input.historyMode === \"raw\" && hasWrites) {\n    throw new Error(\"Document raw-history sync must be read-only\");\n  }\n  if (input.pullCursor !== undefined && hasWrites) {\n    throw new Error(\"Document sync continuation must be read-only\");\n  }\n  if (hasContainerRekeys && !hasOutgoingUpdates) {\n    throw new Error(\n      \"Document sync container rekeys require an outgoing update\",\n    );\n  }\n  if (hasContainerRekeys !== (input.inlineRekeyCommitId !== undefined)) {\n    throw new Error(\n      \"Document sync inline rekey commit id must accompany container rekeys\",\n    );\n  }\n}\n\nexport async function buildDocumentSyncPlan(\n  input: BuildDocumentSyncPlanInput,\n): Promise<DocumentSyncPlan> {\n  const {\n    documentId,\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    organizationId,\n  } = await resolveDocumentSyncIdentity(input);\n  const containerRekeys = [...(input.containerRekeys ?? [])];\n  const outgoingUpdateInputs = [...(input.outgoingUpdates ?? [])];\n  assertDocumentSyncRequestMode(\n    input,\n    containerRekeys.length > 0,\n    outgoingUpdateInputs.length > 0,\n  );\n  const signedAt = input.signedAt ?? new Date().toISOString();\n  assertUniqueDocumentOutgoingUpdates(outgoingUpdateInputs);\n\n  const outgoingUpdates = await Promise.all(\n    outgoingUpdateInputs.map((update) =>\n      signDocumentOutgoingUpdate({\n        authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(\n          input.authorizingContainerPathRefs,\n        ),\n        author: input.author,\n        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n        documentId,\n        expectedLinkSetManifestHash,\n        expectedTargetHash,\n        organizationId,\n        signedAt,\n        update,\n      }),\n    ),\n  );\n  // Writes always carry the verified current content-key bundle so the server\n  // can validate and materialize the current wrapping material in the same\n  // request. Read-only syncs omit it because they do not update server state.\n  const shouldIncludeContentKeyBundle = outgoingUpdates.length > 0;\n  const request: DocumentSyncRequest = {\n    ...(shouldIncludeContentKeyBundle\n      ? {\n          contentKeyBundle: contentKeyBundleForSyncRequest(\n            input.contentKeyBundle,\n          ),\n        }\n      : {}),\n    ...(containerRekeys.length === 0 ? {} : { containerRekeys }),\n    contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n    ...(outgoingUpdates.length === 0\n      ? {}\n      : {\n          authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(\n            input.authorizingContainerPathRefs,\n          ),\n        }),\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    ...(input.historyMode === undefined\n      ? {}\n      : { historyMode: input.historyMode }),\n    ...(input.inlineRekeyCommitId === undefined\n      ? {}\n      : { inlineRekeyCommitId: input.inlineRekeyCommitId }),\n    localVersionVector: input.localVersionVector,\n    ...(input.minLsn === undefined ? {} : { minLsn: input.minLsn }),\n    outgoingUpdates,\n    ...(input.pullCursor === undefined ? {} : { pullCursor: input.pullCursor }),\n    supportsPullPagination: true,\n  };\n\n  return {\n    contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n    documentId,\n    documentKekTargets: input.documentKekTargets,\n    documentManifest: input.documentManifest,\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    minLsn: input.minLsn,\n    organizationId,\n    request,\n    sourceContentKeyBundle: input.contentKeyBundle,\n  };\n}\n"]}

package/workflows/documents/syncPlan/syncPlanMaterial.js

@@ -0,0 +1,306 @@
+import { emptyVersionVector, getImportBlobMetadata, satisfiesVersionVector, versionVectorsEqual, } from "../../../internal/loro/index.js";
+import { documentKekTargetsFromContentKeyBundle } from "../../../internal/validators/response/index.js";
+import { createPendingUpdateFields } from "../../../data/documents/documentSync.js";
+import { assertDocumentKekPathsCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
+import { assertDocumentWriterProjectionConsistent, authorizingContainerPathRefs, buildRotatedDocumentContentKeyBundle, ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { selectDocumentSyncOutgoingBatch } from "../../../data/sync/documentSyncOutgoingBatch.js";
+import { traceCheckpointRegeneration, traceHealBlocked, traceHealPlanned, traceStaleBundle, traceStaleRead, } from "../sync/syncTrace.js";
+import { prepareDocumentOutgoingUpdates } from "./syncContentKeys.js";
+import { buildDocumentSyncPlan } from "./syncPlanIdentity.js";
+import { finalizeMaterializedDocumentSyncPlan } from "./syncPlanProjection.js";
+/**
+ * Builds the rotation baseline that anchors a stale-bundle heal: a full
+ * history snapshot of the local document, re-encrypted under the fresh
+ * content key so every current member (including post-rotation newcomers)
+ * has an efficient current-epoch redirect. Predecessor KEKs remain the
+ * correctness path when no covering baseline exists.
+ */
+async function buildStaleRecoveryBaselinePendingUpdate(buildRotationSnapshot) {
+    const snapshot = buildRotationSnapshot ? await buildRotationSnapshot() : null;
+    if (!snapshot) {
+        throw new Error("Document content-key bundle is stale and no rotation snapshot is available to heal it");
+    }
+    const metadata = getImportBlobMetadata(snapshot);
+    if (metadata.mode !== "snapshot" ||
+        !versionVectorsEqual(metadata.partialStartVersionVector, emptyVersionVector())) {
+        throw new Error("Document stale-bundle recovery requires a full-history rotation snapshot");
+    }
+    const pendingFields = createPendingUpdateFields(snapshot, metadata.partialEndVersionVector);
+    if (!pendingFields) {
+        throw new Error("Document stale-bundle recovery snapshot is empty");
+    }
+    return {
+        id: crypto.randomUUID(),
+        ...pendingFields,
+    };
+}
+/**
+ * Resolves the content material a sync plan encrypts and carries. A stale
+ * bundle names predecessor KEK targets while the document's current targets
+ * name successor epochs, so it splits by intent: a write-bearing pass heals
+ * the document with a FRESH content key at the next epoch, anchored by a
+ * covering rotation baseline, while a read-only pass keeps the stale pair and
+ * unwraps it through predecessor KEKs so the server can settle a complete pull.
+ */
+/**
+ * The manifest bundle a stale read-only plan must pair with: the one the
+ * stale content-key bundle actually references. A stale bundle normally
+ * still carries the current link-set manifest hash (KEK rotations do not
+ * advance the document manifest), but the projection consistency check
+ * defensively admits a bundle lagging the head as long as it appears in the
+ * manifest history — pair with that historical bundle so the plan's own
+ * identity checks hold.
+ */
+function staleBundleDocumentManifest(writerProjection) {
+    const { contentKeyBundle, documentManifest } = writerProjection;
+    if (contentKeyBundle.linkSetManifestHash === documentManifest.manifestHash) {
+        return documentManifest;
+    }
+    const historicalManifest = writerProjection.documentManifestHistory.find((bundle) => bundle.manifestHash === contentKeyBundle.linkSetManifestHash);
+    if (!historicalManifest) {
+        throw new Error("Document stale bundle manifest is missing from the projection history");
+    }
+    return historicalManifest;
+}
+/**
+ * Settling a superseded checkpoint deletes its queue row, so the fresh
+ * baseline must PROVABLY subsume it — assumed coverage would silently drop
+ * any ops the checkpoint alone carried.
+ */
+function assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, checkpoints) {
+    for (const checkpoint of checkpoints) {
+        if (!satisfiesVersionVector(recoveryBaseline.partialEndVersionVector, checkpoint.partialEndVersionVector)) {
+            throw new Error("Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint");
+        }
+    }
+}
+async function resolveStaleHealMaterial(input, containerKeksByEpochId, pendingUpdates) {
+    const contentKey = crypto.getRandomValues(new Uint8Array(32));
+    // A rotation checkpoint left in the queue by an interrupted earlier
+    // recovery is superseded by the fresh covering baseline built below:
+    // submitting it alongside would trip the server's covering-baseline gate,
+    // and resubmitting it after the heal could become the latest baseline at
+    // the healed epoch and mask the covering one. Hold it out of the request;
+    // on heal success its id is reported settled (the committed baseline
+    // subsumes its full-history content) so the queue row is removed.
+    //
+    // A heal whose OWN baseline does not cover the committed frontier is
+    // rejected by that same gate and surfaces as a terminal queue failure.
+    // This write-bearing pass does not pull first. A device missing committed
+    // history can independently rematerialize it through predecessor KEKs on a
+    // read-only pass, then retry with a covering snapshot. The coverage proof
+    // prevents a partial local view from becoming the redirect baseline.
+    const ordinaryPendingUpdates = pendingUpdates.filter((update) => update.sourceVersionVector == null);
+    const heldBackCheckpoints = pendingUpdates.filter((update) => update.sourceVersionVector != null);
+    const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(input.buildRotationSnapshot);
+    const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(ordinaryPendingUpdates, {
+        reservedDataCharacters: recoveryBaseline.updateData.length,
+        reservedUpdateCount: 1,
+    });
+    assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, heldBackCheckpoints);
+    const staleEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch;
+    const contentKeyBundle = await buildRotatedDocumentContentKeyBundle({
+        containerKeksByEpochId,
+        contentKey,
+        writerProjection: input.writerProjection,
+    });
+    traceHealPlanned(input.onSyncTrace, {
+        documentId: input.writerProjection.documentId,
+        fromEpoch: staleEpoch,
+        heldBack: heldBackCheckpoints.length,
+        toEpoch: contentKeyBundle.contentKeyEpoch,
+        updates: selectedOrdinaryPendingUpdates.length,
+    });
+    return {
+        contentKey,
+        contentKeyBundle,
+        documentKekTargets: input.writerProjection.documentKekTargets,
+        documentManifest: input.writerProjection.documentManifest,
+        healedStaleContentKeyBundle: true,
+        heldBackPendingUpdateIds: heldBackCheckpoints.map((update) => update.id),
+        pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],
+        staleRecoveryBaselineUpdateId: recoveryBaseline.id,
+    };
+}
+/**
+ * Reactive repair for a healthy-projection pass whose queued rotation
+ * checkpoint the server rejected via the covering-baseline gate (a leftover
+ * from an interrupted recovery, a heal whose ack was lost, or a lost heal
+ * race). Queued checkpoints normally pass through untouched — reset and
+ * rotation flows legitimately submit them — but a rejected one would strand
+ * the whole queue, and committing it could shrink redirect coverage. Replace
+ * the stale checkpoints with one freshly regenerated covering baseline and
+ * settle them on success (coverage proven above).
+ */
+async function resolveCheckpointRegenerationMaterial(input, base, pendingUpdates) {
+    const ordinaryPendingUpdates = pendingUpdates.filter((update) => update.sourceVersionVector == null);
+    const queuedCheckpoints = pendingUpdates.filter((update) => update.sourceVersionVector != null);
+    const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(input.buildRotationSnapshot);
+    const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(ordinaryPendingUpdates, {
+        reservedDataCharacters: recoveryBaseline.updateData.length,
+        reservedUpdateCount: 1,
+    });
+    assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, queuedCheckpoints);
+    traceCheckpointRegeneration(input.onSyncTrace, {
+        checkpoints: queuedCheckpoints.length,
+        documentId: input.writerProjection.documentId,
+        updates: selectedOrdinaryPendingUpdates.length,
+    });
+    return {
+        ...base,
+        heldBackPendingUpdateIds: queuedCheckpoints.map((update) => update.id),
+        pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],
+        staleRecoveryBaselineUpdateId: recoveryBaseline.id,
+    };
+}
+async function resolveSyncPlanContentMaterial(input, collectedKeks) {
+    const allPendingUpdates = input.pendingUpdates ?? [];
+    if (allPendingUpdates.length > 0 || input.regenerateQueuedCheckpoints) {
+        assertDocumentKekPathsCurrent(input.writerProjection);
+    }
+    const staleContentKeyBundle = input.writerProjection.contentKeyBundleStale === true;
+    if (staleContentKeyBundle && allPendingUpdates.length > 0) {
+        traceStaleBundle(input.onSyncTrace, {
+            documentId: input.writerProjection.documentId,
+            epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,
+            pending: allPendingUpdates.length,
+        });
+        return resolveStaleHealMaterial(input, collectedKeks.keksByEpochId, allPendingUpdates);
+    }
+    const pendingUpdates = selectDocumentSyncOutgoingBatch(allPendingUpdates);
+    if (staleContentKeyBundle) {
+        traceStaleRead(input.onSyncTrace, {
+            documentId: input.writerProjection.documentId,
+            epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,
+        });
+        // Current access includes every predecessor KEK. If damaged history makes
+        // this old bundle unreachable, preserve the bridge-integrity failure: this
+        // read actually needs that historical epoch and cannot safely continue.
+        let staleContentKey;
+        try {
+            staleContentKey = await unwrapDocumentContentKeyFromBundle(input.writerProjection.contentKeyBundle, input.writerProjection.documentId, collectedKeks.keksByEpochId, collectedKeks.predecessorFailuresByEpochId, collectedKeks.unattributedPredecessorFailuresByContainerId);
+        }
+        catch (error) {
+            if (error instanceof DocumentHistoryUnavailableError) {
+                if (input.historyMode !== "raw" ||
+                    !(error.historyCause instanceof ContainerKekHistoryUnavailableError)) {
+                    throw error;
+                }
+            }
+            // A stale bundle can predate the requester's current authorizing links.
+            // Keep the read-only pass alive; served updates that need this absent key
+            // remain undecryptable until a spanning member heals the bundle.
+            staleContentKey = new Uint8Array();
+        }
+        return {
+            contentKey: staleContentKey,
+            contentKeyBundle: input.writerProjection.contentKeyBundle,
+            documentKekTargets: documentKekTargetsFromContentKeyBundle(input.writerProjection.contentKeyBundle),
+            documentManifest: staleBundleDocumentManifest(input.writerProjection),
+            healedStaleContentKeyBundle: false,
+            heldBackPendingUpdateIds: [],
+            pendingUpdates,
+        };
+    }
+    const normalMaterial = {
+        contentKey: await unwrapDocumentContentKeyFromBundle(input.writerProjection.contentKeyBundle, input.writerProjection.documentId, collectedKeks.keksByEpochId, collectedKeks.predecessorFailuresByEpochId, collectedKeks.unattributedPredecessorFailuresByContainerId),
+        contentKeyBundle: input.writerProjection.contentKeyBundle,
+        documentKekTargets: input.writerProjection.documentKekTargets,
+        documentManifest: input.writerProjection.documentManifest,
+        healedStaleContentKeyBundle: false,
+        heldBackPendingUpdateIds: [],
+        pendingUpdates,
+    };
+    if (input.regenerateQueuedCheckpoints === true &&
+        allPendingUpdates.some((update) => update.sourceVersionVector != null)) {
+        return resolveCheckpointRegenerationMaterial(input, normalMaterial, allPendingUpdates);
+    }
+    return normalMaterial;
+}
+export async function buildMaterializedDocumentSyncPlan(input) {
+    // Reuse verification across consistency and unwrap passes; unwrap still
+    // binds the key material independently.
+    const verifiedByHash = new Map();
+    const principalPolicyCache = new Map();
+    let writerAuthorization;
+    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
+        allowStaleContentKeyBundle: true,
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        onVerifiedAuthorization: (authorization) => {
+            writerAuthorization = authorization;
+        },
+        principalPolicyCache,
+        verifiedByHash,
+        ...projectionVerificationOptions(input),
+    });
+    const collectedKeks = await collectContainerKeksForDocumentSync({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache,
+        secretKey: input.targetSecretKey,
+        verifiedByHash,
+        writerProjection: input.writerProjection,
+        ...projectionVerificationOptions(input),
+    });
+    const documentId = input.writerProjection.documentId;
+    const manifestIdentity = await assertDocumentManifestBundleConsistent({
+        bundle: input.writerProjection.documentManifest,
+        label: "Document sync manifest",
+    });
+    let material;
+    try {
+        material = await resolveSyncPlanContentMaterial(input, collectedKeks);
+    }
+    catch (error) {
+        // Only a stale-bundle HEAL (write-bearing) or a checkpoint regeneration
+        // counts as a blocked recovery; an ordinary pass or a stale READ failing
+        // here must not read as one in a support report. Enumerated reason only;
+        // unknown errors emit nothing (fail closed).
+        if ((input.writerProjection.contentKeyBundleStale === true &&
+            (input.pendingUpdates ?? []).length > 0) ||
+            input.regenerateQueuedCheckpoints === true) {
+            traceHealBlocked(input.onSyncTrace, {
+                documentId: input.writerProjection.documentId,
+                error,
+            });
+        }
+        throw error;
+    }
+    const { contentKey, contentKeyBundle, documentKekTargets, documentManifest, pendingUpdates, } = material;
+    const outgoingUpdates = await prepareDocumentOutgoingUpdates({
+        contentKey,
+        contentKeyEpoch: contentKeyBundle.contentKeyEpoch,
+        documentId,
+        organizationId: manifestIdentity.organizationId,
+        pendingUpdates,
+    });
+    const basePlan = await buildDocumentSyncPlan({
+        author: {
+            ...input.author,
+            organizationId: manifestIdentity.organizationId,
+        },
+        authorizingContainerPathRefs: authorizingContainerPathRefs(input.writerProjection),
+        containerRekeys: input.containerRekeys,
+        contentKeyBundle,
+        documentId,
+        documentKekTargets,
+        documentManifest,
+        historyMode: input.historyMode,
+        inlineRekeyCommitId: input.inlineRekeyCommitId,
+        localVersionVector: input.localVersionVector,
+        minLsn: input.minLsn,
+        outgoingUpdates,
+        pullCursor: input.pullCursor,
+        signedAt: input.signedAt,
+    });
+    return finalizeMaterializedDocumentSyncPlan({
+        basePlan,
+        material,
+        writerAuthorization,
+        writerProjection: input.writerProjection,
+    });
+}
+//# sourceMappingURL=syncPlanMaterial.js.map

package/workflows/documents/syncPlan/syncPlanMaterial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPlanMaterial.js","sourceRoot":"","sources":["syncPlanMaterial.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,sCAAsC,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EACL,wCAAwC,EACxC,4BAA4B,EAC5B,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AAOhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAIrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAEL,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;GAMG;AACH,KAAK,UAAU,uCAAuC,CACpD,qBAAqE;IAErE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;QAC5B,CAAC,mBAAmB,CAClB,QAAQ,CAAC,yBAAyB,EAClC,kBAAkB,EAAE,CACrB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAC7C,QAAQ,EACR,QAAQ,CAAC,uBAAuB,CACjC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAClC,gBAAkD;IAElD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC;IAChE,IAAI,gBAAgB,CAAC,mBAAmB,KAAK,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CACtE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,gBAAgB,CAAC,mBAAmB,CACzE,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,uCAAuC,CAC9C,gBAAqC,EACrC,WAA2C;IAE3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,sBAAsB,CACrB,gBAAgB,CAAC,uBAAuB,EACxC,UAAU,CAAC,uBAAuB,CACnC,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,wBAAwB,CACrC,KAA8D,EAC9D,sBAAuD,EACvD,cAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAC/C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CACrC,gBAAgB,EAChB,mBAAmB,CACpB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC3E,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,sBAAsB;QACtB,UAAU;QACV,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,mBAAmB,CAAC,MAAM;QACpC,OAAO,EAAE,gBAAgB,CAAC,eAAe;QACzC,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,gBAAgB;QAChB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,IAAI;QACjC,wBAAwB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAA8D,EAC9D,IAAqC,EACrC,cAA8C;IAE9C,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,2BAA2B,CAAC,KAAK,CAAC,WAAW,EAAE;QAC7C,WAAW,EAAE,iBAAiB,CAAC,MAAM;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,wBAAwB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA8D,EAC9D,aAEC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IACrD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtE,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAExD,IAAI,qBAAqB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;YAC9D,OAAO,EAAE,iBAAiB,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAC7B,KAAK,EACL,aAAa,CAAC,aAAa,EAC3B,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,CAAC;IAE1E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE;YAChC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;SAC/D,CAAC,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;gBACrD,IACE,KAAK,CAAC,WAAW,KAAK,KAAK;oBAC3B,CAAC,CAAC,KAAK,CAAC,YAAY,YAAY,mCAAmC,CAAC,EACpE,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,eAAe,GAAG,IAAI,UAAU,EAAE,CAAC;QACrC,CAAC;QACD,OAAO;YACL,UAAU,EAAE,eAAe;YAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;YACzD,kBAAkB,EAAE,sCAAsC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CACxC;YACD,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACrE,2BAA2B,EAAE,KAAK;YAClC,wBAAwB,EAAE,EAAE;YAC5B,cAAc;SACf,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAoC;QACtD,UAAU,EAAE,MAAM,kCAAkC,CAClD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,KAAK;QAClC,wBAAwB,EAAE,EAAE;QAC5B,cAAc;KACf,CAAC;IACF,IACE,KAAK,CAAC,2BAA2B,KAAK,IAAI;QAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,EACtE,CAAC;QACD,OAAO,qCAAqC,CAC1C,KAAK,EACL,cAAc,EACd,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KA6BiC;IAEjC,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxE,IAAI,mBAAsE,CAAC;IAC3E,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,mBAAmB,GAAG,aAAa,CAAC;QACtC,CAAC;QACD,oBAAoB;QACpB,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB;QACpB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,wBAAwB;KAChC,CAAC,CAAC;IACH,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,6CAA6C;QAC7C,IACE,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI;YACpD,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,KAAK,CAAC,2BAA2B,KAAK,IAAI,EAC1C,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;gBAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EACJ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,GAAG,QAAQ,CAAC;IACb,MAAM,eAAe,GAAG,MAAM,8BAA8B,CAAC;QAC3D,UAAU;QACV,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,UAAU;QACV,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,cAAc;KACf,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD;QACD,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB;QAChB,UAAU;QACV,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,oCAAoC,CAAC;QAC1C,QAAQ;QACR,QAAQ;QACR,mBAAmB;QACnB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  VerifiedContainerAccessManifest,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport {\n  emptyVersionVector,\n  getImportBlobMetadata,\n  satisfiesVersionVector,\n  versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type {\n  DocumentCreateResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { documentKekTargetsFromContentKeyBundle } from \"@tearleads/validators/response\";\nimport { createPendingUpdateFields } from \"../../../data/documents/documentSync\";\nimport { assertDocumentKekPathsCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  authorizingContainerPathRefs,\n  buildRotatedDocumentContentKeyBundle,\n  ContainerKekHistoryUnavailableError,\n  collectContainerKeksForDocumentSync,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n} from \"../../../data/documents/shared/projection\";\nimport { assertDocumentManifestBundleConsistent } from \"../../../data/documents/shared/readers\";\nimport type {\n  BuildDocumentSyncPlanInput,\n  DocumentCreateAuthor,\n  MaterializedDocumentSyncPlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { selectDocumentSyncOutgoingBatch } from \"../../../data/sync/documentSyncOutgoingBatch\";\nimport {\n  type DocumentSyncTraceEmitter,\n  traceCheckpointRegeneration,\n  traceHealBlocked,\n  traceHealPlanned,\n  traceStaleBundle,\n  traceStaleRead,\n} from \"../sync/syncTrace\";\nimport { prepareDocumentOutgoingUpdates } from \"./syncContentKeys\";\nimport { buildDocumentSyncPlan } from \"./syncPlanIdentity\";\nimport { finalizeMaterializedDocumentSyncPlan } from \"./syncPlanProjection\";\n\n/**\n * Builds the rotation baseline that anchors a stale-bundle heal: a full\n * history snapshot of the local document, re-encrypted under the fresh\n * content key so every current member (including post-rotation newcomers)\n * has an efficient current-epoch redirect. Predecessor KEKs remain the\n * correctness path when no covering baseline exists.\n */\nasync function buildStaleRecoveryBaselinePendingUpdate(\n  buildRotationSnapshot: (() => Promise<Uint8Array | null>) | undefined,\n): Promise<PendingUpdateRecord> {\n  const snapshot = buildRotationSnapshot ? await buildRotationSnapshot() : null;\n  if (!snapshot) {\n    throw new Error(\n      \"Document content-key bundle is stale and no rotation snapshot is available to heal it\",\n    );\n  }\n  const metadata = getImportBlobMetadata(snapshot);\n  if (\n    metadata.mode !== \"snapshot\" ||\n    !versionVectorsEqual(\n      metadata.partialStartVersionVector,\n      emptyVersionVector(),\n    )\n  ) {\n    throw new Error(\n      \"Document stale-bundle recovery requires a full-history rotation snapshot\",\n    );\n  }\n  const pendingFields = createPendingUpdateFields(\n    snapshot,\n    metadata.partialEndVersionVector,\n  );\n  if (!pendingFields) {\n    throw new Error(\"Document stale-bundle recovery snapshot is empty\");\n  }\n\n  return {\n    id: crypto.randomUUID(),\n    ...pendingFields,\n  };\n}\n\n/**\n * Resolves the content material a sync plan encrypts and carries. A stale\n * bundle names predecessor KEK targets while the document's current targets\n * name successor epochs, so it splits by intent: a write-bearing pass heals\n * the document with a FRESH content key at the next epoch, anchored by a\n * covering rotation baseline, while a read-only pass keeps the stale pair and\n * unwraps it through predecessor KEKs so the server can settle a complete pull.\n */\n/**\n * The manifest bundle a stale read-only plan must pair with: the one the\n * stale content-key bundle actually references. A stale bundle normally\n * still carries the current link-set manifest hash (KEK rotations do not\n * advance the document manifest), but the projection consistency check\n * defensively admits a bundle lagging the head as long as it appears in the\n * manifest history — pair with that historical bundle so the plan's own\n * identity checks hold.\n */\nfunction staleBundleDocumentManifest(\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentCreateResponse[\"accessManifest\"] {\n  const { contentKeyBundle, documentManifest } = writerProjection;\n  if (contentKeyBundle.linkSetManifestHash === documentManifest.manifestHash) {\n    return documentManifest;\n  }\n  const historicalManifest = writerProjection.documentManifestHistory.find(\n    (bundle) => bundle.manifestHash === contentKeyBundle.linkSetManifestHash,\n  );\n  if (!historicalManifest) {\n    throw new Error(\n      \"Document stale bundle manifest is missing from the projection history\",\n    );\n  }\n  return historicalManifest;\n}\n\n/**\n * Settling a superseded checkpoint deletes its queue row, so the fresh\n * baseline must PROVABLY subsume it — assumed coverage would silently drop\n * any ops the checkpoint alone carried.\n */\nfunction assertRecoveryBaselineCoversCheckpoints(\n  recoveryBaseline: PendingUpdateRecord,\n  checkpoints: readonly PendingUpdateRecord[],\n): void {\n  for (const checkpoint of checkpoints) {\n    if (\n      !satisfiesVersionVector(\n        recoveryBaseline.partialEndVersionVector,\n        checkpoint.partialEndVersionVector,\n      )\n    ) {\n      throw new Error(\n        \"Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint\",\n      );\n    }\n  }\n}\n\ninterface ResolvedSyncPlanContentMaterial {\n  contentKey: Uint8Array;\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  healedStaleContentKeyBundle: boolean;\n  heldBackPendingUpdateIds: readonly string[];\n  pendingUpdates: readonly PendingUpdateRecord[];\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nasync function resolveStaleHealMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>,\n  pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const contentKey = crypto.getRandomValues(new Uint8Array(32));\n  // A rotation checkpoint left in the queue by an interrupted earlier\n  // recovery is superseded by the fresh covering baseline built below:\n  // submitting it alongside would trip the server's covering-baseline gate,\n  // and resubmitting it after the heal could become the latest baseline at\n  // the healed epoch and mask the covering one. Hold it out of the request;\n  // on heal success its id is reported settled (the committed baseline\n  // subsumes its full-history content) so the queue row is removed.\n  //\n  // A heal whose OWN baseline does not cover the committed frontier is\n  // rejected by that same gate and surfaces as a terminal queue failure.\n  // This write-bearing pass does not pull first. A device missing committed\n  // history can independently rematerialize it through predecessor KEKs on a\n  // read-only pass, then retry with a covering snapshot. The coverage proof\n  // prevents a partial local view from becoming the redirect baseline.\n  const ordinaryPendingUpdates = pendingUpdates.filter(\n    (update) => update.sourceVersionVector == null,\n  );\n  const heldBackCheckpoints = pendingUpdates.filter(\n    (update) => update.sourceVersionVector != null,\n  );\n  const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n    input.buildRotationSnapshot,\n  );\n  const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n    ordinaryPendingUpdates,\n    {\n      reservedDataCharacters: recoveryBaseline.updateData.length,\n      reservedUpdateCount: 1,\n    },\n  );\n  assertRecoveryBaselineCoversCheckpoints(\n    recoveryBaseline,\n    heldBackCheckpoints,\n  );\n  const staleEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch;\n  const contentKeyBundle = await buildRotatedDocumentContentKeyBundle({\n    containerKeksByEpochId,\n    contentKey,\n    writerProjection: input.writerProjection,\n  });\n  traceHealPlanned(input.onSyncTrace, {\n    documentId: input.writerProjection.documentId,\n    fromEpoch: staleEpoch,\n    heldBack: heldBackCheckpoints.length,\n    toEpoch: contentKeyBundle.contentKeyEpoch,\n    updates: selectedOrdinaryPendingUpdates.length,\n  });\n  return {\n    contentKey,\n    contentKeyBundle,\n    documentKekTargets: input.writerProjection.documentKekTargets,\n    documentManifest: input.writerProjection.documentManifest,\n    healedStaleContentKeyBundle: true,\n    heldBackPendingUpdateIds: heldBackCheckpoints.map((update) => update.id),\n    pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n    staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n  };\n}\n\n/**\n * Reactive repair for a healthy-projection pass whose queued rotation\n * checkpoint the server rejected via the covering-baseline gate (a leftover\n * from an interrupted recovery, a heal whose ack was lost, or a lost heal\n * race). Queued checkpoints normally pass through untouched — reset and\n * rotation flows legitimately submit them — but a rejected one would strand\n * the whole queue, and committing it could shrink redirect coverage. Replace\n * the stale checkpoints with one freshly regenerated covering baseline and\n * settle them on success (coverage proven above).\n */\nasync function resolveCheckpointRegenerationMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  base: ResolvedSyncPlanContentMaterial,\n  pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const ordinaryPendingUpdates = pendingUpdates.filter(\n    (update) => update.sourceVersionVector == null,\n  );\n  const queuedCheckpoints = pendingUpdates.filter(\n    (update) => update.sourceVersionVector != null,\n  );\n  const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n    input.buildRotationSnapshot,\n  );\n  const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n    ordinaryPendingUpdates,\n    {\n      reservedDataCharacters: recoveryBaseline.updateData.length,\n      reservedUpdateCount: 1,\n    },\n  );\n  assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, queuedCheckpoints);\n  traceCheckpointRegeneration(input.onSyncTrace, {\n    checkpoints: queuedCheckpoints.length,\n    documentId: input.writerProjection.documentId,\n    updates: selectedOrdinaryPendingUpdates.length,\n  });\n  return {\n    ...base,\n    heldBackPendingUpdateIds: queuedCheckpoints.map((update) => update.id),\n    pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n    staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n  };\n}\n\nasync function resolveSyncPlanContentMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  collectedKeks: Awaited<\n    ReturnType<typeof collectContainerKeksForDocumentSync>\n  >,\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const allPendingUpdates = input.pendingUpdates ?? [];\n  if (allPendingUpdates.length > 0 || input.regenerateQueuedCheckpoints) {\n    assertDocumentKekPathsCurrent(input.writerProjection);\n  }\n  const staleContentKeyBundle =\n    input.writerProjection.contentKeyBundleStale === true;\n\n  if (staleContentKeyBundle && allPendingUpdates.length > 0) {\n    traceStaleBundle(input.onSyncTrace, {\n      documentId: input.writerProjection.documentId,\n      epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n      pending: allPendingUpdates.length,\n    });\n    return resolveStaleHealMaterial(\n      input,\n      collectedKeks.keksByEpochId,\n      allPendingUpdates,\n    );\n  }\n\n  const pendingUpdates = selectDocumentSyncOutgoingBatch(allPendingUpdates);\n\n  if (staleContentKeyBundle) {\n    traceStaleRead(input.onSyncTrace, {\n      documentId: input.writerProjection.documentId,\n      epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n    });\n    // Current access includes every predecessor KEK. If damaged history makes\n    // this old bundle unreachable, preserve the bridge-integrity failure: this\n    // read actually needs that historical epoch and cannot safely continue.\n    let staleContentKey: Uint8Array;\n    try {\n      staleContentKey = await unwrapDocumentContentKeyFromBundle(\n        input.writerProjection.contentKeyBundle,\n        input.writerProjection.documentId,\n        collectedKeks.keksByEpochId,\n        collectedKeks.predecessorFailuresByEpochId,\n        collectedKeks.unattributedPredecessorFailuresByContainerId,\n      );\n    } catch (error) {\n      if (error instanceof DocumentHistoryUnavailableError) {\n        if (\n          input.historyMode !== \"raw\" ||\n          !(error.historyCause instanceof ContainerKekHistoryUnavailableError)\n        ) {\n          throw error;\n        }\n      }\n      // A stale bundle can predate the requester's current authorizing links.\n      // Keep the read-only pass alive; served updates that need this absent key\n      // remain undecryptable until a spanning member heals the bundle.\n      staleContentKey = new Uint8Array();\n    }\n    return {\n      contentKey: staleContentKey,\n      contentKeyBundle: input.writerProjection.contentKeyBundle,\n      documentKekTargets: documentKekTargetsFromContentKeyBundle(\n        input.writerProjection.contentKeyBundle,\n      ),\n      documentManifest: staleBundleDocumentManifest(input.writerProjection),\n      healedStaleContentKeyBundle: false,\n      heldBackPendingUpdateIds: [],\n      pendingUpdates,\n    };\n  }\n\n  const normalMaterial: ResolvedSyncPlanContentMaterial = {\n    contentKey: await unwrapDocumentContentKeyFromBundle(\n      input.writerProjection.contentKeyBundle,\n      input.writerProjection.documentId,\n      collectedKeks.keksByEpochId,\n      collectedKeks.predecessorFailuresByEpochId,\n      collectedKeks.unattributedPredecessorFailuresByContainerId,\n    ),\n    contentKeyBundle: input.writerProjection.contentKeyBundle,\n    documentKekTargets: input.writerProjection.documentKekTargets,\n    documentManifest: input.writerProjection.documentManifest,\n    healedStaleContentKeyBundle: false,\n    heldBackPendingUpdateIds: [],\n    pendingUpdates,\n  };\n  if (\n    input.regenerateQueuedCheckpoints === true &&\n    allPendingUpdates.some((update) => update.sourceVersionVector != null)\n  ) {\n    return resolveCheckpointRegenerationMaterial(\n      input,\n      normalMaterial,\n      allPendingUpdates,\n    );\n  }\n\n  return normalMaterial;\n}\n\nexport async function buildMaterializedDocumentSyncPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    /**\n     * Supplies a full-history Loro snapshot of the local document when a\n     * stale content-key bundle must be healed, or when a leftover queued\n     * rotation checkpoint must be regenerated as a covering baseline.\n     * Without it those passes fail with a descriptive error instead.\n     */\n    buildRotationSnapshot?: (() => Promise<Uint8Array | null>) | undefined;\n    containerRekeys?: BuildDocumentSyncPlanInput[\"containerRekeys\"];\n    execSql?: ExecSql | undefined;\n    historyMode?: \"raw\" | undefined;\n    inlineRekeyCommitId?: string | undefined;\n    localVersionVector: string | null;\n    minLsn?: string | undefined;\n    pullCursor?: string | undefined;\n    /** Clipboard-safe trace sink (see syncTrace.ts); never receives content. */\n    onSyncTrace?: DocumentSyncTraceEmitter | undefined;\n    pendingUpdates?: readonly PendingUpdateRecord[] | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    /**\n     * Replace queued rotation checkpoints with a freshly regenerated covering\n     * baseline instead of passing them through. Set by the sync loop after\n     * the server rejected a pass via the covering-baseline gate.\n     */\n    regenerateQueuedCheckpoints?: boolean | undefined;\n    signedAt?: string | undefined;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentSyncPlan> {\n  // Reuse verification across consistency and unwrap passes; unwrap still\n  // binds the key material independently.\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache = new Map<string, VerifiedPrincipalPolicy>();\n  let writerAuthorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    allowStaleContentKeyBundle: true,\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    onVerifiedAuthorization: (authorization) => {\n      writerAuthorization = authorization;\n    },\n    principalPolicyCache,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const collectedKeks = await collectContainerKeksForDocumentSync({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  const documentId = input.writerProjection.documentId;\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document sync manifest\",\n  });\n  let material: ResolvedSyncPlanContentMaterial;\n  try {\n    material = await resolveSyncPlanContentMaterial(input, collectedKeks);\n  } catch (error) {\n    // Only a stale-bundle HEAL (write-bearing) or a checkpoint regeneration\n    // counts as a blocked recovery; an ordinary pass or a stale READ failing\n    // here must not read as one in a support report. Enumerated reason only;\n    // unknown errors emit nothing (fail closed).\n    if (\n      (input.writerProjection.contentKeyBundleStale === true &&\n        (input.pendingUpdates ?? []).length > 0) ||\n      input.regenerateQueuedCheckpoints === true\n    ) {\n      traceHealBlocked(input.onSyncTrace, {\n        documentId: input.writerProjection.documentId,\n        error,\n      });\n    }\n    throw error;\n  }\n  const {\n    contentKey,\n    contentKeyBundle,\n    documentKekTargets,\n    documentManifest,\n    pendingUpdates,\n  } = material;\n  const outgoingUpdates = await prepareDocumentOutgoingUpdates({\n    contentKey,\n    contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n    documentId,\n    organizationId: manifestIdentity.organizationId,\n    pendingUpdates,\n  });\n  const basePlan = await buildDocumentSyncPlan({\n    author: {\n      ...input.author,\n      organizationId: manifestIdentity.organizationId,\n    },\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.writerProjection,\n    ),\n    containerRekeys: input.containerRekeys,\n    contentKeyBundle,\n    documentId,\n    documentKekTargets,\n    documentManifest,\n    historyMode: input.historyMode,\n    inlineRekeyCommitId: input.inlineRekeyCommitId,\n    localVersionVector: input.localVersionVector,\n    minLsn: input.minLsn,\n    outgoingUpdates,\n    pullCursor: input.pullCursor,\n    signedAt: input.signedAt,\n  });\n  return finalizeMaterializedDocumentSyncPlan({\n    basePlan,\n    material,\n    writerAuthorization,\n    writerProjection: input.writerProjection,\n  });\n}\n"]}

package/workflows/documents/syncPlan/syncPlanProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPlanProjection.js","sourceRoot":"","sources":["syncPlanProjection.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAYjC,SAAS,mCAAmC,CAC1C,QAAoC,EACpC,gBAAkD;IAElD,IAAI,CAAC,QAAQ,CAAC,2BAA2B;QAAE,OAAO,gBAAgB,CAAC;IACnE,MAAM,gBAAgB,GAAG;QACvB,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC;IACF,OAAO,gBAAgB,CAAC,qBAAqB,CAAC;IAC9C,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAOpD;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,mBAAmB;QAC7C,CAAC,CAAC;YACE,GAAG,KAAK,CAAC,QAAQ;YACjB,2BAA2B,EAAE,KAAK,CAAC,mBAAmB;SACvD;QACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,4BAA4B,CACvC,aAAa,EACb,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAC7C,CAAC;IACF,OAAO,4BAA4B,CACjC,KAAK,CAAC,QAAQ,EACd,IAAI,EACJ,mCAAmC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAC5E,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  DocumentCreateResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  DocumentSyncPlan,\n  MaterializedDocumentSyncPlan,\n} from \"../../../data/documents/shared/types\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport {\n  boundDocumentSyncPlanRequest,\n  materializedDocumentSyncPlan,\n} from \"./syncPlanRequestBounds\";\n\ninterface SyncPlanProjectionMaterial {\n  readonly contentKey: Uint8Array;\n  readonly contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  readonly documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  readonly documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  readonly healedStaleContentKeyBundle: boolean;\n  readonly heldBackPendingUpdateIds: readonly string[];\n  readonly staleRecoveryBaselineUpdateId?: string | undefined;\n}\n\nfunction writerProjectionAfterContentKeyHeal(\n  material: SyncPlanProjectionMaterial,\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentWriterProjectionResponse {\n  if (!material.healedStaleContentKeyBundle) return writerProjection;\n  const healedProjection = {\n    ...writerProjection,\n    contentKeyBundle: material.contentKeyBundle,\n    documentKekTargets: material.documentKekTargets,\n    documentManifest: material.documentManifest,\n  };\n  delete healedProjection.contentKeyBundleStale;\n  return healedProjection;\n}\n\nexport function finalizeMaterializedDocumentSyncPlan(input: {\n  readonly basePlan: DocumentSyncPlan;\n  readonly material: SyncPlanProjectionMaterial;\n  readonly writerAuthorization:\n    | DocumentWriterProjectionAuthorization\n    | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): MaterializedDocumentSyncPlan {\n  const unboundedPlan = input.writerAuthorization\n    ? {\n        ...input.basePlan,\n        documentWriterAuthorization: input.writerAuthorization,\n      }\n    : input.basePlan;\n  const plan = boundDocumentSyncPlanRequest(\n    unboundedPlan,\n    input.material.staleRecoveryBaselineUpdateId,\n  );\n  return materializedDocumentSyncPlan(\n    input.material,\n    plan,\n    writerProjectionAfterContentKeyHeal(input.material, input.writerProjection),\n  );\n}\n"]}

package/workflows/documents/syncPlan/syncPlanRequestBounds.js

@@ -0,0 +1,54 @@
+import { limitDocumentSyncRequestBytes } from "../../../data/sync/documentSyncOutgoingBatch.js";
+export function boundDocumentSyncPlanRequest(plan, requiredOutgoingUpdateId) {
+    const request = limitDocumentSyncRequestBytes(plan.request, {
+        requiredOutgoingUpdateId,
+    });
+    return request === plan.request ? plan : { ...plan, request };
+}
+export function materializedDocumentSyncPlan(material, plan, writerProjection) {
+    return {
+        contentKey: material.contentKey,
+        healedStaleContentKeyBundle: material.healedStaleContentKeyBundle,
+        heldBackPendingUpdateIds: material.heldBackPendingUpdateIds,
+        plan,
+        writerProjection,
+        ...(material.staleRecoveryBaselineUpdateId === undefined
+            ? {}
+            : {
+                staleRecoveryBaselineUpdateId: material.staleRecoveryBaselineUpdateId,
+            }),
+    };
+}
+export function recoverablePendingUpdates(pendingUpdates, materializedPlan) {
+    const submittedIds = new Set(materializedPlan.plan.request.outgoingUpdates.map((update) => update.id));
+    const recoverableIds = new Set([
+        ...submittedIds,
+        ...materializedPlan.heldBackPendingUpdateIds,
+    ]);
+    return pendingUpdates.filter((update) => recoverableIds.has(update.id));
+}
+export function hasDeferredPendingUpdatesAfterSubmit(input) {
+    if (input.exhaustedPendingUpdateCount > 0) {
+        return false;
+    }
+    const madeDurableProgress = input.acceptedRecoveryBaseline ||
+        input.settledPendingUpdateIds.length > 0 ||
+        input.rekeyedPendingUpdateIds.length > 0;
+    if (!madeDurableProgress) {
+        return false;
+    }
+    const settledPendingUpdateIds = new Set(input.settledPendingUpdateIds);
+    return (input.rekeyedPendingUpdateIds.length > 0 ||
+        input.pendingUpdateIds.some((updateId) => !settledPendingUpdateIds.has(updateId)));
+}
+export function responseAcceptedRecoveryBaseline(materializedPlan, response) {
+    const recoveryBaselineId = materializedPlan.staleRecoveryBaselineUpdateId;
+    return (recoveryBaselineId !== undefined &&
+        response.acceptedOutgoingUpdateIds.includes(recoveryBaselineId));
+}
+export function acceptedHeldBackPendingUpdateIds(materializedPlan, response) {
+    return responseAcceptedRecoveryBaseline(materializedPlan, response)
+        ? materializedPlan.heldBackPendingUpdateIds
+        : [];
+}
+//# sourceMappingURL=syncPlanRequestBounds.js.map

package/workflows/documents/syncPlan/syncPlanRequestBounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPlanRequestBounds.js","sourceRoot":"","sources":["syncPlanRequestBounds.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAS7F,MAAM,UAAU,4BAA4B,CAC1C,IAA0C,EAC1C,wBAA4C;IAE5C,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,EAAE;QAC1D,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAA0B,EAC1B,IAA0C,EAC1C,gBAAkE;IAElE,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;QAC3D,IAAI;QACJ,gBAAgB;QAChB,GAAG,CAAC,QAAQ,CAAC,6BAA6B,KAAK,SAAS;YACtD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;aACtE,CAAC;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,cAA8C,EAC9C,gBAA8C;IAE9C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CACzE,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,GAAG,YAAY;QACf,GAAG,gBAAgB,CAAC,wBAAwB;KAC7C,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,mBAAmB,GACvB,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvE,OAAO,CACL,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CACzB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,gBAA8C,EAC9C,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,6BAA6B,CAAC;IAC1E,OAAO,CACL,kBAAkB,KAAK,SAAS;QAChC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,gBAA8C,EAC9C,QAA8B;IAE9B,OAAO,gCAAgC,CAAC,gBAAgB,EAAE,QAAQ,CAAC;QACjE,CAAC,CAAC,gBAAgB,CAAC,wBAAwB;QAC3C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC","sourcesContent":["import type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedDocumentSyncPlan } from \"../../../data/documents/shared/types\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport { limitDocumentSyncRequestBytes } from \"../../../data/sync/documentSyncOutgoingBatch\";\n\ninterface SyncPlanMaterial {\n  readonly contentKey: Uint8Array;\n  readonly healedStaleContentKeyBundle: boolean;\n  readonly heldBackPendingUpdateIds: readonly string[];\n  readonly staleRecoveryBaselineUpdateId?: string | undefined;\n}\n\nexport function boundDocumentSyncPlanRequest(\n  plan: MaterializedDocumentSyncPlan[\"plan\"],\n  requiredOutgoingUpdateId: string | undefined,\n): MaterializedDocumentSyncPlan[\"plan\"] {\n  const request = limitDocumentSyncRequestBytes(plan.request, {\n    requiredOutgoingUpdateId,\n  });\n  return request === plan.request ? plan : { ...plan, request };\n}\n\nexport function materializedDocumentSyncPlan(\n  material: SyncPlanMaterial,\n  plan: MaterializedDocumentSyncPlan[\"plan\"],\n  writerProjection: MaterializedDocumentSyncPlan[\"writerProjection\"],\n): MaterializedDocumentSyncPlan {\n  return {\n    contentKey: material.contentKey,\n    healedStaleContentKeyBundle: material.healedStaleContentKeyBundle,\n    heldBackPendingUpdateIds: material.heldBackPendingUpdateIds,\n    plan,\n    writerProjection,\n    ...(material.staleRecoveryBaselineUpdateId === undefined\n      ? {}\n      : {\n          staleRecoveryBaselineUpdateId: material.staleRecoveryBaselineUpdateId,\n        }),\n  };\n}\n\nexport function recoverablePendingUpdates(\n  pendingUpdates: readonly PendingUpdateRecord[],\n  materializedPlan: MaterializedDocumentSyncPlan,\n): PendingUpdateRecord[] {\n  const submittedIds = new Set(\n    materializedPlan.plan.request.outgoingUpdates.map((update) => update.id),\n  );\n  const recoverableIds = new Set([\n    ...submittedIds,\n    ...materializedPlan.heldBackPendingUpdateIds,\n  ]);\n  return pendingUpdates.filter((update) => recoverableIds.has(update.id));\n}\n\nexport function hasDeferredPendingUpdatesAfterSubmit(input: {\n  acceptedRecoveryBaseline: boolean;\n  exhaustedPendingUpdateCount: number;\n  pendingUpdateIds: readonly string[];\n  rekeyedPendingUpdateIds: readonly string[];\n  settledPendingUpdateIds: readonly string[];\n}): boolean {\n  if (input.exhaustedPendingUpdateCount > 0) {\n    return false;\n  }\n\n  const madeDurableProgress =\n    input.acceptedRecoveryBaseline ||\n    input.settledPendingUpdateIds.length > 0 ||\n    input.rekeyedPendingUpdateIds.length > 0;\n  if (!madeDurableProgress) {\n    return false;\n  }\n\n  const settledPendingUpdateIds = new Set(input.settledPendingUpdateIds);\n  return (\n    input.rekeyedPendingUpdateIds.length > 0 ||\n    input.pendingUpdateIds.some(\n      (updateId) => !settledPendingUpdateIds.has(updateId),\n    )\n  );\n}\n\nexport function responseAcceptedRecoveryBaseline(\n  materializedPlan: MaterializedDocumentSyncPlan,\n  response: DocumentSyncResponse,\n): boolean {\n  const recoveryBaselineId = materializedPlan.staleRecoveryBaselineUpdateId;\n  return (\n    recoveryBaselineId !== undefined &&\n    response.acceptedOutgoingUpdateIds.includes(recoveryBaselineId)\n  );\n}\n\nexport function acceptedHeldBackPendingUpdateIds(\n  materializedPlan: MaterializedDocumentSyncPlan,\n  response: DocumentSyncResponse,\n): readonly string[] {\n  return responseAcceptedRecoveryBaseline(materializedPlan, response)\n    ? materializedPlan.heldBackPendingUpdateIds\n    : [];\n}\n"]}

package/workflows/documents/syncRekeys/syncAutomaticContainerRekeys.js

@@ -0,0 +1,119 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { MAX_INLINE_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
+import { ContainerAuthorAccessError } from "../../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError } from "../../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekTargetUnreachableError } from "../../../data/documents/shared/containerKekPath.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/documentContainerProjections.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { buildMaterializedContainerRekeyPlan } from "../../containers/child/rekey.js";
+import { DocumentAncestorRepairAbandonedError } from "../syncFailures/syncRepairAbandon.js";
+import { hasOtherLinkedWriteAccess } from "../syncFailures/syncRepairAccess.js";
+import { applyContainerRekeyPlan } from "./syncContainerRekeyProjection.js";
+function firstStaleContainer(projection) {
+    for (const path of documentContainerProjections(projection)) {
+        for (let index = 1; index < path.containerKeks.length; index += 1) {
+            const parent = path.containerKeks[index - 1];
+            const child = path.containerKeks[index];
+            if (!parent || !child)
+                throw new Error("Container KEK path is incomplete");
+            if (child.parentContainerKeyEpochId === parent.containerKeyEpochId) {
+                continue;
+            }
+            return {
+                isPathTarget: index === path.containerKeks.length - 1,
+                projection: {
+                    ...path,
+                    containerId: child.containerId,
+                    containerKeks: path.containerKeks.slice(0, index + 1),
+                    path: path.path.slice(0, index + 1),
+                },
+            };
+        }
+    }
+    return null;
+}
+/**
+ * The stale container is not this writer's to re-key: no wrap on the verified
+ * path opens it, or the signed path grants the signer no write access there.
+ * Both are judged against the path sliced at the stale container, so a grant
+ * held only further down never counts — exactly the API's `container.rekey`
+ * rule. Anything else (keyring damage, a forged path) stays an error.
+ *
+ * A target's write refusal is handled separately: another linked target may
+ * still authorize the document write. Key unwrap failures on a target stay
+ * errors, because this path's readable grant should open its own key.
+ */
+function isRepairInaccessible(error, stale) {
+    if (stale.isPathTarget)
+        return false;
+    return (error instanceof ContainerAuthorAccessError ||
+        (error instanceof ContainerKekTargetUnreachableError &&
+            error.containerId === stale.projection.containerId));
+}
+/** Prepare parent-first repairs; the sync transaction commits them with the write. */
+export async function buildAutomaticContainerRekeys(sync, initialProjection) {
+    const plans = [];
+    const plannedIds = new Set();
+    let projection = initialProjection;
+    for (;;) {
+        const stale = firstStaleContainer(projection);
+        if (!stale)
+            return { plans, hasMore: false };
+        const previousProjection = stale.projection;
+        if (plans.length >= MAX_INLINE_CONTAINER_REKEYS) {
+            return { plans, hasMore: true };
+        }
+        // Use the shared cancellation sentinel: syncRemoteDocument converts only
+        // that to a graceful null, so a plain Error would report a routine
+        // generation flip mid-repair as a real sync failure.
+        assertProjectionVerificationCurrent(sync.stillCurrent);
+        if (plannedIds.has(previousProjection.containerId)) {
+            // Abandon like every other routine repair failure: two linked paths
+            // disagreeing about a container is a concurrent-rotation race, not a
+            // defect, and a raw Error would crash the sync lane instead.
+            throw new DocumentAncestorRepairAbandonedError("peer-rotation");
+        }
+        // Assert rather than adopt: resolveRotationContext compares the verified
+        // manifest's organization against the author's, so substituting the path's
+        // own organization here would make that the only cross-org check and leave
+        // it comparing a server-supplied value with itself.
+        if (previousProjection.organizationId !== sync.author.organizationId) {
+            throw new KeyingVerificationError("object_mismatch", "Document ancestor repair crosses the author's organization");
+        }
+        const planned = await buildMaterializedContainerRekeyPlan({
+            author: sync.author,
+            persistVerificationCheckpoints: false,
+            previousProjection,
+            signedAt: sync.signedAt,
+            targetSecretKey: sync.targetSecretKey,
+            resolveProjectionUserKey: sync.resolveProjectionUserKey,
+            stillCurrent: sync.stillCurrent,
+            warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,
+            execSql: sync.execSql,
+        }).catch(async (error) => {
+            if (error instanceof ContainerAuthorAccessError && stale.isPathTarget) {
+                if (await hasOtherLinkedWriteAccess(sync, initialProjection, previousProjection.containerId)) {
+                    throw new ContainerKekRepairInaccessibleError(previousProjection.containerId);
+                }
+                await sync.onTerminalSubmitFailure?.({
+                    code: error.code,
+                    message: error.message,
+                    ok: false,
+                    report: () => undefined,
+                    status: error.status,
+                });
+                throw new DocumentAncestorRepairAbandonedError("refused");
+            }
+            // Repairs run parent-first and access inherits downward, so only the
+            // first stale container can be out of reach. Retry-classified like any
+            // stale path: one refetch sees a repair a capable member already made.
+            throw isRepairInaccessible(error, stale)
+                ? new ContainerKekRepairInaccessibleError(previousProjection.containerId)
+                : error;
+        });
+        plannedIds.add(previousProjection.containerId);
+        plans.push(planned);
+        projection = await applyContainerRekeyPlan(projection, planned);
+    }
+}
+//# sourceMappingURL=syncAutomaticContainerRekeys.js.map