@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/syncLane.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncLane.js","sourceRoot":"","sources":["syncLane.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC,uEAAuE;AACvE,uEAAuE;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAI7D,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,aAAa,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAOxC;IACC,OAAO,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CACrE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EACrC;QACE,KAAK,EAAE,YAAY,KAAK,CAAC,OAAO,EAAE;QAClC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,OAAO,CAAC,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ,EAAE,CAAC,6BAA6B,EAAE,KAAK,CAAC;QACxD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,iBAAiB,EAAE,0BAA0B;KAC9C,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAO9C;IACC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,WAAW,GAAG,gCAAgC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,WAAW;SAC5B,WAAW,EAAE;SACb,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAE,EAAE;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC7B,WAAW,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,WAAW;iBACrB,WAAW,EAAE;iBACb,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,WAAW,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,WAAW,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,IAAI,gBAAgB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC,CAAC;QACF,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,WAAW,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  getOrCreateDomainSyncCoordinator,\n  isDatabaseUnavailableError,\n  type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\n\n// Facade re-export: document stores must reach this shared sync helper\n// through this workflow boundary, not by importing data/sync directly.\nexport { sequenceUnchanged } from \"../../data/sync/sequence\";\n\nexport type DocumentSyncLane = SyncLane;\n\nfunction getDocumentSyncLaneKey(localId: string): string {\n  return `documents:${localId}`;\n}\n\nexport function registerDocumentSyncLane(input: {\n  readonly domainScope: DomainScope;\n  readonly localId: string;\n  /** Host diagnostics sink; bare runtimes do not structure errors. */\n  readonly logError?: ((message: string, error: unknown) => void) | undefined;\n  readonly run: () => Promise<void>;\n  readonly priority?: (() => number) | undefined;\n}): DocumentSyncLane {\n  return getOrCreateDomainSyncCoordinator(input.domainScope).registerLane(\n    getDocumentSyncLaneKey(input.localId),\n    {\n      label: `Document ${input.localId}`,\n      onUnexpectedError: (error) => {\n        console.error(`Failed to sync document ${input.localId}:`, error);\n      },\n      phase: \"document\",\n      priority: input.priority,\n      // Fixed literal: the local id stays in the console line above, never in\n      // a report. The mapped stack identifies which lane body threw. Returning\n      // the host's result hands a rejection to the lane reporter's wrapper;\n      // discarding it would surface as an unhandled rejection instead.\n      reportUnexpectedError: (error) =>\n        input.logError?.(\"Documents: sync lane failed\", error),\n      run: input.run,\n      shouldIgnoreError: isDatabaseUnavailableError,\n    },\n  );\n}\n\nexport function requestDocumentSyncLaneAndWait(input: {\n  readonly didCompleteRequest: () => boolean;\n  readonly domainScope: DomainScope;\n  readonly localId: string;\n  readonly onInvalidated?: (() => void) | undefined;\n  readonly request: () => void;\n  readonly signal?: AbortSignal | undefined;\n}): Promise<boolean> {\n  if (input.signal?.aborted) {\n    input.onInvalidated?.();\n    return Promise.resolve(false);\n  }\n  const coordinator = getOrCreateDomainSyncCoordinator(input.domainScope);\n  const laneKey = getDocumentSyncLaneKey(input.localId);\n  const initialLane = coordinator\n    .getSnapshot()\n    .lanes.find((lane) => lane.key === laneKey);\n  if (!initialLane) {\n    return Promise.resolve(false);\n  }\n  if (initialLane.runAbandoned) {\n    return Promise.resolve(false);\n  }\n  const baselineRunCount = initialLane.runCount;\n  return new Promise((resolve) => {\n    let settled = false;\n    let unsubscribe: () => void = () => undefined;\n    const finish = (completed: boolean) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      unsubscribe();\n      input.signal?.removeEventListener(\"abort\", handleAbort);\n      resolve(completed);\n    };\n    const handleAbort = () => {\n      if (settled) {\n        return;\n      }\n      input.onInvalidated?.();\n      finish(false);\n    };\n    const inspect = () => {\n      if (coordinator.isDisposed()) {\n        handleAbort();\n        return;\n      }\n      const lane = coordinator\n        .getSnapshot()\n        .lanes.find((candidate) => candidate.key === laneKey);\n      if (!lane) {\n        handleAbort();\n        return;\n      }\n      if (lane.runAbandoned) {\n        handleAbort();\n        return;\n      }\n      if (lane.runCount <= baselineRunCount || lane.running || lane.requested) {\n        return;\n      }\n      if (lane.lastAction === \"completed\" || lane.lastAction === \"failed\") {\n        finish(lane.lastAction === \"completed\" && input.didCompleteRequest());\n      }\n    };\n    unsubscribe = coordinator.subscribe(inspect);\n    input.signal?.addEventListener(\"abort\", handleAbort, { once: true });\n    if (input.signal?.aborted) {\n      handleAbort();\n      return;\n    }\n    input.request();\n    inspect();\n  });\n}\n"]}

package/workflows/documents/syncPlanIdentity.js

@@ -1,203 +0,0 @@
-import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, signWriteHeader, } from "../../internal/crypto/index.js";
-import { assertDocumentManifestBundleConsistent, normalizeDocumentKekTargetResponse, serializeCanonical, sortDocumentTargets, targetEnvelopeReference, } from "../../data/documents/shared/readers.js";
-import { readCanonicalRecord } from "../../data/keying/canonicalJson.js";
-function contentKeyBundleForSyncRequest(input) {
-    const { documentId: _omit, ...bundle } = input;
-    return bundle;
-}
-async function resolveDocumentSyncIdentity(input) {
-    const manifestIdentity = await assertDocumentManifestBundleConsistent({
-        bundle: input.documentManifest,
-        label: "Document sync manifest",
-    });
-    const documentId = input.documentId ?? input.contentKeyBundle.documentId;
-    if (documentId.length === 0) {
-        throw new Error("Document sync document id is empty");
-    }
-    if (input.contentKeyBundle.documentId !== documentId ||
-        input.documentKekTargets.documentId !== documentId ||
-        manifestIdentity.documentId !== documentId) {
-        throw new Error("Document sync state document id mismatch");
-    }
-    if (manifestIdentity.organizationId !== input.author.organizationId) {
-        throw new Error("Document sync author organization mismatch");
-    }
-    if (input.documentManifest.manifestHash !==
-        input.contentKeyBundle.linkSetManifestHash ||
-        input.documentKekTargets.linkSetManifestHash !==
-            input.contentKeyBundle.linkSetManifestHash) {
-        throw new Error("Document sync link manifest mismatch");
-    }
-    if (input.documentKekTargets.documentKeyTargetHash !==
-        input.contentKeyBundle.targetHash) {
-        throw new Error("Document sync target hash mismatch");
-    }
-    const kekTargets = normalizeDocumentKekTargetResponse(input.documentKekTargets);
-    const contentKeyTargets = sortDocumentTargets(input.contentKeyBundle.targets.map(targetEnvelopeReference));
-    if (serializeCanonical(kekTargets, "KEK targets") !==
-        serializeCanonical(contentKeyTargets, "content-key targets")) {
-        throw new Error("Document sync content-key targets mismatch");
-    }
-    const targetHash = await computeDocumentContentKeyTargetHash(kekTargets);
-    if (targetHash !== input.contentKeyBundle.targetHash) {
-        throw new Error("Document sync target hash is not canonical");
-    }
-    return {
-        documentId,
-        expectedLinkSetManifestHash: input.contentKeyBundle.linkSetManifestHash,
-        expectedTargetHash: input.contentKeyBundle.targetHash,
-        organizationId: manifestIdentity.organizationId,
-    };
-}
-function normalizeAuthorizingContainerPathRefs(refs) {
-    if (!refs || refs.length === 0) {
-        throw new Error("Document sync write authorization path refs are missing");
-    }
-    return refs.map((path, pathIndex) => {
-        if (path.length === 0) {
-            throw new Error(`Document sync write authorization path[${pathIndex}] is empty`);
-        }
-        return [...path];
-    });
-}
-export async function signDocumentOutgoingUpdate(input) {
-    const contentRecordId = input.update.contentRecordId ?? input.update.id;
-    const nonceDomain = {
-        version: 1,
-        organizationId: input.organizationId,
-        objectKind: "document",
-        objectId: input.documentId,
-        contentKeyEpoch: input.contentKeyEpoch,
-        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
-        contentRecordId,
-    };
-    const unsignedHeader = {
-        ...nonceDomain,
-        dependencyManifestHashes: [
-            ...new Set(input.authorizingContainerPathRefs.flatMap((path) => path.map((ref) => ref.manifestHash))),
-        ].sort(),
-        accessManifestHash: input.expectedLinkSetManifestHash,
-        targetHash: input.expectedTargetHash,
-        nonceDomainHash: await computeContentRecordNonceDomainHash(nonceDomain),
-        metadataHash: input.update.metadataHash,
-        ciphertextHash: input.update.ciphertextHash,
-        writerUserId: input.author.signerUserId,
-        writerDeviceId: input.author.signerDeviceId,
-        writerKeyFingerprint: input.author.signerKeyFingerprint,
-        signedAt: input.update.signedAt ?? input.signedAt,
-    };
-    const writeHeader = await signWriteHeader(unsignedHeader, input.author.signerPrivateKey);
-    return {
-        ...(input.update.checkpointKind === undefined
-            ? {}
-            : { checkpointKind: input.update.checkpointKind }),
-        ...(input.update.checkpointPayloadKind === undefined
-            ? {}
-            : { checkpointPayloadKind: input.update.checkpointPayloadKind }),
-        id: input.update.id,
-        encryptedData: input.update.encryptedData,
-        partialStartVersionVector: input.update.partialStartVersionVector,
-        partialEndVersionVector: input.update.partialEndVersionVector,
-        plaintextHash: input.update.plaintextHash,
-        ...(input.update.sourceVersionVector === undefined
-            ? {}
-            : { sourceVersionVector: input.update.sourceVersionVector }),
-        writeHeader: readCanonicalRecord(writeHeader, "Document outgoing write header"),
-    };
-}
-function assertUniqueDocumentOutgoingUpdates(updates) {
-    const updateIds = new Set();
-    const contentRecordIds = new Set();
-    for (const update of updates) {
-        if (updateIds.has(update.id)) {
-            throw new Error("Document sync update id is duplicated");
-        }
-        updateIds.add(update.id);
-        const contentRecordId = (update.contentRecordId ?? update.id).toLowerCase();
-        if (contentRecordIds.has(contentRecordId)) {
-            throw new Error("Document sync content record id is duplicated");
-        }
-        contentRecordIds.add(contentRecordId);
-    }
-}
-function assertDocumentSyncRequestMode(input, hasContainerRekeys, hasOutgoingUpdates) {
-    if (input.historyMode === "raw" && input.localVersionVector !== null) {
-        throw new Error("Document raw-history sync must start from a null version vector");
-    }
-    const hasWrites = hasOutgoingUpdates || hasContainerRekeys;
-    if (input.historyMode === "raw" && hasWrites) {
-        throw new Error("Document raw-history sync must be read-only");
-    }
-    if (input.pullCursor !== undefined && hasWrites) {
-        throw new Error("Document sync continuation must be read-only");
-    }
-    if (hasContainerRekeys && !hasOutgoingUpdates) {
-        throw new Error("Document sync container rekeys require an outgoing update");
-    }
-    if (hasContainerRekeys !== (input.inlineRekeyCommitId !== undefined)) {
-        throw new Error("Document sync inline rekey commit id must accompany container rekeys");
-    }
-}
-export async function buildDocumentSyncPlan(input) {
-    const { documentId, expectedLinkSetManifestHash, expectedTargetHash, organizationId, } = await resolveDocumentSyncIdentity(input);
-    const containerRekeys = [...(input.containerRekeys ?? [])];
-    const outgoingUpdateInputs = [...(input.outgoingUpdates ?? [])];
-    assertDocumentSyncRequestMode(input, containerRekeys.length > 0, outgoingUpdateInputs.length > 0);
-    const signedAt = input.signedAt ?? new Date().toISOString();
-    assertUniqueDocumentOutgoingUpdates(outgoingUpdateInputs);
-    const outgoingUpdates = await Promise.all(outgoingUpdateInputs.map((update) => signDocumentOutgoingUpdate({
-        authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(input.authorizingContainerPathRefs),
-        author: input.author,
-        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
-        documentId,
-        expectedLinkSetManifestHash,
-        expectedTargetHash,
-        organizationId,
-        signedAt,
-        update,
-    })));
-    // Writes always carry the verified current content-key bundle so the server
-    // can validate and materialize the current wrapping material in the same
-    // request. Read-only syncs omit it because they do not update server state.
-    const shouldIncludeContentKeyBundle = outgoingUpdates.length > 0;
-    const request = {
-        ...(shouldIncludeContentKeyBundle
-            ? {
-                contentKeyBundle: contentKeyBundleForSyncRequest(input.contentKeyBundle),
-            }
-            : {}),
-        ...(containerRekeys.length === 0 ? {} : { containerRekeys }),
-        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
-        ...(outgoingUpdates.length === 0
-            ? {}
-            : {
-                authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(input.authorizingContainerPathRefs),
-            }),
-        expectedLinkSetManifestHash,
-        expectedTargetHash,
-        ...(input.historyMode === undefined
-            ? {}
-            : { historyMode: input.historyMode }),
-        ...(input.inlineRekeyCommitId === undefined
-            ? {}
-            : { inlineRekeyCommitId: input.inlineRekeyCommitId }),
-        localVersionVector: input.localVersionVector,
-        ...(input.minLsn === undefined ? {} : { minLsn: input.minLsn }),
-        outgoingUpdates,
-        ...(input.pullCursor === undefined ? {} : { pullCursor: input.pullCursor }),
-        supportsPullPagination: true,
-    };
-    return {
-        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
-        documentId,
-        documentKekTargets: input.documentKekTargets,
-        documentManifest: input.documentManifest,
-        expectedLinkSetManifestHash,
-        expectedTargetHash,
-        minLsn: input.minLsn,
-        organizationId,
-        request,
-        sourceContentKeyBundle: input.contentKeyBundle,
-    };
-}
-//# sourceMappingURL=syncPlanIdentity.js.map

package/workflows/documents/syncPlanIdentity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncPlanIdentity.js","sourceRoot":"","sources":["syncPlanIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,mCAAmC,EACnC,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAO7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,SAAS,8BAA8B,CACrC,KAAiD;IAEjD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAiC;IAOjC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB;QAC9B,KAAK,EAAE,wBAAwB;KAChC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAChD,KAAK,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU;QAClD,gBAAgB,CAAC,UAAU,KAAK,UAAU,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACjC,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;QAC5C,KAAK,CAAC,kBAAkB,CAAC,mBAAmB;YAC1C,KAAK,CAAC,gBAAgB,CAAC,mBAAmB,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,CAAC,qBAAqB;QAC9C,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,kCAAkC,CACnD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,iBAAiB,GAAG,mBAAmB,CAC3C,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAC5D,CAAC;IACF,IACE,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC;QAC7C,kBAAkB,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,UAAU;QACV,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;QACvE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QACrD,cAAc,EAAE,gBAAgB,CAAC,cAAc;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,IAA8D;IAE9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,0CAA0C,SAAS,YAAY,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAUhD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe;KACP,CAAC;IACX,MAAM,cAAc,GAAwB;QAC1C,GAAG,WAAW;QACd,wBAAwB,EAAE;YACxB,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC,CACF;SACF,CAAC,IAAI,EAAE;QACR,kBAAkB,EAAE,KAAK,CAAC,2BAA2B;QACrD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,eAAe,EAAE,MAAM,mCAAmC,CAAC,WAAW,CAAC;QACvE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;KAClD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,cAAc,EACd,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,WAAW,EAAE,mBAAmB,CAC9B,WAAW,EACX,gCAAgC,CACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,OAA8C;IAE9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEzB,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAiC,EACjC,kBAA2B,EAC3B,kBAA2B;IAE3B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,IAAI,kBAAkB,CAAC;IAC3D,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,KAAK,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,EACJ,UAAU,EACV,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,GACf,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,oBAAoB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,6BAA6B,CAC3B,KAAK,EACL,eAAe,CAAC,MAAM,GAAG,CAAC,EAC1B,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,mCAAmC,CAAC,oBAAoB,CAAC,CAAC;IAE1D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CACvC,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,0BAA0B,CAAC;QACzB,4BAA4B,EAAE,qCAAqC,CACjE,KAAK,CAAC,4BAA4B,CACnC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,UAAU;QACV,2BAA2B;QAC3B,kBAAkB;QAClB,cAAc;QACd,QAAQ;QACR,MAAM;KACP,CAAC,CACH,CACF,CAAC;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,6BAA6B,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACjE,MAAM,OAAO,GAAwB;QACnC,GAAG,CAAC,6BAA6B;YAC/B,CAAC,CAAC;gBACE,gBAAgB,EAAE,8BAA8B,CAC9C,KAAK,CAAC,gBAAgB,CACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,4BAA4B,EAAE,qCAAqC,CACjE,KAAK,CAAC,4BAA4B,CACnC;aACF,CAAC;QACN,2BAA2B;QAC3B,kBAAkB;QAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACvD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,sBAAsB,EAAE,IAAI;KAC7B,CAAC;IAEF,OAAO;QACL,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACvD,UAAU;QACV,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,2BAA2B;QAC3B,kBAAkB;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc;QACd,OAAO;QACP,sBAAsB,EAAE,KAAK,CAAC,gBAAgB;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  signWriteHeader,\n  type UnsignedWriteHeader,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type { DocumentCreateResponse } from \"@tearleads/validators/response\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  normalizeDocumentKekTargetResponse,\n  serializeCanonical,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  BuildDocumentSyncPlanInput,\n  DocumentCreateAuthor,\n  DocumentSyncPlan,\n  DocumentSyncPreparedUpdate,\n} from \"../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\n\nfunction contentKeyBundleForSyncRequest(\n  input: DocumentCreateResponse[\"contentKeyBundle\"],\n): NonNullable<DocumentSyncRequest[\"contentKeyBundle\"]> {\n  const { documentId: _omit, ...bundle } = input;\n  return bundle;\n}\n\nasync function resolveDocumentSyncIdentity(\n  input: BuildDocumentSyncPlanInput,\n): Promise<{\n  documentId: string;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  organizationId: string;\n}> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.documentManifest,\n    label: \"Document sync manifest\",\n  });\n  const documentId = input.documentId ?? input.contentKeyBundle.documentId;\n  if (documentId.length === 0) {\n    throw new Error(\"Document sync document id is empty\");\n  }\n  if (\n    input.contentKeyBundle.documentId !== documentId ||\n    input.documentKekTargets.documentId !== documentId ||\n    manifestIdentity.documentId !== documentId\n  ) {\n    throw new Error(\"Document sync state document id mismatch\");\n  }\n  if (manifestIdentity.organizationId !== input.author.organizationId) {\n    throw new Error(\"Document sync author organization mismatch\");\n  }\n  if (\n    input.documentManifest.manifestHash !==\n      input.contentKeyBundle.linkSetManifestHash ||\n    input.documentKekTargets.linkSetManifestHash !==\n      input.contentKeyBundle.linkSetManifestHash\n  ) {\n    throw new Error(\"Document sync link manifest mismatch\");\n  }\n  if (\n    input.documentKekTargets.documentKeyTargetHash !==\n    input.contentKeyBundle.targetHash\n  ) {\n    throw new Error(\"Document sync target hash mismatch\");\n  }\n\n  const kekTargets = normalizeDocumentKekTargetResponse(\n    input.documentKekTargets,\n  );\n  const contentKeyTargets = sortDocumentTargets(\n    input.contentKeyBundle.targets.map(targetEnvelopeReference),\n  );\n  if (\n    serializeCanonical(kekTargets, \"KEK targets\") !==\n    serializeCanonical(contentKeyTargets, \"content-key targets\")\n  ) {\n    throw new Error(\"Document sync content-key targets mismatch\");\n  }\n\n  const targetHash = await computeDocumentContentKeyTargetHash(kekTargets);\n  if (targetHash !== input.contentKeyBundle.targetHash) {\n    throw new Error(\"Document sync target hash is not canonical\");\n  }\n\n  return {\n    documentId,\n    expectedLinkSetManifestHash: input.contentKeyBundle.linkSetManifestHash,\n    expectedTargetHash: input.contentKeyBundle.targetHash,\n    organizationId: manifestIdentity.organizationId,\n  };\n}\n\nfunction normalizeAuthorizingContainerPathRefs(\n  refs: readonly (readonly ContainerManifestRef[])[] | undefined,\n): ContainerManifestRef[][] {\n  if (!refs || refs.length === 0) {\n    throw new Error(\"Document sync write authorization path refs are missing\");\n  }\n\n  return refs.map((path, pathIndex) => {\n    if (path.length === 0) {\n      throw new Error(\n        `Document sync write authorization path[${pathIndex}] is empty`,\n      );\n    }\n    return [...path];\n  });\n}\n\nexport async function signDocumentOutgoingUpdate(input: {\n  authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  documentId: string;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  organizationId: string;\n  signedAt: string;\n  update: DocumentSyncPreparedUpdate;\n}): Promise<DocumentOutgoingUpdate> {\n  const contentRecordId = input.update.contentRecordId ?? input.update.id;\n  const nonceDomain = {\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId,\n  } as const;\n  const unsignedHeader: UnsignedWriteHeader = {\n    ...nonceDomain,\n    dependencyManifestHashes: [\n      ...new Set(\n        input.authorizingContainerPathRefs.flatMap((path) =>\n          path.map((ref) => ref.manifestHash),\n        ),\n      ),\n    ].sort(),\n    accessManifestHash: input.expectedLinkSetManifestHash,\n    targetHash: input.expectedTargetHash,\n    nonceDomainHash: await computeContentRecordNonceDomainHash(nonceDomain),\n    metadataHash: input.update.metadataHash,\n    ciphertextHash: input.update.ciphertextHash,\n    writerUserId: input.author.signerUserId,\n    writerDeviceId: input.author.signerDeviceId,\n    writerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.update.signedAt ?? input.signedAt,\n  };\n  const writeHeader = await signWriteHeader(\n    unsignedHeader,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    encryptedData: input.update.encryptedData,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    plaintextHash: input.update.plaintextHash,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    writeHeader: readCanonicalRecord(\n      writeHeader,\n      \"Document outgoing write header\",\n    ),\n  };\n}\n\nfunction assertUniqueDocumentOutgoingUpdates(\n  updates: readonly DocumentSyncPreparedUpdate[],\n): void {\n  const updateIds = new Set<string>();\n  const contentRecordIds = new Set<string>();\n  for (const update of updates) {\n    if (updateIds.has(update.id)) {\n      throw new Error(\"Document sync update id is duplicated\");\n    }\n    updateIds.add(update.id);\n\n    const contentRecordId = (update.contentRecordId ?? update.id).toLowerCase();\n    if (contentRecordIds.has(contentRecordId)) {\n      throw new Error(\"Document sync content record id is duplicated\");\n    }\n    contentRecordIds.add(contentRecordId);\n  }\n}\n\nfunction assertDocumentSyncRequestMode(\n  input: BuildDocumentSyncPlanInput,\n  hasContainerRekeys: boolean,\n  hasOutgoingUpdates: boolean,\n): void {\n  if (input.historyMode === \"raw\" && input.localVersionVector !== null) {\n    throw new Error(\n      \"Document raw-history sync must start from a null version vector\",\n    );\n  }\n  const hasWrites = hasOutgoingUpdates || hasContainerRekeys;\n  if (input.historyMode === \"raw\" && hasWrites) {\n    throw new Error(\"Document raw-history sync must be read-only\");\n  }\n  if (input.pullCursor !== undefined && hasWrites) {\n    throw new Error(\"Document sync continuation must be read-only\");\n  }\n  if (hasContainerRekeys && !hasOutgoingUpdates) {\n    throw new Error(\n      \"Document sync container rekeys require an outgoing update\",\n    );\n  }\n  if (hasContainerRekeys !== (input.inlineRekeyCommitId !== undefined)) {\n    throw new Error(\n      \"Document sync inline rekey commit id must accompany container rekeys\",\n    );\n  }\n}\n\nexport async function buildDocumentSyncPlan(\n  input: BuildDocumentSyncPlanInput,\n): Promise<DocumentSyncPlan> {\n  const {\n    documentId,\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    organizationId,\n  } = await resolveDocumentSyncIdentity(input);\n  const containerRekeys = [...(input.containerRekeys ?? [])];\n  const outgoingUpdateInputs = [...(input.outgoingUpdates ?? [])];\n  assertDocumentSyncRequestMode(\n    input,\n    containerRekeys.length > 0,\n    outgoingUpdateInputs.length > 0,\n  );\n  const signedAt = input.signedAt ?? new Date().toISOString();\n  assertUniqueDocumentOutgoingUpdates(outgoingUpdateInputs);\n\n  const outgoingUpdates = await Promise.all(\n    outgoingUpdateInputs.map((update) =>\n      signDocumentOutgoingUpdate({\n        authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(\n          input.authorizingContainerPathRefs,\n        ),\n        author: input.author,\n        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n        documentId,\n        expectedLinkSetManifestHash,\n        expectedTargetHash,\n        organizationId,\n        signedAt,\n        update,\n      }),\n    ),\n  );\n  // Writes always carry the verified current content-key bundle so the server\n  // can validate and materialize the current wrapping material in the same\n  // request. Read-only syncs omit it because they do not update server state.\n  const shouldIncludeContentKeyBundle = outgoingUpdates.length > 0;\n  const request: DocumentSyncRequest = {\n    ...(shouldIncludeContentKeyBundle\n      ? {\n          contentKeyBundle: contentKeyBundleForSyncRequest(\n            input.contentKeyBundle,\n          ),\n        }\n      : {}),\n    ...(containerRekeys.length === 0 ? {} : { containerRekeys }),\n    contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n    ...(outgoingUpdates.length === 0\n      ? {}\n      : {\n          authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(\n            input.authorizingContainerPathRefs,\n          ),\n        }),\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    ...(input.historyMode === undefined\n      ? {}\n      : { historyMode: input.historyMode }),\n    ...(input.inlineRekeyCommitId === undefined\n      ? {}\n      : { inlineRekeyCommitId: input.inlineRekeyCommitId }),\n    localVersionVector: input.localVersionVector,\n    ...(input.minLsn === undefined ? {} : { minLsn: input.minLsn }),\n    outgoingUpdates,\n    ...(input.pullCursor === undefined ? {} : { pullCursor: input.pullCursor }),\n    supportsPullPagination: true,\n  };\n\n  return {\n    contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n    documentId,\n    documentKekTargets: input.documentKekTargets,\n    documentManifest: input.documentManifest,\n    expectedLinkSetManifestHash,\n    expectedTargetHash,\n    minLsn: input.minLsn,\n    organizationId,\n    request,\n    sourceContentKeyBundle: input.contentKeyBundle,\n  };\n}\n"]}

package/workflows/documents/syncPlanMaterial.js

@@ -1,306 +0,0 @@
-import { emptyVersionVector, getImportBlobMetadata, satisfiesVersionVector, versionVectorsEqual, } from "../../internal/loro/index.js";
-import { documentKekTargetsFromContentKeyBundle } from "../../internal/validators/response/index.js";
-import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
-import { assertDocumentKekPathsCurrent } from "../../data/documents/shared/containerKekCurrency.js";
-import { assertDocumentWriterProjectionConsistent, authorizingContainerPathRefs, buildRotatedDocumentContentKeyBundle, ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../data/documents/shared/projection.js";
-import { assertDocumentManifestBundleConsistent } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
-import { prepareDocumentOutgoingUpdates } from "./syncContentKeys.js";
-import { buildDocumentSyncPlan } from "./syncPlanIdentity.js";
-import { finalizeMaterializedDocumentSyncPlan } from "./syncPlanProjection.js";
-import { traceCheckpointRegeneration, traceHealBlocked, traceHealPlanned, traceStaleBundle, traceStaleRead, } from "./syncTrace.js";
-/**
- * Builds the rotation baseline that anchors a stale-bundle heal: a full
- * history snapshot of the local document, re-encrypted under the fresh
- * content key so every current member (including post-rotation newcomers)
- * has an efficient current-epoch redirect. Predecessor KEKs remain the
- * correctness path when no covering baseline exists.
- */
-async function buildStaleRecoveryBaselinePendingUpdate(buildRotationSnapshot) {
-    const snapshot = buildRotationSnapshot ? await buildRotationSnapshot() : null;
-    if (!snapshot) {
-        throw new Error("Document content-key bundle is stale and no rotation snapshot is available to heal it");
-    }
-    const metadata = getImportBlobMetadata(snapshot);
-    if (metadata.mode !== "snapshot" ||
-        !versionVectorsEqual(metadata.partialStartVersionVector, emptyVersionVector())) {
-        throw new Error("Document stale-bundle recovery requires a full-history rotation snapshot");
-    }
-    const pendingFields = createPendingUpdateFields(snapshot, metadata.partialEndVersionVector);
-    if (!pendingFields) {
-        throw new Error("Document stale-bundle recovery snapshot is empty");
-    }
-    return {
-        id: crypto.randomUUID(),
-        ...pendingFields,
-    };
-}
-/**
- * Resolves the content material a sync plan encrypts and carries. A stale
- * bundle names predecessor KEK targets while the document's current targets
- * name successor epochs, so it splits by intent: a write-bearing pass heals
- * the document with a FRESH content key at the next epoch, anchored by a
- * covering rotation baseline, while a read-only pass keeps the stale pair and
- * unwraps it through predecessor KEKs so the server can settle a complete pull.
- */
-/**
- * The manifest bundle a stale read-only plan must pair with: the one the
- * stale content-key bundle actually references. A stale bundle normally
- * still carries the current link-set manifest hash (KEK rotations do not
- * advance the document manifest), but the projection consistency check
- * defensively admits a bundle lagging the head as long as it appears in the
- * manifest history — pair with that historical bundle so the plan's own
- * identity checks hold.
- */
-function staleBundleDocumentManifest(writerProjection) {
-    const { contentKeyBundle, documentManifest } = writerProjection;
-    if (contentKeyBundle.linkSetManifestHash === documentManifest.manifestHash) {
-        return documentManifest;
-    }
-    const historicalManifest = writerProjection.documentManifestHistory.find((bundle) => bundle.manifestHash === contentKeyBundle.linkSetManifestHash);
-    if (!historicalManifest) {
-        throw new Error("Document stale bundle manifest is missing from the projection history");
-    }
-    return historicalManifest;
-}
-/**
- * Settling a superseded checkpoint deletes its queue row, so the fresh
- * baseline must PROVABLY subsume it — assumed coverage would silently drop
- * any ops the checkpoint alone carried.
- */
-function assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, checkpoints) {
-    for (const checkpoint of checkpoints) {
-        if (!satisfiesVersionVector(recoveryBaseline.partialEndVersionVector, checkpoint.partialEndVersionVector)) {
-            throw new Error("Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint");
-        }
-    }
-}
-async function resolveStaleHealMaterial(input, containerKeksByEpochId, pendingUpdates) {
-    const contentKey = crypto.getRandomValues(new Uint8Array(32));
-    // A rotation checkpoint left in the queue by an interrupted earlier
-    // recovery is superseded by the fresh covering baseline built below:
-    // submitting it alongside would trip the server's covering-baseline gate,
-    // and resubmitting it after the heal could become the latest baseline at
-    // the healed epoch and mask the covering one. Hold it out of the request;
-    // on heal success its id is reported settled (the committed baseline
-    // subsumes its full-history content) so the queue row is removed.
-    //
-    // A heal whose OWN baseline does not cover the committed frontier is
-    // rejected by that same gate and surfaces as a terminal queue failure.
-    // This write-bearing pass does not pull first. A device missing committed
-    // history can independently rematerialize it through predecessor KEKs on a
-    // read-only pass, then retry with a covering snapshot. The coverage proof
-    // prevents a partial local view from becoming the redirect baseline.
-    const ordinaryPendingUpdates = pendingUpdates.filter((update) => update.sourceVersionVector == null);
-    const heldBackCheckpoints = pendingUpdates.filter((update) => update.sourceVersionVector != null);
-    const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(input.buildRotationSnapshot);
-    const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(ordinaryPendingUpdates, {
-        reservedDataCharacters: recoveryBaseline.updateData.length,
-        reservedUpdateCount: 1,
-    });
-    assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, heldBackCheckpoints);
-    const staleEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch;
-    const contentKeyBundle = await buildRotatedDocumentContentKeyBundle({
-        containerKeksByEpochId,
-        contentKey,
-        writerProjection: input.writerProjection,
-    });
-    traceHealPlanned(input.onSyncTrace, {
-        documentId: input.writerProjection.documentId,
-        fromEpoch: staleEpoch,
-        heldBack: heldBackCheckpoints.length,
-        toEpoch: contentKeyBundle.contentKeyEpoch,
-        updates: selectedOrdinaryPendingUpdates.length,
-    });
-    return {
-        contentKey,
-        contentKeyBundle,
-        documentKekTargets: input.writerProjection.documentKekTargets,
-        documentManifest: input.writerProjection.documentManifest,
-        healedStaleContentKeyBundle: true,
-        heldBackPendingUpdateIds: heldBackCheckpoints.map((update) => update.id),
-        pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],
-        staleRecoveryBaselineUpdateId: recoveryBaseline.id,
-    };
-}
-/**
- * Reactive repair for a healthy-projection pass whose queued rotation
- * checkpoint the server rejected via the covering-baseline gate (a leftover
- * from an interrupted recovery, a heal whose ack was lost, or a lost heal
- * race). Queued checkpoints normally pass through untouched — reset and
- * rotation flows legitimately submit them — but a rejected one would strand
- * the whole queue, and committing it could shrink redirect coverage. Replace
- * the stale checkpoints with one freshly regenerated covering baseline and
- * settle them on success (coverage proven above).
- */
-async function resolveCheckpointRegenerationMaterial(input, base, pendingUpdates) {
-    const ordinaryPendingUpdates = pendingUpdates.filter((update) => update.sourceVersionVector == null);
-    const queuedCheckpoints = pendingUpdates.filter((update) => update.sourceVersionVector != null);
-    const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(input.buildRotationSnapshot);
-    const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(ordinaryPendingUpdates, {
-        reservedDataCharacters: recoveryBaseline.updateData.length,
-        reservedUpdateCount: 1,
-    });
-    assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, queuedCheckpoints);
-    traceCheckpointRegeneration(input.onSyncTrace, {
-        checkpoints: queuedCheckpoints.length,
-        documentId: input.writerProjection.documentId,
-        updates: selectedOrdinaryPendingUpdates.length,
-    });
-    return {
-        ...base,
-        heldBackPendingUpdateIds: queuedCheckpoints.map((update) => update.id),
-        pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],
-        staleRecoveryBaselineUpdateId: recoveryBaseline.id,
-    };
-}
-async function resolveSyncPlanContentMaterial(input, collectedKeks) {
-    const allPendingUpdates = input.pendingUpdates ?? [];
-    if (allPendingUpdates.length > 0 || input.regenerateQueuedCheckpoints) {
-        assertDocumentKekPathsCurrent(input.writerProjection);
-    }
-    const staleContentKeyBundle = input.writerProjection.contentKeyBundleStale === true;
-    if (staleContentKeyBundle && allPendingUpdates.length > 0) {
-        traceStaleBundle(input.onSyncTrace, {
-            documentId: input.writerProjection.documentId,
-            epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,
-            pending: allPendingUpdates.length,
-        });
-        return resolveStaleHealMaterial(input, collectedKeks.keksByEpochId, allPendingUpdates);
-    }
-    const pendingUpdates = selectDocumentSyncOutgoingBatch(allPendingUpdates);
-    if (staleContentKeyBundle) {
-        traceStaleRead(input.onSyncTrace, {
-            documentId: input.writerProjection.documentId,
-            epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,
-        });
-        // Current access includes every predecessor KEK. If damaged history makes
-        // this old bundle unreachable, preserve the bridge-integrity failure: this
-        // read actually needs that historical epoch and cannot safely continue.
-        let staleContentKey;
-        try {
-            staleContentKey = await unwrapDocumentContentKeyFromBundle(input.writerProjection.contentKeyBundle, input.writerProjection.documentId, collectedKeks.keksByEpochId, collectedKeks.predecessorFailuresByEpochId, collectedKeks.unattributedPredecessorFailuresByContainerId);
-        }
-        catch (error) {
-            if (error instanceof DocumentHistoryUnavailableError) {
-                if (input.historyMode !== "raw" ||
-                    !(error.historyCause instanceof ContainerKekHistoryUnavailableError)) {
-                    throw error;
-                }
-            }
-            // A stale bundle can predate the requester's current authorizing links.
-            // Keep the read-only pass alive; served updates that need this absent key
-            // remain undecryptable until a spanning member heals the bundle.
-            staleContentKey = new Uint8Array();
-        }
-        return {
-            contentKey: staleContentKey,
-            contentKeyBundle: input.writerProjection.contentKeyBundle,
-            documentKekTargets: documentKekTargetsFromContentKeyBundle(input.writerProjection.contentKeyBundle),
-            documentManifest: staleBundleDocumentManifest(input.writerProjection),
-            healedStaleContentKeyBundle: false,
-            heldBackPendingUpdateIds: [],
-            pendingUpdates,
-        };
-    }
-    const normalMaterial = {
-        contentKey: await unwrapDocumentContentKeyFromBundle(input.writerProjection.contentKeyBundle, input.writerProjection.documentId, collectedKeks.keksByEpochId, collectedKeks.predecessorFailuresByEpochId, collectedKeks.unattributedPredecessorFailuresByContainerId),
-        contentKeyBundle: input.writerProjection.contentKeyBundle,
-        documentKekTargets: input.writerProjection.documentKekTargets,
-        documentManifest: input.writerProjection.documentManifest,
-        healedStaleContentKeyBundle: false,
-        heldBackPendingUpdateIds: [],
-        pendingUpdates,
-    };
-    if (input.regenerateQueuedCheckpoints === true &&
-        allPendingUpdates.some((update) => update.sourceVersionVector != null)) {
-        return resolveCheckpointRegenerationMaterial(input, normalMaterial, allPendingUpdates);
-    }
-    return normalMaterial;
-}
-export async function buildMaterializedDocumentSyncPlan(input) {
-    // Reuse verification across consistency and unwrap passes; unwrap still
-    // binds the key material independently.
-    const verifiedByHash = new Map();
-    const principalPolicyCache = new Map();
-    let writerAuthorization;
-    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
-        allowStaleContentKeyBundle: true,
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        onVerifiedAuthorization: (authorization) => {
-            writerAuthorization = authorization;
-        },
-        principalPolicyCache,
-        verifiedByHash,
-        ...projectionVerificationOptions(input),
-    });
-    const collectedKeks = await collectContainerKeksForDocumentSync({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache,
-        secretKey: input.targetSecretKey,
-        verifiedByHash,
-        writerProjection: input.writerProjection,
-        ...projectionVerificationOptions(input),
-    });
-    const documentId = input.writerProjection.documentId;
-    const manifestIdentity = await assertDocumentManifestBundleConsistent({
-        bundle: input.writerProjection.documentManifest,
-        label: "Document sync manifest",
-    });
-    let material;
-    try {
-        material = await resolveSyncPlanContentMaterial(input, collectedKeks);
-    }
-    catch (error) {
-        // Only a stale-bundle HEAL (write-bearing) or a checkpoint regeneration
-        // counts as a blocked recovery; an ordinary pass or a stale READ failing
-        // here must not read as one in a support report. Enumerated reason only;
-        // unknown errors emit nothing (fail closed).
-        if ((input.writerProjection.contentKeyBundleStale === true &&
-            (input.pendingUpdates ?? []).length > 0) ||
-            input.regenerateQueuedCheckpoints === true) {
-            traceHealBlocked(input.onSyncTrace, {
-                documentId: input.writerProjection.documentId,
-                error,
-            });
-        }
-        throw error;
-    }
-    const { contentKey, contentKeyBundle, documentKekTargets, documentManifest, pendingUpdates, } = material;
-    const outgoingUpdates = await prepareDocumentOutgoingUpdates({
-        contentKey,
-        contentKeyEpoch: contentKeyBundle.contentKeyEpoch,
-        documentId,
-        organizationId: manifestIdentity.organizationId,
-        pendingUpdates,
-    });
-    const basePlan = await buildDocumentSyncPlan({
-        author: {
-            ...input.author,
-            organizationId: manifestIdentity.organizationId,
-        },
-        authorizingContainerPathRefs: authorizingContainerPathRefs(input.writerProjection),
-        containerRekeys: input.containerRekeys,
-        contentKeyBundle,
-        documentId,
-        documentKekTargets,
-        documentManifest,
-        historyMode: input.historyMode,
-        inlineRekeyCommitId: input.inlineRekeyCommitId,
-        localVersionVector: input.localVersionVector,
-        minLsn: input.minLsn,
-        outgoingUpdates,
-        pullCursor: input.pullCursor,
-        signedAt: input.signedAt,
-    });
-    return finalizeMaterializedDocumentSyncPlan({
-        basePlan,
-        material,
-        writerAuthorization,
-        writerProjection: input.writerProjection,
-    });
-}
-//# sourceMappingURL=syncPlanMaterial.js.map

package/workflows/documents/syncPlanMaterial.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncPlanMaterial.js","sourceRoot":"","sources":["syncPlanMaterial.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,sCAAsC,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EACL,wCAAwC,EACxC,4BAA4B,EAC5B,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAO7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAIlF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAEL,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,KAAK,UAAU,uCAAuC,CACpD,qBAAqE;IAErE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;QAC5B,CAAC,mBAAmB,CAClB,QAAQ,CAAC,yBAAyB,EAClC,kBAAkB,EAAE,CACrB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAC7C,QAAQ,EACR,QAAQ,CAAC,uBAAuB,CACjC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAClC,gBAAkD;IAElD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC;IAChE,IAAI,gBAAgB,CAAC,mBAAmB,KAAK,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CACtE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,gBAAgB,CAAC,mBAAmB,CACzE,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,uCAAuC,CAC9C,gBAAqC,EACrC,WAA2C;IAE3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,sBAAsB,CACrB,gBAAgB,CAAC,uBAAuB,EACxC,UAAU,CAAC,uBAAuB,CACnC,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,wBAAwB,CACrC,KAA8D,EAC9D,sBAAuD,EACvD,cAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAC/C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CACrC,gBAAgB,EAChB,mBAAmB,CACpB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC3E,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,sBAAsB;QACtB,UAAU;QACV,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,mBAAmB,CAAC,MAAM;QACpC,OAAO,EAAE,gBAAgB,CAAC,eAAe;QACzC,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,gBAAgB;QAChB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,IAAI;QACjC,wBAAwB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAA8D,EAC9D,IAAqC,EACrC,cAA8C;IAE9C,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,2BAA2B,CAAC,KAAK,CAAC,WAAW,EAAE;QAC7C,WAAW,EAAE,iBAAiB,CAAC,MAAM;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,wBAAwB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA8D,EAC9D,aAEC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IACrD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtE,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAExD,IAAI,qBAAqB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;YAC9D,OAAO,EAAE,iBAAiB,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAC7B,KAAK,EACL,aAAa,CAAC,aAAa,EAC3B,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,CAAC;IAE1E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE;YAChC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;SAC/D,CAAC,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;gBACrD,IACE,KAAK,CAAC,WAAW,KAAK,KAAK;oBAC3B,CAAC,CAAC,KAAK,CAAC,YAAY,YAAY,mCAAmC,CAAC,EACpE,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,eAAe,GAAG,IAAI,UAAU,EAAE,CAAC;QACrC,CAAC;QACD,OAAO;YACL,UAAU,EAAE,eAAe;YAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;YACzD,kBAAkB,EAAE,sCAAsC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CACxC;YACD,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACrE,2BAA2B,EAAE,KAAK;YAClC,wBAAwB,EAAE,EAAE;YAC5B,cAAc;SACf,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAoC;QACtD,UAAU,EAAE,MAAM,kCAAkC,CAClD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,KAAK;QAClC,wBAAwB,EAAE,EAAE;QAC5B,cAAc;KACf,CAAC;IACF,IACE,KAAK,CAAC,2BAA2B,KAAK,IAAI;QAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,EACtE,CAAC;QACD,OAAO,qCAAqC,CAC1C,KAAK,EACL,cAAc,EACd,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KA6BiC;IAEjC,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxE,IAAI,mBAAsE,CAAC;IAC3E,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,mBAAmB,GAAG,aAAa,CAAC;QACtC,CAAC;QACD,oBAAoB;QACpB,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB;QACpB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,wBAAwB;KAChC,CAAC,CAAC;IACH,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,6CAA6C;QAC7C,IACE,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI;YACpD,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,KAAK,CAAC,2BAA2B,KAAK,IAAI,EAC1C,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;gBAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EACJ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,GAAG,QAAQ,CAAC;IACb,MAAM,eAAe,GAAG,MAAM,8BAA8B,CAAC;QAC3D,UAAU;QACV,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,UAAU;QACV,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,cAAc;KACf,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD;QACD,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB;QAChB,UAAU;QACV,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,oCAAoC,CAAC;QAC1C,QAAQ;QACR,QAAQ;QACR,mBAAmB;QACnB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  VerifiedContainerAccessManifest,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport {\n  emptyVersionVector,\n  getImportBlobMetadata,\n  satisfiesVersionVector,\n  versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type {\n  DocumentCreateResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { documentKekTargetsFromContentKeyBundle } from \"@tearleads/validators/response\";\nimport { createPendingUpdateFields } from \"../../data/documents/documentSync\";\nimport { assertDocumentKekPathsCurrent } from \"../../data/documents/shared/containerKekCurrency\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  authorizingContainerPathRefs,\n  buildRotatedDocumentContentKeyBundle,\n  ContainerKekHistoryUnavailableError,\n  collectContainerKeksForDocumentSync,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n} from \"../../data/documents/shared/projection\";\nimport { assertDocumentManifestBundleConsistent } from \"../../data/documents/shared/readers\";\nimport type {\n  BuildDocumentSyncPlanInput,\n  DocumentCreateAuthor,\n  MaterializedDocumentSyncPlan,\n  ProjectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../data/keyingProjectionVerification\";\nimport type { PendingUpdateRecord } from \"../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { selectDocumentSyncOutgoingBatch } from \"../../data/sync/documentSyncOutgoingBatch\";\nimport { prepareDocumentOutgoingUpdates } from \"./syncContentKeys\";\nimport { buildDocumentSyncPlan } from \"./syncPlanIdentity\";\nimport { finalizeMaterializedDocumentSyncPlan } from \"./syncPlanProjection\";\nimport {\n  type DocumentSyncTraceEmitter,\n  traceCheckpointRegeneration,\n  traceHealBlocked,\n  traceHealPlanned,\n  traceStaleBundle,\n  traceStaleRead,\n} from \"./syncTrace\";\n\n/**\n * Builds the rotation baseline that anchors a stale-bundle heal: a full\n * history snapshot of the local document, re-encrypted under the fresh\n * content key so every current member (including post-rotation newcomers)\n * has an efficient current-epoch redirect. Predecessor KEKs remain the\n * correctness path when no covering baseline exists.\n */\nasync function buildStaleRecoveryBaselinePendingUpdate(\n  buildRotationSnapshot: (() => Promise<Uint8Array | null>) | undefined,\n): Promise<PendingUpdateRecord> {\n  const snapshot = buildRotationSnapshot ? await buildRotationSnapshot() : null;\n  if (!snapshot) {\n    throw new Error(\n      \"Document content-key bundle is stale and no rotation snapshot is available to heal it\",\n    );\n  }\n  const metadata = getImportBlobMetadata(snapshot);\n  if (\n    metadata.mode !== \"snapshot\" ||\n    !versionVectorsEqual(\n      metadata.partialStartVersionVector,\n      emptyVersionVector(),\n    )\n  ) {\n    throw new Error(\n      \"Document stale-bundle recovery requires a full-history rotation snapshot\",\n    );\n  }\n  const pendingFields = createPendingUpdateFields(\n    snapshot,\n    metadata.partialEndVersionVector,\n  );\n  if (!pendingFields) {\n    throw new Error(\"Document stale-bundle recovery snapshot is empty\");\n  }\n\n  return {\n    id: crypto.randomUUID(),\n    ...pendingFields,\n  };\n}\n\n/**\n * Resolves the content material a sync plan encrypts and carries. A stale\n * bundle names predecessor KEK targets while the document's current targets\n * name successor epochs, so it splits by intent: a write-bearing pass heals\n * the document with a FRESH content key at the next epoch, anchored by a\n * covering rotation baseline, while a read-only pass keeps the stale pair and\n * unwraps it through predecessor KEKs so the server can settle a complete pull.\n */\n/**\n * The manifest bundle a stale read-only plan must pair with: the one the\n * stale content-key bundle actually references. A stale bundle normally\n * still carries the current link-set manifest hash (KEK rotations do not\n * advance the document manifest), but the projection consistency check\n * defensively admits a bundle lagging the head as long as it appears in the\n * manifest history — pair with that historical bundle so the plan's own\n * identity checks hold.\n */\nfunction staleBundleDocumentManifest(\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentCreateResponse[\"accessManifest\"] {\n  const { contentKeyBundle, documentManifest } = writerProjection;\n  if (contentKeyBundle.linkSetManifestHash === documentManifest.manifestHash) {\n    return documentManifest;\n  }\n  const historicalManifest = writerProjection.documentManifestHistory.find(\n    (bundle) => bundle.manifestHash === contentKeyBundle.linkSetManifestHash,\n  );\n  if (!historicalManifest) {\n    throw new Error(\n      \"Document stale bundle manifest is missing from the projection history\",\n    );\n  }\n  return historicalManifest;\n}\n\n/**\n * Settling a superseded checkpoint deletes its queue row, so the fresh\n * baseline must PROVABLY subsume it — assumed coverage would silently drop\n * any ops the checkpoint alone carried.\n */\nfunction assertRecoveryBaselineCoversCheckpoints(\n  recoveryBaseline: PendingUpdateRecord,\n  checkpoints: readonly PendingUpdateRecord[],\n): void {\n  for (const checkpoint of checkpoints) {\n    if (\n      !satisfiesVersionVector(\n        recoveryBaseline.partialEndVersionVector,\n        checkpoint.partialEndVersionVector,\n      )\n    ) {\n      throw new Error(\n        \"Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint\",\n      );\n    }\n  }\n}\n\ninterface ResolvedSyncPlanContentMaterial {\n  contentKey: Uint8Array;\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  healedStaleContentKeyBundle: boolean;\n  heldBackPendingUpdateIds: readonly string[];\n  pendingUpdates: readonly PendingUpdateRecord[];\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nasync function resolveStaleHealMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>,\n  pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const contentKey = crypto.getRandomValues(new Uint8Array(32));\n  // A rotation checkpoint left in the queue by an interrupted earlier\n  // recovery is superseded by the fresh covering baseline built below:\n  // submitting it alongside would trip the server's covering-baseline gate,\n  // and resubmitting it after the heal could become the latest baseline at\n  // the healed epoch and mask the covering one. Hold it out of the request;\n  // on heal success its id is reported settled (the committed baseline\n  // subsumes its full-history content) so the queue row is removed.\n  //\n  // A heal whose OWN baseline does not cover the committed frontier is\n  // rejected by that same gate and surfaces as a terminal queue failure.\n  // This write-bearing pass does not pull first. A device missing committed\n  // history can independently rematerialize it through predecessor KEKs on a\n  // read-only pass, then retry with a covering snapshot. The coverage proof\n  // prevents a partial local view from becoming the redirect baseline.\n  const ordinaryPendingUpdates = pendingUpdates.filter(\n    (update) => update.sourceVersionVector == null,\n  );\n  const heldBackCheckpoints = pendingUpdates.filter(\n    (update) => update.sourceVersionVector != null,\n  );\n  const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n    input.buildRotationSnapshot,\n  );\n  const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n    ordinaryPendingUpdates,\n    {\n      reservedDataCharacters: recoveryBaseline.updateData.length,\n      reservedUpdateCount: 1,\n    },\n  );\n  assertRecoveryBaselineCoversCheckpoints(\n    recoveryBaseline,\n    heldBackCheckpoints,\n  );\n  const staleEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch;\n  const contentKeyBundle = await buildRotatedDocumentContentKeyBundle({\n    containerKeksByEpochId,\n    contentKey,\n    writerProjection: input.writerProjection,\n  });\n  traceHealPlanned(input.onSyncTrace, {\n    documentId: input.writerProjection.documentId,\n    fromEpoch: staleEpoch,\n    heldBack: heldBackCheckpoints.length,\n    toEpoch: contentKeyBundle.contentKeyEpoch,\n    updates: selectedOrdinaryPendingUpdates.length,\n  });\n  return {\n    contentKey,\n    contentKeyBundle,\n    documentKekTargets: input.writerProjection.documentKekTargets,\n    documentManifest: input.writerProjection.documentManifest,\n    healedStaleContentKeyBundle: true,\n    heldBackPendingUpdateIds: heldBackCheckpoints.map((update) => update.id),\n    pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n    staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n  };\n}\n\n/**\n * Reactive repair for a healthy-projection pass whose queued rotation\n * checkpoint the server rejected via the covering-baseline gate (a leftover\n * from an interrupted recovery, a heal whose ack was lost, or a lost heal\n * race). Queued checkpoints normally pass through untouched — reset and\n * rotation flows legitimately submit them — but a rejected one would strand\n * the whole queue, and committing it could shrink redirect coverage. Replace\n * the stale checkpoints with one freshly regenerated covering baseline and\n * settle them on success (coverage proven above).\n */\nasync function resolveCheckpointRegenerationMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  base: ResolvedSyncPlanContentMaterial,\n  pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const ordinaryPendingUpdates = pendingUpdates.filter(\n    (update) => update.sourceVersionVector == null,\n  );\n  const queuedCheckpoints = pendingUpdates.filter(\n    (update) => update.sourceVersionVector != null,\n  );\n  const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n    input.buildRotationSnapshot,\n  );\n  const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n    ordinaryPendingUpdates,\n    {\n      reservedDataCharacters: recoveryBaseline.updateData.length,\n      reservedUpdateCount: 1,\n    },\n  );\n  assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, queuedCheckpoints);\n  traceCheckpointRegeneration(input.onSyncTrace, {\n    checkpoints: queuedCheckpoints.length,\n    documentId: input.writerProjection.documentId,\n    updates: selectedOrdinaryPendingUpdates.length,\n  });\n  return {\n    ...base,\n    heldBackPendingUpdateIds: queuedCheckpoints.map((update) => update.id),\n    pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n    staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n  };\n}\n\nasync function resolveSyncPlanContentMaterial(\n  input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n  collectedKeks: Awaited<\n    ReturnType<typeof collectContainerKeksForDocumentSync>\n  >,\n): Promise<ResolvedSyncPlanContentMaterial> {\n  const allPendingUpdates = input.pendingUpdates ?? [];\n  if (allPendingUpdates.length > 0 || input.regenerateQueuedCheckpoints) {\n    assertDocumentKekPathsCurrent(input.writerProjection);\n  }\n  const staleContentKeyBundle =\n    input.writerProjection.contentKeyBundleStale === true;\n\n  if (staleContentKeyBundle && allPendingUpdates.length > 0) {\n    traceStaleBundle(input.onSyncTrace, {\n      documentId: input.writerProjection.documentId,\n      epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n      pending: allPendingUpdates.length,\n    });\n    return resolveStaleHealMaterial(\n      input,\n      collectedKeks.keksByEpochId,\n      allPendingUpdates,\n    );\n  }\n\n  const pendingUpdates = selectDocumentSyncOutgoingBatch(allPendingUpdates);\n\n  if (staleContentKeyBundle) {\n    traceStaleRead(input.onSyncTrace, {\n      documentId: input.writerProjection.documentId,\n      epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n    });\n    // Current access includes every predecessor KEK. If damaged history makes\n    // this old bundle unreachable, preserve the bridge-integrity failure: this\n    // read actually needs that historical epoch and cannot safely continue.\n    let staleContentKey: Uint8Array;\n    try {\n      staleContentKey = await unwrapDocumentContentKeyFromBundle(\n        input.writerProjection.contentKeyBundle,\n        input.writerProjection.documentId,\n        collectedKeks.keksByEpochId,\n        collectedKeks.predecessorFailuresByEpochId,\n        collectedKeks.unattributedPredecessorFailuresByContainerId,\n      );\n    } catch (error) {\n      if (error instanceof DocumentHistoryUnavailableError) {\n        if (\n          input.historyMode !== \"raw\" ||\n          !(error.historyCause instanceof ContainerKekHistoryUnavailableError)\n        ) {\n          throw error;\n        }\n      }\n      // A stale bundle can predate the requester's current authorizing links.\n      // Keep the read-only pass alive; served updates that need this absent key\n      // remain undecryptable until a spanning member heals the bundle.\n      staleContentKey = new Uint8Array();\n    }\n    return {\n      contentKey: staleContentKey,\n      contentKeyBundle: input.writerProjection.contentKeyBundle,\n      documentKekTargets: documentKekTargetsFromContentKeyBundle(\n        input.writerProjection.contentKeyBundle,\n      ),\n      documentManifest: staleBundleDocumentManifest(input.writerProjection),\n      healedStaleContentKeyBundle: false,\n      heldBackPendingUpdateIds: [],\n      pendingUpdates,\n    };\n  }\n\n  const normalMaterial: ResolvedSyncPlanContentMaterial = {\n    contentKey: await unwrapDocumentContentKeyFromBundle(\n      input.writerProjection.contentKeyBundle,\n      input.writerProjection.documentId,\n      collectedKeks.keksByEpochId,\n      collectedKeks.predecessorFailuresByEpochId,\n      collectedKeks.unattributedPredecessorFailuresByContainerId,\n    ),\n    contentKeyBundle: input.writerProjection.contentKeyBundle,\n    documentKekTargets: input.writerProjection.documentKekTargets,\n    documentManifest: input.writerProjection.documentManifest,\n    healedStaleContentKeyBundle: false,\n    heldBackPendingUpdateIds: [],\n    pendingUpdates,\n  };\n  if (\n    input.regenerateQueuedCheckpoints === true &&\n    allPendingUpdates.some((update) => update.sourceVersionVector != null)\n  ) {\n    return resolveCheckpointRegenerationMaterial(\n      input,\n      normalMaterial,\n      allPendingUpdates,\n    );\n  }\n\n  return normalMaterial;\n}\n\nexport async function buildMaterializedDocumentSyncPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    /**\n     * Supplies a full-history Loro snapshot of the local document when a\n     * stale content-key bundle must be healed, or when a leftover queued\n     * rotation checkpoint must be regenerated as a covering baseline.\n     * Without it those passes fail with a descriptive error instead.\n     */\n    buildRotationSnapshot?: (() => Promise<Uint8Array | null>) | undefined;\n    containerRekeys?: BuildDocumentSyncPlanInput[\"containerRekeys\"];\n    execSql?: ExecSql | undefined;\n    historyMode?: \"raw\" | undefined;\n    inlineRekeyCommitId?: string | undefined;\n    localVersionVector: string | null;\n    minLsn?: string | undefined;\n    pullCursor?: string | undefined;\n    /** Clipboard-safe trace sink (see syncTrace.ts); never receives content. */\n    onSyncTrace?: DocumentSyncTraceEmitter | undefined;\n    pendingUpdates?: readonly PendingUpdateRecord[] | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    /**\n     * Replace queued rotation checkpoints with a freshly regenerated covering\n     * baseline instead of passing them through. Set by the sync loop after\n     * the server rejected a pass via the covering-baseline gate.\n     */\n    regenerateQueuedCheckpoints?: boolean | undefined;\n    signedAt?: string | undefined;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentSyncPlan> {\n  // Reuse verification across consistency and unwrap passes; unwrap still\n  // binds the key material independently.\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache = new Map<string, VerifiedPrincipalPolicy>();\n  let writerAuthorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    allowStaleContentKeyBundle: true,\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    onVerifiedAuthorization: (authorization) => {\n      writerAuthorization = authorization;\n    },\n    principalPolicyCache,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const collectedKeks = await collectContainerKeksForDocumentSync({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  const documentId = input.writerProjection.documentId;\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document sync manifest\",\n  });\n  let material: ResolvedSyncPlanContentMaterial;\n  try {\n    material = await resolveSyncPlanContentMaterial(input, collectedKeks);\n  } catch (error) {\n    // Only a stale-bundle HEAL (write-bearing) or a checkpoint regeneration\n    // counts as a blocked recovery; an ordinary pass or a stale READ failing\n    // here must not read as one in a support report. Enumerated reason only;\n    // unknown errors emit nothing (fail closed).\n    if (\n      (input.writerProjection.contentKeyBundleStale === true &&\n        (input.pendingUpdates ?? []).length > 0) ||\n      input.regenerateQueuedCheckpoints === true\n    ) {\n      traceHealBlocked(input.onSyncTrace, {\n        documentId: input.writerProjection.documentId,\n        error,\n      });\n    }\n    throw error;\n  }\n  const {\n    contentKey,\n    contentKeyBundle,\n    documentKekTargets,\n    documentManifest,\n    pendingUpdates,\n  } = material;\n  const outgoingUpdates = await prepareDocumentOutgoingUpdates({\n    contentKey,\n    contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n    documentId,\n    organizationId: manifestIdentity.organizationId,\n    pendingUpdates,\n  });\n  const basePlan = await buildDocumentSyncPlan({\n    author: {\n      ...input.author,\n      organizationId: manifestIdentity.organizationId,\n    },\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.writerProjection,\n    ),\n    containerRekeys: input.containerRekeys,\n    contentKeyBundle,\n    documentId,\n    documentKekTargets,\n    documentManifest,\n    historyMode: input.historyMode,\n    inlineRekeyCommitId: input.inlineRekeyCommitId,\n    localVersionVector: input.localVersionVector,\n    minLsn: input.minLsn,\n    outgoingUpdates,\n    pullCursor: input.pullCursor,\n    signedAt: input.signedAt,\n  });\n  return finalizeMaterializedDocumentSyncPlan({\n    basePlan,\n    material,\n    writerAuthorization,\n    writerProjection: input.writerProjection,\n  });\n}\n"]}