@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/syncContainerRekeyPreparation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncContainerRekeyPreparation.js","sourceRoot":"","sources":["syncContainerRekeyPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sDAAsD,CAAC;AAEzG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EACL,uBAAuB,EACvB,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,wCAAwC,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,qBAAqB,CAAC;AAE3E;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAmC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAA2B,CAAC;AAEtE,MAAM,UAAU,iCAAiC,CAC/C,IAA6B;IAE7B,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA6B;IAE7B,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,MAAqB;IACnD,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,IAA4C,EAC5C,gBAAoE;IAEpE,MAAM,OAAO,GAAG;QACd,qCAAqC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;KACjE,CAAC;IACF,MAAM,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC9E,OAAO,iCAAiC,CAAC;QACvC,aAAa,EAAE,4BAA4B,IAAI;YAC7C,QAAQ,EAAE;gBACR,SAAS,EAAE;oBACT,4BAA4B,EAAE,4BAA4B,CAAC,IAAI,CAC7D,IAAI,CAAC,SAAS,CACf;iBACF;gBACD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,wBAAwB,EAAE,gCAAgC,CACxD,IAAI,CAAC,wBAAwB,EAC7B,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;aACtE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB;SACtC;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACjB,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACnE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAIjC;IACC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,oCAAoC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAC3D,KAAK,CAAC,IAAI,EACV,IAAI,EACJ,gBAAgB,CACjB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,qDAAqD;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACzC,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,+BAA+B,IAAI,CAAC,WAAW,EAAE;oBAC1D,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,yEAAyE;QACzE,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;YAC3D,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3B,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAC1D,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,yEAAyE;YACzE,wEAAwE;YACxE,iDAAiD;YACjD,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,SAAS,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;QACrC,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAA6B,EAC7B,iBAAmD,EACnD,UAAU,GAAG,yBAAyB;IAKtC,IAAI,iBAAiB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,4EAA4E;IAC5E,+DAA+D;IAC/D,2EAA2E;IAC3E,0EAA0E;IAC1E,qDAAqD;IACrD,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,iBAAiB,GACrB,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAClE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,wCAAwC,CAAC,UAAU,EAAE;YACzD,GAAG,6BAA6B,CAAC,IAAI,CAAC;YACtC,8BAA8B,EAAE,IAAI;YACpC,0BAA0B,EAAE,IAAI;SACjC,CAAC,CAAC;QACH,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IACE,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM;YACpC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;QACjE,CAAC;QACD,gBAAgB,CAAC,GAAG,CAClB,IAAI,EACJ,eAAe;YACb,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CACxE,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,kCAAkC,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,6DAA6D;YAC7D,iBAAiB,EAAE,IAAI,CAAC,uBAAuB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,wEAAwE;YACxE,mCAAmC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,0EAA0E;YAC1E,0EAA0E;YAC1E,qCAAqC;YACrC,MAAM,IAAI,oCAAoC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,mCAAmC;QACnC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAA6B,EAC7B,UAA4C;IAE5C,IAAI,CAAC;QACH,OAAO,MAAM,+BAA+B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B;YAC7C,CAAC,wCAAwC,CAAC,KAAK,CAAC;YAEhD,MAAM,KAAK,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kCAAkC,CAAC;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,uBAAuB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { acknowledgeContainerMutationBatch } from \"../../data/containers/shared/mutationAcknowledgement\";\nimport type { MaterializedContainerRekeyPlan } from \"../../data/containers/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport {\n  submitContainerRotation,\n  submitRotationCarryingDescendants,\n} from \"../containers/child/mutationSubmit\";\nimport type { SyncRemoteDocumentInput } from \"./readOnlySync\";\nimport { buildAutomaticContainerRekeys } from \"./syncAutomaticContainerRekeys\";\nimport { shouldRetrySyncWithFreshWriterProjection } from \"./syncFailureClassification\";\nimport { refreshSyncAttemptWriterProjection } from \"./syncFailures\";\nimport { DocumentAncestorRepairAbandonedError } from \"./syncRepairAbandon\";\n\n/**\n * Repairs committed during one sync pass, keyed by the pass's own input object\n * (stable across all three attempts). The sync loop explicitly prepares each\n * attempt, so a counter local to one call would not bound the whole pass.\n */\nconst passRepairTotals = new WeakMap<SyncRemoteDocumentInput, number>();\n\n/**\n * Passes whose inline repairs the server refused for stranding a level above a\n * directly granted container. The write's flat rekey list cannot say which\n * descendants each repair must carry; a standalone rekey can, so the rest of\n * the pass commits every repair standalone before writing.\n */\nconst standaloneRepairPasses = new WeakSet<SyncRemoteDocumentInput>();\n\nexport function requiresStandaloneAncestorRepairs(\n  sync: SyncRemoteDocumentInput,\n): boolean {\n  return standaloneRepairPasses.has(sync);\n}\n\nexport function requireStandaloneAncestorRepairs(\n  sync: SyncRemoteDocumentInput,\n): void {\n  standaloneRepairPasses.add(sync);\n}\n\n/** A refusal the writer cannot clear by retrying, as opposed to 5xx/offline. */\nfunction isTerminalRepairStatus(status: number | null): boolean {\n  return status === 401 || status === 402 || status === 403;\n}\n\n/**\n * One standalone repair. Prefers the status-bearing rekey: a permanent refusal\n * (403 once ancestor write access is revoked, 402) must leave a durable record,\n * while a 5xx or an offline blip must not, and plain `rekeyContainer` collapses\n * both to null. It is also the only way to learn which descendant rekeys this\n * repair must carry. An adapter without it still repairs; its refusals are just\n * reported as an ordinary abandon.\n */\nfunction submitStandaloneRepair(\n  sync: SyncRemoteDocumentInput,\n  plan: MaterializedContainerRekeyPlan[\"plan\"],\n  writerProjection: MaterializedContainerRekeyPlan[\"writerProjection\"],\n) {\n  const options = {\n    expectedPaymentRequiredOrganizationId: plan.state.organizationId,\n  };\n  const { getContainerWriterProjection, rekeyContainerResult } = sync.apiClient;\n  return submitRotationCarryingDescendants({\n    carriedRekeys: getContainerWriterProjection && {\n      planning: {\n        apiClient: {\n          getContainerWriterProjection: getContainerWriterProjection.bind(\n            sync.apiClient,\n          ),\n        },\n        author: sync.author,\n        execSql: sync.execSql,\n        resolveProjectionUserKey: requireProjectionUserKeyResolver(\n          sync.resolveProjectionUserKey,\n          \"Document ancestor repair\",\n        ),\n        stillCurrent: sync.stillCurrent,\n        targetSecretKey: sync.targetSecretKey,\n        warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,\n      },\n      rotated: async () => writerProjection,\n    },\n    stillCurrent: sync.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...plan.request, containerRekeys: [...carried] }\n        : plan.request;\n      return submitContainerRotation({\n        plain: () =>\n          sync.apiClient.rekeyContainer(plan.containerId, request, options),\n        result: rekeyContainerResult\n          ? () =>\n              rekeyContainerResult.call(\n                sync.apiClient,\n                plan.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n\nasync function commitRepairPrefix(input: {\n  plans: readonly MaterializedContainerRekeyPlan[];\n  repairedIds: Set<string>;\n  sync: SyncRemoteDocumentInput;\n}): Promise<number> {\n  let committed = 0;\n  for (const { plan, writerProjection } of input.plans) {\n    assertProjectionVerificationCurrent(input.sync.stillCurrent);\n    if (input.sync.isRemoteSyncBlocked?.(plan.state.organizationId)) {\n      throw new DocumentAncestorRepairAbandonedError(\"blocked\");\n    }\n    if (input.repairedIds.has(plan.containerId)) {\n      throw new DocumentAncestorRepairAbandonedError(\"peer-rotation\");\n    }\n    const { carriedPlans, result } = await submitStandaloneRepair(\n      input.sync,\n      plan,\n      writerProjection,\n    );\n    const response = result.ok ? result.data : null;\n    // Deliberately not ContainerKekRepairRequiredError: that is classified as\n    // retryable, so a handled refusal would re-sign the whole prefix before\n    // failing again, and the retry never reaches onTerminalSubmitFailure\n    // regardless, because this throws before submission.\n    if (!response) {\n      if (!result.ok && isTerminalRepairStatus(result.status)) {\n        await input.sync.onTerminalSubmitFailure?.({\n          code: \"document_ancestor_repair_refused\",\n          message: `Ancestor repair refused for ${plan.containerId}`,\n          ok: false,\n          report: () => undefined,\n          status: result.status,\n        });\n      }\n      throw new DocumentAncestorRepairAbandonedError(\"refused\");\n    }\n    // What a repair carried committed with it, so the pins advance together.\n    const acknowledged = await acknowledgeContainerMutationBatch({\n      execSql: input.sync.execSql,\n      plans: [plan, ...carriedPlans.map((carried) => carried.plan)],\n      responses: [response, ...(response.containerRekeys ?? [])],\n      stillCurrent: input.sync.stillCurrent,\n    });\n    if (!acknowledged) {\n      // A refused guarded transaction is usually a generation flip; surface it\n      // as the shared cancellation so syncRemoteDocument returns null instead\n      // of reporting a routine flip as a sync failure.\n      assertProjectionVerificationCurrent(input.sync.stillCurrent);\n      throw new Error(\"Document ancestor repair was superseded\");\n    }\n    input.repairedIds.add(plan.containerId);\n    for (const carried of carriedPlans) {\n      input.repairedIds.add(carried.plan.containerId);\n    }\n    committed += 1 + carriedPlans.length;\n    // The rest of this prefix was signed before the carry. A plan for a carried\n    // container extends a superseded head, and one below it pins an epoch that\n    // was never minted. Stop here; the caller refetches and re-plans.\n    if (carriedPlans.length > 0) return committed;\n  }\n  return committed;\n}\n\n/**\n * Large repairs commit a bounded prefix; the last batch stays atomic with content.\n * A tighter local resource budget may be used, but never above the protocol cap.\n */\nexport async function prepareAutomaticContainerRekeys(\n  sync: SyncRemoteDocumentInput,\n  initialProjection: DocumentWriterProjectionResponse,\n  maxRepairs = MAX_CONTAINER_PATH_LENGTH,\n): Promise<{\n  plans: readonly MaterializedContainerRekeyPlan[];\n  projection: DocumentWriterProjectionResponse;\n}> {\n  if (initialProjection.documentId !== sync.documentId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document ancestor repair projection targets another document\",\n    );\n  }\n  let projection = initialProjection;\n  const repairedIds = new Set<string>();\n  // `repairedIds` only breaks a loop within one preparation. An explicit sync\n  // retry starts another preparation with a fresh set. Bound the\n  // work by the deepest authorizing path the protocol allows, counted across\n  // the whole pass rather than per call: no honest chain needs more repairs\n  // than that, so re-entry cannot multiply the budget.\n  for (;;) {\n    const batch = await buildAutomaticContainerRekeys(sync, projection);\n    const commitsStandalone =\n      batch.hasMore ||\n      (batch.plans.length > 0 && standaloneRepairPasses.has(sync));\n    if (!commitsStandalone) return { plans: batch.plans, projection };\n    // Standalone mutations require authentic document scope before any request.\n    // Persist the verified heads here, unlike the inline path: a committed\n    // repair is acknowledged against the latest durable pin, and a repaired\n    // ancestor is always past epoch 1, so a device that has never pinned it\n    // would reject its own acknowledgement after the server already committed\n    // the rekey. The inline path needs no pin because the sync response\n    // re-verifies and pins before anything is acknowledged.\n    await assertDocumentWriterProjectionConsistent(projection, {\n      ...projectionVerificationOptions(sync),\n      persistVerificationCheckpoints: true,\n      allowStaleContentKeyBundle: true,\n    });\n    // Charge what this prefix can still commit, then settle to what it did: it\n    // stops early after a repair that carried something, and charging the plans\n    // it never submitted would spend the budget on work that did not happen.\n    const committedBefore = passRepairTotals.get(sync) ?? 0;\n    if (\n      committedBefore + batch.plans.length >\n      Math.min(maxRepairs, MAX_CONTAINER_PATH_LENGTH)\n    ) {\n      throw new DocumentAncestorRepairAbandonedError(\"depth-budget\");\n    }\n    passRepairTotals.set(\n      sync,\n      committedBefore +\n        (await commitRepairPrefix({ plans: batch.plans, repairedIds, sync })),\n    );\n    const fresh = await refreshSyncAttemptWriterProjection({\n      apiClient: sync.apiClient,\n      documentId: sync.documentId,\n      onRemoteDocumentDeleted: sync.onRemoteDocumentDeleted,\n      onSyncAbandoned: sync.onSyncAbandoned,\n      onSyncTrace: sync.onSyncTrace,\n      // Always a write-bearing pass, so a terminal projection failure (a 403\n      // after revocation mid-repair) must leave the durable record that the\n      // queued writes are blocked. onReadOnlyProjectionFailure is documented\n      // for passes without queued writes and would not apply here.\n      onTerminalFailure: sync.onTerminalSubmitFailure,\n      stillCurrent: sync.stillCurrent,\n    });\n    if (!fresh) {\n      // refreshSyncAttemptWriterProjection returns null on a generation flip.\n      assertProjectionVerificationCurrent(sync.stillCurrent);\n      // It has already called onSyncAbandoned by this point, and on a coded 404\n      // ran the verified local teardown, so a bare Error would double-signal as\n      // an abandon plus a sync-lane crash.\n      throw new DocumentAncestorRepairAbandonedError(\"unrefreshable\");\n    }\n    // The scope check above guards the first round only; a refetched projection\n    // is server-supplied too, and nothing in the refresh path proves it names\n    // the document this repair is for.\n    if (fresh.documentId !== sync.documentId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Document ancestor repair projection targets another document\",\n      );\n    }\n    projection = fresh;\n  }\n}\n\n/** An explicit preparation retry may commit repairs; plan retries never do. */\nexport async function prepareSyncAttemptContainerRekeys(\n  sync: SyncRemoteDocumentInput,\n  projection: DocumentWriterProjectionResponse,\n) {\n  try {\n    return await prepareAutomaticContainerRekeys(sync, projection);\n  } catch (error) {\n    if (\n      !sync.apiClient.evictDocumentWriterProjection ||\n      !shouldRetrySyncWithFreshWriterProjection(error)\n    )\n      throw error;\n  }\n  const fresh = await refreshSyncAttemptWriterProjection({\n    apiClient: sync.apiClient,\n    documentId: sync.documentId,\n    onRemoteDocumentDeleted: sync.onRemoteDocumentDeleted,\n    onSyncAbandoned: sync.onSyncAbandoned,\n    onSyncTrace: sync.onSyncTrace,\n    onTerminalFailure: sync.onTerminalSubmitFailure,\n    stillCurrent: sync.stillCurrent,\n  });\n  return fresh ? prepareAutomaticContainerRekeys(sync, fresh) : null;\n}\n"]}

package/workflows/documents/syncContainerRekeyProjection.js

@@ -1,79 +0,0 @@
-import { computeDocumentContentKeyTargetHash } from "../../internal/crypto/index.js";
-import { normalizeDocumentKekTargetResponse, readManifestContainerId, } from "../../data/documents/shared/readers.js";
-function replaceRekeyedPathNode(input) {
-    const index = input.projection.path.findIndex((bundle) => readManifestContainerId(bundle) === input.plan.plan.containerId);
-    if (index < 0)
-        return { projection: input.projection, replaced: false };
-    const previousManifest = input.projection.path[index];
-    const previousKek = input.projection.containerKeks[index];
-    const nextManifest = input.plan.writerProjection.path.at(-1);
-    const nextKek = input.plan.writerProjection.containerKeks.at(-1);
-    if (!previousManifest ||
-        !previousKek ||
-        !nextManifest ||
-        !nextKek ||
-        previousManifest.manifestHash !==
-            input.plan.plan.previousManifest.manifestHash ||
-        previousKek.accessManifestHash !== previousManifest.manifestHash) {
-        throw new Error("Document inline rekey projection predecessor mismatch");
-    }
-    const path = [...input.projection.path];
-    const containerKeks = [...input.projection.containerKeks];
-    path[index] = nextManifest;
-    containerKeks[index] = nextKek;
-    return {
-        projection: { ...input.projection, containerKeks, path },
-        replaced: true,
-    };
-}
-export async function applyContainerRekeyPlan(writerProjection, plan) {
-    let replacedPath = false;
-    const authorizingContainerPaths = writerProjection.authorizingContainerPaths.map((projection) => {
-        const replaced = replaceRekeyedPathNode({ plan, projection });
-        replacedPath ||= replaced.replaced;
-        return replaced.projection;
-    });
-    const nextKek = plan.writerProjection.containerKeks.at(-1);
-    const nextManifest = plan.writerProjection.path.at(-1);
-    if (!nextKek || !nextManifest) {
-        throw new Error("Document inline rekey projection is empty");
-    }
-    let replacedTarget = false;
-    const targets = normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets).map((target) => {
-        if (target.containerId !== plan.plan.containerId)
-            return target;
-        replacedTarget = true;
-        return {
-            ...target,
-            containerKeyEpoch: nextKek.containerKeyEpoch,
-            containerKeyEpochId: nextKek.containerKeyEpochId,
-            containerManifestHash: nextManifest.manifestHash,
-        };
-    });
-    if (!replacedPath && !replacedTarget) {
-        throw new Error("Document inline rekey does not belong to its writer projection");
-    }
-    const documentKeyTargetHash = await computeDocumentContentKeyTargetHash(targets);
-    return {
-        ...writerProjection,
-        authorizingContainerPaths,
-        ...(documentKeyTargetHash === writerProjection.contentKeyBundle.targetHash
-            ? {}
-            : { contentKeyBundleStale: true }),
-        documentKekTargets: {
-            ...writerProjection.documentKekTargets,
-            documentKeyTargetHash,
-            linkedContainerKeyEpochIds: targets.map((target) => target.containerKeyEpochId),
-            linkedContainerManifestHashes: targets.map((target) => target.containerManifestHash),
-            targets: targets.map((target) => ({ ...target })),
-        },
-    };
-}
-export async function applyDocumentSyncContainerRekeys(input) {
-    let projection = input.writerProjection;
-    for (const plan of input.plans) {
-        projection = await applyContainerRekeyPlan(projection, plan);
-    }
-    return projection;
-}
-//# sourceMappingURL=syncContainerRekeyProjection.js.map

package/workflows/documents/syncContainerRekeyProjection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncContainerRekeyProjection.js","sourceRoot":"","sources":["syncContainerRekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EACL,kCAAkC,EAClC,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,SAAS,sBAAsB,CAAC,KAG/B;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC5E,CAAC;IACF,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,CAAC,YAAY;QACb,CAAC,OAAO;QACR,gBAAgB,CAAC,YAAY;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC/C,WAAW,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,YAAY,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;IAC3B,aAAa,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAC/B,OAAO;QACL,UAAU,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE;QACxD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,gBAAkD,EAClD,IAAoC;IAEpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,yBAAyB,GAC7B,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9D,YAAY,KAAK,QAAQ,CAAC,QAAQ,CAAC;QACnC,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,kCAAkC,CAChD,gBAAgB,CAAC,kBAAkB,CACpC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC;QAChE,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,MAAM;YACT,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,qBAAqB,EAAE,YAAY,CAAC,YAAY;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GACzB,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,gBAAgB;QACnB,yBAAyB;QACzB,GAAG,CAAC,qBAAqB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,UAAU;YACxE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAa,EAAE,CAAC;QAC7C,kBAAkB,EAAE;YAClB,GAAG,gBAAgB,CAAC,kBAAkB;YACtC,qBAAqB;YACrB,0BAA0B,EAAE,OAAO,CAAC,GAAG,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CACvC;YACD,6BAA6B,EAAE,OAAO,CAAC,GAAG,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC;YACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;SAClD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAGtD;IACC,IAAI,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,UAAU,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { computeDocumentContentKeyTargetHash } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedContainerRekeyPlan } from \"../../data/containers/shared/types\";\nimport {\n  normalizeDocumentKekTargetResponse,\n  readManifestContainerId,\n} from \"../../data/documents/shared/readers\";\n\nfunction replaceRekeyedPathNode(input: {\n  plan: MaterializedContainerRekeyPlan;\n  projection: DocumentWriterProjectionResponse[\"authorizingContainerPaths\"][number];\n}) {\n  const index = input.projection.path.findIndex(\n    (bundle) => readManifestContainerId(bundle) === input.plan.plan.containerId,\n  );\n  if (index < 0) return { projection: input.projection, replaced: false };\n  const previousManifest = input.projection.path[index];\n  const previousKek = input.projection.containerKeks[index];\n  const nextManifest = input.plan.writerProjection.path.at(-1);\n  const nextKek = input.plan.writerProjection.containerKeks.at(-1);\n  if (\n    !previousManifest ||\n    !previousKek ||\n    !nextManifest ||\n    !nextKek ||\n    previousManifest.manifestHash !==\n      input.plan.plan.previousManifest.manifestHash ||\n    previousKek.accessManifestHash !== previousManifest.manifestHash\n  ) {\n    throw new Error(\"Document inline rekey projection predecessor mismatch\");\n  }\n  const path = [...input.projection.path];\n  const containerKeks = [...input.projection.containerKeks];\n  path[index] = nextManifest;\n  containerKeks[index] = nextKek;\n  return {\n    projection: { ...input.projection, containerKeks, path },\n    replaced: true,\n  };\n}\n\nexport async function applyContainerRekeyPlan(\n  writerProjection: DocumentWriterProjectionResponse,\n  plan: MaterializedContainerRekeyPlan,\n): Promise<DocumentWriterProjectionResponse> {\n  let replacedPath = false;\n  const authorizingContainerPaths =\n    writerProjection.authorizingContainerPaths.map((projection) => {\n      const replaced = replaceRekeyedPathNode({ plan, projection });\n      replacedPath ||= replaced.replaced;\n      return replaced.projection;\n    });\n  const nextKek = plan.writerProjection.containerKeks.at(-1);\n  const nextManifest = plan.writerProjection.path.at(-1);\n  if (!nextKek || !nextManifest) {\n    throw new Error(\"Document inline rekey projection is empty\");\n  }\n  let replacedTarget = false;\n  const targets = normalizeDocumentKekTargetResponse(\n    writerProjection.documentKekTargets,\n  ).map((target) => {\n    if (target.containerId !== plan.plan.containerId) return target;\n    replacedTarget = true;\n    return {\n      ...target,\n      containerKeyEpoch: nextKek.containerKeyEpoch,\n      containerKeyEpochId: nextKek.containerKeyEpochId,\n      containerManifestHash: nextManifest.manifestHash,\n    };\n  });\n  if (!replacedPath && !replacedTarget) {\n    throw new Error(\n      \"Document inline rekey does not belong to its writer projection\",\n    );\n  }\n  const documentKeyTargetHash =\n    await computeDocumentContentKeyTargetHash(targets);\n  return {\n    ...writerProjection,\n    authorizingContainerPaths,\n    ...(documentKeyTargetHash === writerProjection.contentKeyBundle.targetHash\n      ? {}\n      : { contentKeyBundleStale: true as const }),\n    documentKekTargets: {\n      ...writerProjection.documentKekTargets,\n      documentKeyTargetHash,\n      linkedContainerKeyEpochIds: targets.map(\n        (target) => target.containerKeyEpochId,\n      ),\n      linkedContainerManifestHashes: targets.map(\n        (target) => target.containerManifestHash,\n      ),\n      targets: targets.map((target) => ({ ...target })),\n    },\n  };\n}\n\nexport async function applyDocumentSyncContainerRekeys(input: {\n  plans: readonly MaterializedContainerRekeyPlan[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentWriterProjectionResponse> {\n  let projection = input.writerProjection;\n  for (const plan of input.plans) {\n    projection = await applyContainerRekeyPlan(projection, plan);\n  }\n  return projection;\n}\n"]}

package/workflows/documents/syncContainerRekeys.js

@@ -1,72 +0,0 @@
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { buildAutomaticContainerRekeys } from "./syncAutomaticContainerRekeys.js";
-import { requiresStandaloneAncestorRepairs } from "./syncContainerRekeyPreparation.js";
-import { applyDocumentSyncContainerRekeys } from "./syncContainerRekeyProjection.js";
-import { buildMaterializedDocumentSyncPlan } from "./syncPlanMaterial.js";
-import { computeInlineRekeyCommitId } from "./syncRekeyCommit.js";
-import { DocumentSyncPreparationRequiredError } from "./syncRepairAbandon.js";
-/** Plan only: standalone server repairs belong to the outer sync attempt. */
-export async function buildRemoteDocumentSyncPlan(input) {
-    // Repairing this document's own container moves its key target hash, which
-    // marks the content-key bundle stale. Only a pass that can build a rotation
-    // snapshot is able to heal that; rotation settlement deliberately cannot
-    // (`syncRequest.ts` omits the builder for `allowRecoveryBaseline: false`), so
-    // repairing there would trade a classified "ancestor repair required" failure
-    // for an unhealable bundle — after a standalone prefix may already have been
-    // committed. Such a pass is left to fail as it did before automatic repair.
-    const canHealStaleBundle = input.sync.buildRotationSnapshot !== undefined;
-    let automaticPlans = input.preparedRekeys;
-    if (input.pendingUpdates.length &&
-        !input.sync.buildContainerRekeys &&
-        canHealStaleBundle &&
-        automaticPlans === undefined) {
-        const batch = await buildAutomaticContainerRekeys(input.sync, input.projection);
-        if (batch.hasMore ||
-            (batch.plans.length > 0 && requiresStandaloneAncestorRepairs(input.sync))) {
-            throw new DocumentSyncPreparationRequiredError();
-        }
-        automaticPlans = batch.plans;
-    }
-    const rekeyPlans = input.pendingUpdates.length && input.sync.buildContainerRekeys
-        ? await input.sync.buildContainerRekeys(input.projection, {
-            persistVerificationCheckpoints: false,
-        })
-        : automaticPlans;
-    const writerProjection = rekeyPlans?.length
-        ? await applyDocumentSyncContainerRekeys({
-            plans: rekeyPlans,
-            writerProjection: input.projection,
-        })
-        : input.projection;
-    let inlineRekeyCommitId;
-    if (rekeyPlans?.length) {
-        const headPendingUpdate = input.pendingUpdates[0];
-        if (!headPendingUpdate) {
-            throw new Error("Document inline rekey pending queue is empty");
-        }
-        inlineRekeyCommitId = await computeInlineRekeyCommitId({
-            headPendingUpdateId: headPendingUpdate.id,
-            projection: input.projection,
-        });
-    }
-    return buildMaterializedDocumentSyncPlan({
-        author: input.sync.author,
-        buildRotationSnapshot: input.sync.buildRotationSnapshot,
-        containerRekeys: rekeyPlans?.map(({ plan }) => plan.request),
-        execSql: input.sync.execSql,
-        historyMode: input.sync.historyMode,
-        inlineRekeyCommitId,
-        localVersionVector: input.sync.localVersionVector,
-        minLsn: input.minLsn,
-        onSyncTrace: input.sync.onSyncTrace,
-        pendingUpdates: input.pendingUpdates,
-        persistVerificationCheckpoints: rekeyPlans?.length ? false : undefined,
-        pullCursor: input.pullCursor,
-        regenerateQueuedCheckpoints: input.regenerateQueuedCheckpoints,
-        signedAt: input.sync.signedAt,
-        targetSecretKey: input.sync.targetSecretKey,
-        writerProjection,
-        ...projectionVerificationOptions(input.sync),
-    });
-}
-//# sourceMappingURL=syncContainerRekeys.js.map

package/workflows/documents/syncContainerRekeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncContainerRekeys.js","sourceRoot":"","sources":["syncContainerRekeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAGlF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oCAAoC,EAAE,MAAM,qBAAqB,CAAC;AAE3E,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAC1E,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC1C,IACE,KAAK,CAAC,cAAc,CAAC,MAAM;QAC3B,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB;QAChC,kBAAkB;QAClB,cAAc,KAAK,SAAS,EAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAC/C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,UAAU,CACjB,CAAC;QACF,IACE,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,oCAAoC,EAAE,CAAC;QACnD,CAAC;QACD,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,cAAc,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB;QAC5D,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE;YACtD,8BAA8B,EAAE,KAAK;SACtC,CAAC;QACJ,CAAC,CAAC,cAAc,CAAC;IACrB,MAAM,gBAAgB,GAAG,UAAU,EAAE,MAAM;QACzC,CAAC,CAAC,MAAM,gCAAgC,CAAC;YACrC,KAAK,EAAE,UAAU;YACjB,gBAAgB,EAAE,KAAK,CAAC,UAAU;SACnC,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACrB,IAAI,mBAAuC,CAAC;IAC5C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;YACrD,mBAAmB,EAAE,iBAAiB,CAAC,EAAE;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iCAAiC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;QACzB,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,eAAe,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;QAC3B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,8BAA8B,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;QAC3C,gBAAgB;QAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedContainerRekeyPlan } from \"../../data/containers/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport type { PendingUpdateRecord } from \"../../data/sqlite/documentPersistence\";\nimport type { SyncRemoteDocumentInput } from \"./readOnlySync\";\nimport { buildAutomaticContainerRekeys } from \"./syncAutomaticContainerRekeys\";\nimport { requiresStandaloneAncestorRepairs } from \"./syncContainerRekeyPreparation\";\nimport { applyDocumentSyncContainerRekeys } from \"./syncContainerRekeyProjection\";\nimport { buildMaterializedDocumentSyncPlan } from \"./syncPlanMaterial\";\nimport { computeInlineRekeyCommitId } from \"./syncRekeyCommit\";\nimport { DocumentSyncPreparationRequiredError } from \"./syncRepairAbandon\";\n\n/** Plan only: standalone server repairs belong to the outer sync attempt. */\nexport async function buildRemoteDocumentSyncPlan(input: {\n  preparedRekeys?: readonly MaterializedContainerRekeyPlan[] | undefined;\n  minLsn?: string | undefined;\n  pendingUpdates: readonly PendingUpdateRecord[];\n  pullCursor?: string | undefined;\n  projection: DocumentWriterProjectionResponse;\n  regenerateQueuedCheckpoints: boolean;\n  sync: SyncRemoteDocumentInput;\n}) {\n  // Repairing this document's own container moves its key target hash, which\n  // marks the content-key bundle stale. Only a pass that can build a rotation\n  // snapshot is able to heal that; rotation settlement deliberately cannot\n  // (`syncRequest.ts` omits the builder for `allowRecoveryBaseline: false`), so\n  // repairing there would trade a classified \"ancestor repair required\" failure\n  // for an unhealable bundle — after a standalone prefix may already have been\n  // committed. Such a pass is left to fail as it did before automatic repair.\n  const canHealStaleBundle = input.sync.buildRotationSnapshot !== undefined;\n  let automaticPlans = input.preparedRekeys;\n  if (\n    input.pendingUpdates.length &&\n    !input.sync.buildContainerRekeys &&\n    canHealStaleBundle &&\n    automaticPlans === undefined\n  ) {\n    const batch = await buildAutomaticContainerRekeys(\n      input.sync,\n      input.projection,\n    );\n    if (\n      batch.hasMore ||\n      (batch.plans.length > 0 && requiresStandaloneAncestorRepairs(input.sync))\n    ) {\n      throw new DocumentSyncPreparationRequiredError();\n    }\n    automaticPlans = batch.plans;\n  }\n  const rekeyPlans =\n    input.pendingUpdates.length && input.sync.buildContainerRekeys\n      ? await input.sync.buildContainerRekeys(input.projection, {\n          persistVerificationCheckpoints: false,\n        })\n      : automaticPlans;\n  const writerProjection = rekeyPlans?.length\n    ? await applyDocumentSyncContainerRekeys({\n        plans: rekeyPlans,\n        writerProjection: input.projection,\n      })\n    : input.projection;\n  let inlineRekeyCommitId: string | undefined;\n  if (rekeyPlans?.length) {\n    const headPendingUpdate = input.pendingUpdates[0];\n    if (!headPendingUpdate) {\n      throw new Error(\"Document inline rekey pending queue is empty\");\n    }\n    inlineRekeyCommitId = await computeInlineRekeyCommitId({\n      headPendingUpdateId: headPendingUpdate.id,\n      projection: input.projection,\n    });\n  }\n  return buildMaterializedDocumentSyncPlan({\n    author: input.sync.author,\n    buildRotationSnapshot: input.sync.buildRotationSnapshot,\n    containerRekeys: rekeyPlans?.map(({ plan }) => plan.request),\n    execSql: input.sync.execSql,\n    historyMode: input.sync.historyMode,\n    inlineRekeyCommitId,\n    localVersionVector: input.sync.localVersionVector,\n    minLsn: input.minLsn,\n    onSyncTrace: input.sync.onSyncTrace,\n    pendingUpdates: input.pendingUpdates,\n    persistVerificationCheckpoints: rekeyPlans?.length ? false : undefined,\n    pullCursor: input.pullCursor,\n    regenerateQueuedCheckpoints: input.regenerateQueuedCheckpoints,\n    signedAt: input.sync.signedAt,\n    targetSecretKey: input.sync.targetSecretKey,\n    writerProjection,\n    ...projectionVerificationOptions(input.sync),\n  });\n}\n"]}

package/workflows/documents/syncContentKeys.d.ts

@@ -1,39 +0,0 @@
-import type { DocumentSyncResponse, DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { DocumentSyncPreparedUpdate, ProjectionVerificationOptions } from "../../data/documents/shared/types.js";
-import type { PendingUpdateRecord } from "../../data/sqlite/documentPersistence.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-type SyncResponseUpdate = DocumentSyncResponse["updates"][number];
-type RawHistoryUnavailableValidator = (input: {
-    contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;
-    updates: readonly SyncResponseUpdate[];
-}) => void | Promise<void>;
-/** A raw recovery cannot reconstruct history without this retained epoch. */
-export declare class DocumentRawHistoryUnavailableError extends Error {
-    readonly contentKeyEpoch: number;
-    readonly code = "document_raw_history_epoch_unavailable";
-    constructor(contentKeyEpoch: number, cause: unknown);
-}
-export declare function prepareDocumentOutgoingUpdates(input: {
-    contentKey: Uint8Array;
-    contentKeyEpoch: number;
-    documentId: string;
-    organizationId: string;
-    pendingUpdates: readonly PendingUpdateRecord[];
-}): Promise<DocumentSyncPreparedUpdate[]>;
-/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */
-export declare function throwDocumentSyncContentKeyFailure(input: {
-    cause: unknown;
-    updates: readonly SyncResponseUpdate[];
-}): never;
-export declare function unwrapDocumentSyncResponseContentKeys(input: {
-    currentContentKey: Uint8Array;
-    currentContentKeyEpoch: number;
-    execSql?: ExecSql | undefined;
-    historyMode?: "raw" | undefined;
-    /** @internal Validate every decryptable sibling before raw availability wins. */
-    onRawHistoryUnavailable?: RawHistoryUnavailableValidator | undefined;
-    response: DocumentSyncResponse;
-    targetSecretKey: Uint8Array;
-    writerProjection: DocumentWriterProjectionResponse;
-} & ProjectionVerificationOptions): Promise<ReadonlyMap<number, Uint8Array>>;
-export {};

package/workflows/documents/syncContentKeys.js

@@ -1,254 +0,0 @@
-import { importContentKeyMaterial } from "../../data/documents/shared/contentRecordKeys.js";
-import { encryptDocumentPendingUpdate } from "../../data/documents/shared/crypto.js";
-import { assertDocumentSyncUpdateEncryptedRecord } from "../../data/documents/shared/documentSyncUpdateDecryption.js";
-import { isDocumentSyncUpdateIsolationError, isolateDocumentSyncBatchError, isolateDocumentSyncUpdateError, } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-import { ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentContentKeyUnavailableError, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../data/documents/shared/projection.js";
-import { readWriteHeader } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { isKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
-function isRawHistoryUnavailableCause(error) {
-    return (error instanceof DocumentContentKeyUnavailableError ||
-        (error instanceof DocumentHistoryUnavailableError &&
-            error.historyCause instanceof ContainerKekHistoryUnavailableError));
-}
-/** A raw recovery cannot reconstruct history without this retained epoch. */
-export class DocumentRawHistoryUnavailableError extends Error {
-    contentKeyEpoch;
-    code = "document_raw_history_epoch_unavailable";
-    constructor(contentKeyEpoch, cause) {
-        super(`Document raw-history recovery cannot decrypt content-key epoch ${contentKeyEpoch}`, { cause });
-        this.contentKeyEpoch = contentKeyEpoch;
-        this.name = "DocumentRawHistoryUnavailableError";
-    }
-}
-async function assertResponseEncryptedRecords(updates) {
-    const inspections = await Promise.allSettled(updates.map(assertDocumentSyncUpdateEncryptedRecord));
-    const failures = inspections.flatMap((inspection, index) => inspection.status === "rejected"
-        ? [{ index, reason: inspection.reason }]
-        : []);
-    const firstFailure = failures[0];
-    if (failures.length === 1 && firstFailure) {
-        throw firstFailure.reason;
-    }
-    if (failures.length > 1 && firstFailure) {
-        const stage = isDocumentSyncUpdateIsolationError(firstFailure.reason) &&
-            failures.every(({ reason }) => isDocumentSyncUpdateIsolationError(reason) &&
-                reason.stage === firstFailure.reason.stage)
-            ? firstFailure.reason.stage
-            : "encrypted_record";
-        throw isolateDocumentSyncBatchError({
-            cause: new Error("Multiple document encrypted records are invalid"),
-            stage,
-            updateIds: failures.map(({ index }) => updates[index]?.id ?? "unknown"),
-        });
-    }
-}
-async function throwRawHistoryUnavailable(input) {
-    await assertResponseEncryptedRecords(input.response.updates);
-    await input.validate?.({
-        contentKeysByEpoch: input.contentKeysByEpoch,
-        updates: input.response.updates.filter((update) => input.contentKeysByEpoch.has(readWriteHeader(update.writeHeader, "Document sync response write header").contentKeyEpoch)),
-    });
-    throw new DocumentRawHistoryUnavailableError(input.unavailable.contentKeyEpoch, input.unavailable.cause);
-}
-export async function prepareDocumentOutgoingUpdates(input) {
-    if (input.pendingUpdates.length === 0) {
-        return [];
-    }
-    const contentKeyMaterial = await importContentKeyMaterial(input.contentKey);
-    return Promise.all(input.pendingUpdates.map(async (update) => {
-        const encrypted = await encryptDocumentPendingUpdate({
-            contentKeyMaterial,
-            contentKeyEpoch: input.contentKeyEpoch,
-            documentId: input.documentId,
-            organizationId: input.organizationId,
-            update,
-        });
-        return {
-            contentRecordId: encrypted.contentRecordId,
-            encryptedData: encrypted.encryptedData,
-            id: update.id,
-            partialStartVersionVector: update.partialStartVersionVector,
-            partialEndVersionVector: update.partialEndVersionVector,
-            metadataHash: encrypted.metadataHash,
-            ciphertextHash: encrypted.ciphertextHash,
-            plaintextHash: encrypted.plaintextHash,
-            ...(update.sourceVersionVector
-                ? {
-                    checkpointKind: "rotate_baseline",
-                    checkpointPayloadKind: "full_history_snapshot",
-                    sourceVersionVector: update.sourceVersionVector,
-                }
-                : {}),
-        };
-    }));
-}
-function syncResponseContentKeyBundlesByEpoch(response) {
-    const byEpoch = new Map();
-    for (const bundle of [
-        response.contentKeyBundle,
-        ...response.contentKeyBundles,
-    ]) {
-        if (byEpoch.has(bundle.contentKeyEpoch)) {
-            throw new Error("Document sync response repeats a content-key epoch");
-        }
-        byEpoch.set(bundle.contentKeyEpoch, bundle);
-    }
-    return byEpoch;
-}
-function syncResponseUpdatesByContentKeyEpoch(response) {
-    const updatesByEpoch = new Map();
-    for (const update of response.updates) {
-        let contentKeyEpoch;
-        try {
-            contentKeyEpoch = readWriteHeader(update.writeHeader, "Document sync response write header").contentKeyEpoch;
-        }
-        catch (error) {
-            throw isolateDocumentSyncUpdateError({
-                cause: error,
-                responseUpdate: update,
-                stage: "write_header",
-                updateId: update.id,
-            });
-        }
-        const epochUpdates = updatesByEpoch.get(contentKeyEpoch);
-        if (epochUpdates)
-            epochUpdates.push(update);
-        else
-            updatesByEpoch.set(contentKeyEpoch, [update]);
-    }
-    return updatesByEpoch;
-}
-function assertBundleMatchesUpdateHeaders(input) {
-    for (const update of input.updates) {
-        const header = readWriteHeader(update.writeHeader, "Document sync response write header");
-        if (header.objectId !== input.bundle.documentId ||
-            header.contentKeyEpoch !== input.bundle.contentKeyEpoch ||
-            (input.requireOriginalTargets &&
-                (header.accessManifestHash !== input.bundle.linkSetManifestHash ||
-                    header.targetHash !== input.bundle.targetHash))) {
-            throw new Error(input.requireOriginalTargets
-                ? "Document sync response content key is unavailable and its bundle differs from the original update headers"
-                : "Document sync response content-key bundle does not match its update headers");
-        }
-    }
-}
-/**
- * Linking can rewrap a retained key at the same content epoch. Its latest bundle
- * then has newer targets than older signed updates. A usable key is validated
- * by the caller's authenticated record decryption; the update's own historical
- * manifest, targets and signature are verified independently before this step.
- *
- * If the key cannot be recovered, require the original target commitments before
- * calling that an availability failure. Substituted unavailable targets must
- * still be quarantined, never disguised as legitimate missing history.
- */
-async function unwrapHistoricalContentKey(input) {
-    assertBundleMatchesUpdateHeaders({ ...input, requireOriginalTargets: false });
-    try {
-        return await unwrapDocumentContentKeyFromBundle(input.bundle, input.documentId, input.collectedKeks.keksByEpochId, input.collectedKeks.predecessorFailuresByEpochId, input.collectedKeks.unattributedPredecessorFailuresByContainerId);
-    }
-    catch (error) {
-        if (isRawHistoryUnavailableCause(error)) {
-            assertBundleMatchesUpdateHeaders({
-                ...input,
-                requireOriginalTargets: true,
-            });
-        }
-        throw error;
-    }
-}
-/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */
-export function throwDocumentSyncContentKeyFailure(input) {
-    if (isKeyingVerificationError(input.cause)) {
-        throw input.cause;
-    }
-    if (input.cause instanceof DocumentHistoryUnavailableError &&
-        isKeyingVerificationError(input.cause.historyCause)) {
-        throw input.cause.historyCause;
-    }
-    throw isolateDocumentSyncBatchError({
-        cause: input.cause,
-        stage: "content_key",
-        updateIds: input.updates.map((update) => update.id),
-    });
-}
-export async function unwrapDocumentSyncResponseContentKeys(input) {
-    // A stale read-only pass can carry an empty placeholder when none of its
-    // authorizing paths reaches the bundle target. Do not mark that epoch as
-    // resolved: every served update must instead unwrap its bundle through the
-    // verified predecessor KEK chain or fail with an honest error.
-    const contentKeysByEpoch = new Map(input.currentContentKey.byteLength > 0
-        ? [[input.currentContentKeyEpoch, input.currentContentKey]]
-        : []);
-    const updatesByContentKeyEpoch = syncResponseUpdatesByContentKeyEpoch(input.response);
-    const missingContentKeyEpochs = [...updatesByContentKeyEpoch.keys()].filter((contentKeyEpoch) => !contentKeysByEpoch.has(contentKeyEpoch));
-    missingContentKeyEpochs.sort((left, right) => left - right);
-    if (missingContentKeyEpochs.length === 0) {
-        return contentKeysByEpoch;
-    }
-    const missingUpdates = missingContentKeyEpochs.flatMap((contentKeyEpoch) => updatesByContentKeyEpoch.get(contentKeyEpoch) ?? []);
-    let bundlesByEpoch;
-    try {
-        bundlesByEpoch = syncResponseContentKeyBundlesByEpoch(input.response);
-    }
-    catch (error) {
-        throwDocumentSyncContentKeyFailure({
-            cause: error,
-            updates: missingUpdates,
-        });
-    }
-    const absentBundleEpoch = missingContentKeyEpochs.find((contentKeyEpoch) => !bundlesByEpoch.has(contentKeyEpoch));
-    if (absentBundleEpoch !== undefined) {
-        throwDocumentSyncContentKeyFailure({
-            cause: new Error("Document sync response content-key bundle missing"),
-            updates: updatesByContentKeyEpoch.get(absentBundleEpoch) ?? missingUpdates,
-        });
-    }
-    const collectedKeks = await collectContainerKeksForDocumentSync({
-        execSql: input.execSql,
-        secretKey: input.targetSecretKey,
-        writerProjection: input.writerProjection,
-        ...projectionVerificationOptions(input),
-    });
-    let unavailableRawHistory;
-    for (const contentKeyEpoch of missingContentKeyEpochs) {
-        const bundle = bundlesByEpoch.get(contentKeyEpoch);
-        const responseUpdates = updatesByContentKeyEpoch.get(contentKeyEpoch) ?? missingUpdates;
-        if (!bundle) {
-            const error = new Error("Document sync response content-key bundle missing");
-            throwDocumentSyncContentKeyFailure({
-                cause: error,
-                updates: responseUpdates,
-            });
-        }
-        try {
-            contentKeysByEpoch.set(bundle.contentKeyEpoch, await unwrapHistoricalContentKey({
-                bundle,
-                collectedKeks,
-                documentId: input.writerProjection.documentId,
-                updates: responseUpdates,
-            }));
-        }
-        catch (error) {
-            if (input.historyMode === "raw" && isRawHistoryUnavailableCause(error)) {
-                unavailableRawHistory ??= { cause: error, contentKeyEpoch };
-                continue;
-            }
-            throwDocumentSyncContentKeyFailure({
-                cause: error,
-                updates: responseUpdates,
-            });
-        }
-    }
-    if (unavailableRawHistory) {
-        await throwRawHistoryUnavailable({
-            contentKeysByEpoch,
-            response: input.response,
-            unavailable: unavailableRawHistory,
-            validate: input.onRawHistoryUnavailable,
-        });
-    }
-    return contentKeysByEpoch;
-}
-//# sourceMappingURL=syncContentKeys.js.map

package/workflows/documents/syncContentKeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncContentKeys.js","sourceRoot":"","sources":["syncContentKeys.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,uCAAuC,EAAE,MAAM,0DAA0D,CAAC;AACnH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAKtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAS1F,SAAS,4BAA4B,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,kCAAkC;QACnD,CAAC,KAAK,YAAY,+BAA+B;YAC/C,KAAK,CAAC,YAAY,YAAY,mCAAmC,CAAC,CACrE,CAAC;AACJ,CAAC;AAOD,6EAA6E;AAC7E,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIhD;IAHF,IAAI,GAAG,wCAAwC,CAAC;IAEzD,YACW,eAAuB,EAChC,KAAc;QAEd,KAAK,CACH,kEAAkE,eAAe,EAAE,EACnF,EAAE,KAAK,EAAE,CACV,CAAC;QANO,oBAAe,GAAf,eAAe,CAAQ;QAOhC,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAsC;IAEtC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CACrD,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CACzD,UAAU,CAAC,MAAM,KAAK,UAAU;QAC9B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,KAAK,GACT,kCAAkC,CAAC,YAAY,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,KAAK,CACZ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACb,kCAAkC,CAAC,MAAM,CAAC;gBAC1C,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,KAAK,CAC7C;YACC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK;YAC3B,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CAAC,iDAAiD,CAAC;YACnE,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAC1B,eAAe,CACb,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC,eAAe,CAClB,CACF;KACF,CAAC,CAAC;IACH,MAAM,IAAI,kCAAkC,CAC1C,KAAK,CAAC,WAAW,CAAC,eAAe,EACjC,KAAK,CAAC,WAAW,CAAC,KAAK,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE5E,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;YACnD,kBAAkB;YAClB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM;SACP,CAAC,CAAC;QAEH,OAAO;YACL,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACvD,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,GAAG,CAAC,MAAM,CAAC,mBAAmB;gBAC5B,CAAC,CAAC;oBACE,cAAc,EAAE,iBAA0B;oBAC1C,qBAAqB,EAAE,uBAAgC;oBACvD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;iBAChD;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,QAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAE5E,KAAK,MAAM,MAAM,IAAI;QACnB,QAAQ,CAAC,gBAAgB;QACzB,GAAG,QAAQ,CAAC,iBAAiB;KAC9B,EAAE,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oCAAoC,CAC3C,QAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,eAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,eAAe,GAAG,eAAe,CAC/B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC,eAAe,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,8BAA8B,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,MAAM;gBACtB,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACvC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IACE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU;YAC3C,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,eAAe;YACvD,CAAC,KAAK,CAAC,sBAAsB;gBAC3B,CAAC,MAAM,CAAC,kBAAkB,KAAK,KAAK,CAAC,MAAM,CAAC,mBAAmB;oBAC7D,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,sBAAsB;gBAC1B,CAAC,CAAC,2GAA2G;gBAC7G,CAAC,CAAC,6EAA6E,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,0BAA0B,CAAC,KAOzC;IACC,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,MAAM,kCAAkC,CAC7C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,aAAa,CAAC,aAAa,EACjC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAChD,KAAK,CAAC,aAAa,CAAC,4CAA4C,CACjE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,gCAAgC,CAAC;gBAC/B,GAAG,KAAK;gBACR,sBAAsB,EAAE,IAAI;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,IACE,KAAK,CAAC,KAAK,YAAY,+BAA+B;QACtD,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EACnD,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAUiC;IAEjC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,iBAAiB,CAAC,UAAU,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,MAAM,uBAAuB,GAAG,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACzE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC9D,CAAC;IACF,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CACpD,CAAC,eAAe,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CACzE,CAAC;IACF,IAAI,cAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,cAAc,GAAG,oCAAoC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kCAAkC,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CACpD,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1D,CAAC;IACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,kCAAkC,CAAC;YACjC,KAAK,EAAE,IAAI,KAAK,CAAC,mDAAmD,CAAC;YACrE,OAAO,EACL,wBAAwB,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,cAAc;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,qBAES,CAAC;IAEd,KAAK,MAAM,eAAe,IAAI,uBAAuB,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,eAAe,GACnB,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mDAAmD,CACpD,CAAC;YACF,kCAAkC,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CACpB,MAAM,CAAC,eAAe,EACtB,MAAM,0BAA0B,CAAC;gBAC/B,MAAM;gBACN,aAAa;gBACb,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,OAAO,EAAE,eAAe;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,qBAAqB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,kCAAkC,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,0BAA0B,CAAC;YAC/B,kBAAkB;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,KAAK,CAAC,uBAAuB;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type {\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { encryptDocumentPendingUpdate } from \"../../data/documents/shared/crypto\";\nimport { assertDocumentSyncUpdateEncryptedRecord } from \"../../data/documents/shared/documentSyncUpdateDecryption\";\nimport {\n  isDocumentSyncUpdateIsolationError,\n  isolateDocumentSyncBatchError,\n  isolateDocumentSyncUpdateError,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n  ContainerKekHistoryUnavailableError,\n  collectContainerKeksForDocumentSync,\n  DocumentContentKeyUnavailableError,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n} from \"../../data/documents/shared/projection\";\nimport { readWriteHeader } from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentSyncPreparedUpdate,\n  ProjectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { isKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { PendingUpdateRecord } from \"../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype RawHistoryUnavailableCause =\n  | DocumentContentKeyUnavailableError\n  | DocumentHistoryUnavailableError;\n\nfunction isRawHistoryUnavailableCause(\n  error: unknown,\n): error is RawHistoryUnavailableCause {\n  return (\n    error instanceof DocumentContentKeyUnavailableError ||\n    (error instanceof DocumentHistoryUnavailableError &&\n      error.historyCause instanceof ContainerKekHistoryUnavailableError)\n  );\n}\n\ntype RawHistoryUnavailableValidator = (input: {\n  contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;\n  updates: readonly SyncResponseUpdate[];\n}) => void | Promise<void>;\n\n/** A raw recovery cannot reconstruct history without this retained epoch. */\nexport class DocumentRawHistoryUnavailableError extends Error {\n  readonly code = \"document_raw_history_epoch_unavailable\";\n\n  constructor(\n    readonly contentKeyEpoch: number,\n    cause: unknown,\n  ) {\n    super(\n      `Document raw-history recovery cannot decrypt content-key epoch ${contentKeyEpoch}`,\n      { cause },\n    );\n    this.name = \"DocumentRawHistoryUnavailableError\";\n  }\n}\n\nasync function assertResponseEncryptedRecords(\n  updates: readonly SyncResponseUpdate[],\n): Promise<void> {\n  const inspections = await Promise.allSettled(\n    updates.map(assertDocumentSyncUpdateEncryptedRecord),\n  );\n  const failures = inspections.flatMap((inspection, index) =>\n    inspection.status === \"rejected\"\n      ? [{ index, reason: inspection.reason }]\n      : [],\n  );\n  const firstFailure = failures[0];\n  if (failures.length === 1 && firstFailure) {\n    throw firstFailure.reason;\n  }\n  if (failures.length > 1 && firstFailure) {\n    const stage =\n      isDocumentSyncUpdateIsolationError(firstFailure.reason) &&\n      failures.every(\n        ({ reason }) =>\n          isDocumentSyncUpdateIsolationError(reason) &&\n          reason.stage === firstFailure.reason.stage,\n      )\n        ? firstFailure.reason.stage\n        : \"encrypted_record\";\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\"Multiple document encrypted records are invalid\"),\n      stage,\n      updateIds: failures.map(({ index }) => updates[index]?.id ?? \"unknown\"),\n    });\n  }\n}\n\nasync function throwRawHistoryUnavailable(input: {\n  contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;\n  response: DocumentSyncResponse;\n  unavailable: { cause: RawHistoryUnavailableCause; contentKeyEpoch: number };\n  validate?: RawHistoryUnavailableValidator | undefined;\n}): Promise<never> {\n  await assertResponseEncryptedRecords(input.response.updates);\n  await input.validate?.({\n    contentKeysByEpoch: input.contentKeysByEpoch,\n    updates: input.response.updates.filter((update) =>\n      input.contentKeysByEpoch.has(\n        readWriteHeader(\n          update.writeHeader,\n          \"Document sync response write header\",\n        ).contentKeyEpoch,\n      ),\n    ),\n  });\n  throw new DocumentRawHistoryUnavailableError(\n    input.unavailable.contentKeyEpoch,\n    input.unavailable.cause,\n  );\n}\n\nexport async function prepareDocumentOutgoingUpdates(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  pendingUpdates: readonly PendingUpdateRecord[];\n}): Promise<DocumentSyncPreparedUpdate[]> {\n  if (input.pendingUpdates.length === 0) {\n    return [];\n  }\n  const contentKeyMaterial = await importContentKeyMaterial(input.contentKey);\n\n  return Promise.all(\n    input.pendingUpdates.map(async (update) => {\n      const encrypted = await encryptDocumentPendingUpdate({\n        contentKeyMaterial,\n        contentKeyEpoch: input.contentKeyEpoch,\n        documentId: input.documentId,\n        organizationId: input.organizationId,\n        update,\n      });\n\n      return {\n        contentRecordId: encrypted.contentRecordId,\n        encryptedData: encrypted.encryptedData,\n        id: update.id,\n        partialStartVersionVector: update.partialStartVersionVector,\n        partialEndVersionVector: update.partialEndVersionVector,\n        metadataHash: encrypted.metadataHash,\n        ciphertextHash: encrypted.ciphertextHash,\n        plaintextHash: encrypted.plaintextHash,\n        ...(update.sourceVersionVector\n          ? {\n              checkpointKind: \"rotate_baseline\" as const,\n              checkpointPayloadKind: \"full_history_snapshot\" as const,\n              sourceVersionVector: update.sourceVersionVector,\n            }\n          : {}),\n      };\n    }),\n  );\n}\n\nfunction syncResponseContentKeyBundlesByEpoch(\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  const byEpoch = new Map<number, DocumentSyncResponse[\"contentKeyBundle\"]>();\n\n  for (const bundle of [\n    response.contentKeyBundle,\n    ...response.contentKeyBundles,\n  ]) {\n    if (byEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    byEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return byEpoch;\n}\n\nfunction syncResponseUpdatesByContentKeyEpoch(\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, readonly SyncResponseUpdate[]> {\n  const updatesByEpoch = new Map<number, SyncResponseUpdate[]>();\n  for (const update of response.updates) {\n    let contentKeyEpoch: number;\n    try {\n      contentKeyEpoch = readWriteHeader(\n        update.writeHeader,\n        \"Document sync response write header\",\n      ).contentKeyEpoch;\n    } catch (error) {\n      throw isolateDocumentSyncUpdateError({\n        cause: error,\n        responseUpdate: update,\n        stage: \"write_header\",\n        updateId: update.id,\n      });\n    }\n    const epochUpdates = updatesByEpoch.get(contentKeyEpoch);\n    if (epochUpdates) epochUpdates.push(update);\n    else updatesByEpoch.set(contentKeyEpoch, [update]);\n  }\n  return updatesByEpoch;\n}\n\nfunction assertBundleMatchesUpdateHeaders(input: {\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  requireOriginalTargets: boolean;\n  updates: readonly SyncResponseUpdate[];\n}): void {\n  for (const update of input.updates) {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (\n      header.objectId !== input.bundle.documentId ||\n      header.contentKeyEpoch !== input.bundle.contentKeyEpoch ||\n      (input.requireOriginalTargets &&\n        (header.accessManifestHash !== input.bundle.linkSetManifestHash ||\n          header.targetHash !== input.bundle.targetHash))\n    ) {\n      throw new Error(\n        input.requireOriginalTargets\n          ? \"Document sync response content key is unavailable and its bundle differs from the original update headers\"\n          : \"Document sync response content-key bundle does not match its update headers\",\n      );\n    }\n  }\n}\n\n/**\n * Linking can rewrap a retained key at the same content epoch. Its latest bundle\n * then has newer targets than older signed updates. A usable key is validated\n * by the caller's authenticated record decryption; the update's own historical\n * manifest, targets and signature are verified independently before this step.\n *\n * If the key cannot be recovered, require the original target commitments before\n * calling that an availability failure. Substituted unavailable targets must\n * still be quarantined, never disguised as legitimate missing history.\n */\nasync function unwrapHistoricalContentKey(input: {\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  documentId: string;\n  collectedKeks: Awaited<\n    ReturnType<typeof collectContainerKeksForDocumentSync>\n  >;\n  updates: readonly SyncResponseUpdate[];\n}): Promise<Uint8Array> {\n  assertBundleMatchesUpdateHeaders({ ...input, requireOriginalTargets: false });\n  try {\n    return await unwrapDocumentContentKeyFromBundle(\n      input.bundle,\n      input.documentId,\n      input.collectedKeks.keksByEpochId,\n      input.collectedKeks.predecessorFailuresByEpochId,\n      input.collectedKeks.unattributedPredecessorFailuresByContainerId,\n    );\n  } catch (error) {\n    if (isRawHistoryUnavailableCause(error)) {\n      assertBundleMatchesUpdateHeaders({\n        ...input,\n        requireOriginalTargets: true,\n      });\n    }\n    throw error;\n  }\n}\n\n/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */\nexport function throwDocumentSyncContentKeyFailure(input: {\n  cause: unknown;\n  updates: readonly SyncResponseUpdate[];\n}): never {\n  if (isKeyingVerificationError(input.cause)) {\n    throw input.cause;\n  }\n  if (\n    input.cause instanceof DocumentHistoryUnavailableError &&\n    isKeyingVerificationError(input.cause.historyCause)\n  ) {\n    throw input.cause.historyCause;\n  }\n  throw isolateDocumentSyncBatchError({\n    cause: input.cause,\n    stage: \"content_key\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nexport async function unwrapDocumentSyncResponseContentKeys(\n  input: {\n    currentContentKey: Uint8Array;\n    currentContentKeyEpoch: number;\n    execSql?: ExecSql | undefined;\n    historyMode?: \"raw\" | undefined;\n    /** @internal Validate every decryptable sibling before raw availability wins. */\n    onRawHistoryUnavailable?: RawHistoryUnavailableValidator | undefined;\n    response: DocumentSyncResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<ReadonlyMap<number, Uint8Array>> {\n  // A stale read-only pass can carry an empty placeholder when none of its\n  // authorizing paths reaches the bundle target. Do not mark that epoch as\n  // resolved: every served update must instead unwrap its bundle through the\n  // verified predecessor KEK chain or fail with an honest error.\n  const contentKeysByEpoch = new Map<number, Uint8Array>(\n    input.currentContentKey.byteLength > 0\n      ? [[input.currentContentKeyEpoch, input.currentContentKey]]\n      : [],\n  );\n  const updatesByContentKeyEpoch = syncResponseUpdatesByContentKeyEpoch(\n    input.response,\n  );\n  const missingContentKeyEpochs = [...updatesByContentKeyEpoch.keys()].filter(\n    (contentKeyEpoch) => !contentKeysByEpoch.has(contentKeyEpoch),\n  );\n  missingContentKeyEpochs.sort((left, right) => left - right);\n  if (missingContentKeyEpochs.length === 0) {\n    return contentKeysByEpoch;\n  }\n  const missingUpdates = missingContentKeyEpochs.flatMap(\n    (contentKeyEpoch) => updatesByContentKeyEpoch.get(contentKeyEpoch) ?? [],\n  );\n  let bundlesByEpoch: ReturnType<typeof syncResponseContentKeyBundlesByEpoch>;\n  try {\n    bundlesByEpoch = syncResponseContentKeyBundlesByEpoch(input.response);\n  } catch (error) {\n    throwDocumentSyncContentKeyFailure({\n      cause: error,\n      updates: missingUpdates,\n    });\n  }\n  const absentBundleEpoch = missingContentKeyEpochs.find(\n    (contentKeyEpoch) => !bundlesByEpoch.has(contentKeyEpoch),\n  );\n  if (absentBundleEpoch !== undefined) {\n    throwDocumentSyncContentKeyFailure({\n      cause: new Error(\"Document sync response content-key bundle missing\"),\n      updates:\n        updatesByContentKeyEpoch.get(absentBundleEpoch) ?? missingUpdates,\n    });\n  }\n  const collectedKeks = await collectContainerKeksForDocumentSync({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  let unavailableRawHistory:\n    | { cause: RawHistoryUnavailableCause; contentKeyEpoch: number }\n    | undefined;\n\n  for (const contentKeyEpoch of missingContentKeyEpochs) {\n    const bundle = bundlesByEpoch.get(contentKeyEpoch);\n    const responseUpdates =\n      updatesByContentKeyEpoch.get(contentKeyEpoch) ?? missingUpdates;\n    if (!bundle) {\n      const error = new Error(\n        \"Document sync response content-key bundle missing\",\n      );\n      throwDocumentSyncContentKeyFailure({\n        cause: error,\n        updates: responseUpdates,\n      });\n    }\n    try {\n      contentKeysByEpoch.set(\n        bundle.contentKeyEpoch,\n        await unwrapHistoricalContentKey({\n          bundle,\n          collectedKeks,\n          documentId: input.writerProjection.documentId,\n          updates: responseUpdates,\n        }),\n      );\n    } catch (error) {\n      if (input.historyMode === \"raw\" && isRawHistoryUnavailableCause(error)) {\n        unavailableRawHistory ??= { cause: error, contentKeyEpoch };\n        continue;\n      }\n      throwDocumentSyncContentKeyFailure({\n        cause: error,\n        updates: responseUpdates,\n      });\n    }\n  }\n\n  if (unavailableRawHistory) {\n    await throwRawHistoryUnavailable({\n      contentKeysByEpoch,\n      response: input.response,\n      unavailable: unavailableRawHistory,\n      validate: input.onRawHistoryUnavailable,\n    });\n  }\n\n  return contentKeysByEpoch;\n}\n"]}