npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.63 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (653) hide show

package/workflows/documents/{syncPlanMaterial.js → syncPlan/syncPlanMaterial.js} RENAMED Viewed

@@ -1,15 +1,15 @@
-import { emptyVersionVector, getImportBlobMetadata, satisfiesVersionVector, versionVectorsEqual, } from "../../internal/loro/index.js";
-import { documentKekTargetsFromContentKeyBundle } from "../../internal/validators/response/index.js";
-import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
-import { assertDocumentKekPathsCurrent } from "../../data/documents/shared/containerKekCurrency.js";
-import { assertDocumentWriterProjectionConsistent, authorizingContainerPathRefs, buildRotatedDocumentContentKeyBundle, ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../data/documents/shared/projection.js";
-import { assertDocumentManifestBundleConsistent } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
+import { emptyVersionVector, getImportBlobMetadata, satisfiesVersionVector, versionVectorsEqual, } from "../../../internal/loro/index.js";
+import { documentKekTargetsFromContentKeyBundle } from "../../../internal/validators/response/index.js";
+import { createPendingUpdateFields } from "../../../data/documents/documentSync.js";
+import { assertDocumentKekPathsCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
+import { assertDocumentWriterProjectionConsistent, authorizingContainerPathRefs, buildRotatedDocumentContentKeyBundle, ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { selectDocumentSyncOutgoingBatch } from "../../../data/sync/documentSyncOutgoingBatch.js";
+import { traceCheckpointRegeneration, traceHealBlocked, traceHealPlanned, traceStaleBundle, traceStaleRead, } from "../sync/syncTrace.js";
 import { prepareDocumentOutgoingUpdates } from "./syncContentKeys.js";
 import { buildDocumentSyncPlan } from "./syncPlanIdentity.js";
 import { finalizeMaterializedDocumentSyncPlan } from "./syncPlanProjection.js";
-import { traceCheckpointRegeneration, traceHealBlocked, traceHealPlanned, traceStaleBundle, traceStaleRead, } from "./syncTrace.js";
 /**
  * Builds the rotation baseline that anchors a stale-bundle heal: a full
  * history snapshot of the local document, re-encrypted under the fresh

package/workflows/documents/syncPlan/syncPlanMaterial.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncPlanMaterial.js","sourceRoot":"","sources":["syncPlanMaterial.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,sCAAsC,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EACL,wCAAwC,EACxC,4BAA4B,EAC5B,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AAOhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAIrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAEL,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;GAMG;AACH,KAAK,UAAU,uCAAuC,CACpD,qBAAqE;IAErE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;QAC5B,CAAC,mBAAmB,CAClB,QAAQ,CAAC,yBAAyB,EAClC,kBAAkB,EAAE,CACrB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAC7C,QAAQ,EACR,QAAQ,CAAC,uBAAuB,CACjC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAClC,gBAAkD;IAElD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC;IAChE,IAAI,gBAAgB,CAAC,mBAAmB,KAAK,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CACtE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,gBAAgB,CAAC,mBAAmB,CACzE,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,uCAAuC,CAC9C,gBAAqC,EACrC,WAA2C;IAE3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,sBAAsB,CACrB,gBAAgB,CAAC,uBAAuB,EACxC,UAAU,CAAC,uBAAuB,CACnC,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,wBAAwB,CACrC,KAA8D,EAC9D,sBAAuD,EACvD,cAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAC/C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CACrC,gBAAgB,EAChB,mBAAmB,CACpB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC3E,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,sBAAsB;QACtB,UAAU;QACV,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,mBAAmB,CAAC,MAAM;QACpC,OAAO,EAAE,gBAAgB,CAAC,eAAe;QACzC,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,gBAAgB;QAChB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,IAAI;QACjC,wBAAwB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAA8D,EAC9D,IAAqC,EACrC,cAA8C;IAE9C,MAAM,sBAAsB,GAAG,cAAc,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CACpE,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,MAAM,8BAA8B,GAAG,+BAA+B,CACpE,sBAAsB,EACtB;QACE,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM;QAC1D,mBAAmB,EAAE,CAAC;KACvB,CACF,CAAC;IACF,uCAAuC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,2BAA2B,CAAC,KAAK,CAAC,WAAW,EAAE;QAC7C,WAAW,EAAE,iBAAiB,CAAC,MAAM;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,wBAAwB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,cAAc,EAAE,CAAC,gBAAgB,EAAE,GAAG,8BAA8B,CAAC;QACrE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA8D,EAC9D,aAEC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IACrD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtE,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAExD,IAAI,qBAAqB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;YAC9D,OAAO,EAAE,iBAAiB,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAC7B,KAAK,EACL,aAAa,CAAC,aAAa,EAC3B,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,CAAC;IAE1E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE;YAChC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;SAC/D,CAAC,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;gBACrD,IACE,KAAK,CAAC,WAAW,KAAK,KAAK;oBAC3B,CAAC,CAAC,KAAK,CAAC,YAAY,YAAY,mCAAmC,CAAC,EACpE,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,iEAAiE;YACjE,eAAe,GAAG,IAAI,UAAU,EAAE,CAAC;QACrC,CAAC;QACD,OAAO;YACL,UAAU,EAAE,eAAe;YAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;YACzD,kBAAkB,EAAE,sCAAsC,CACxD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CACxC;YACD,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACrE,2BAA2B,EAAE,KAAK;YAClC,wBAAwB,EAAE,EAAE;YAC5B,cAAc;SACf,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAoC;QACtD,UAAU,EAAE,MAAM,kCAAkC,CAClD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;QAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QACzD,2BAA2B,EAAE,KAAK;QAClC,wBAAwB,EAAE,EAAE;QAC5B,cAAc;KACf,CAAC;IACF,IACE,KAAK,CAAC,2BAA2B,KAAK,IAAI;QAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,EACtE,CAAC;QACD,OAAO,qCAAqC,CAC1C,KAAK,EACL,cAAc,EACd,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KA6BiC;IAEjC,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxE,IAAI,mBAAsE,CAAC;IAC3E,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,mBAAmB,GAAG,aAAa,CAAC;QACtC,CAAC;QACD,oBAAoB;QACpB,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB;QACpB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,wBAAwB;KAChC,CAAC,CAAC;IACH,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,6CAA6C;QAC7C,IACE,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,IAAI;YACpD,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,KAAK,CAAC,2BAA2B,KAAK,IAAI,EAC1C,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;gBAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EACJ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,GAAG,QAAQ,CAAC;IACb,MAAM,eAAe,GAAG,MAAM,8BAA8B,CAAC;QAC3D,UAAU;QACV,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,UAAU;QACV,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,cAAc;KACf,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD;QACD,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB;QAChB,UAAU;QACV,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,oCAAoC,CAAC;QAC1C,QAAQ;QACR,QAAQ;QACR,mBAAmB;QACnB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n VerifiedContainerAccessManifest,\n VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport {\n emptyVersionVector,\n getImportBlobMetadata,\n satisfiesVersionVector,\n versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type {\n DocumentCreateResponse,\n DocumentSyncResponse,\n DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { documentKekTargetsFromContentKeyBundle } from \"@tearleads/validators/response\";\nimport { createPendingUpdateFields } from \"../../../data/documents/documentSync\";\nimport { assertDocumentKekPathsCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport {\n assertDocumentWriterProjectionConsistent,\n authorizingContainerPathRefs,\n buildRotatedDocumentContentKeyBundle,\n ContainerKekHistoryUnavailableError,\n collectContainerKeksForDocumentSync,\n DocumentHistoryUnavailableError,\n unwrapDocumentContentKeyFromBundle,\n} from \"../../../data/documents/shared/projection\";\nimport { assertDocumentManifestBundleConsistent } from \"../../../data/documents/shared/readers\";\nimport type {\n BuildDocumentSyncPlanInput,\n DocumentCreateAuthor,\n MaterializedDocumentSyncPlan,\n ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { selectDocumentSyncOutgoingBatch } from \"../../../data/sync/documentSyncOutgoingBatch\";\nimport {\n type DocumentSyncTraceEmitter,\n traceCheckpointRegeneration,\n traceHealBlocked,\n traceHealPlanned,\n traceStaleBundle,\n traceStaleRead,\n} from \"../sync/syncTrace\";\nimport { prepareDocumentOutgoingUpdates } from \"./syncContentKeys\";\nimport { buildDocumentSyncPlan } from \"./syncPlanIdentity\";\nimport { finalizeMaterializedDocumentSyncPlan } from \"./syncPlanProjection\";\n\n/**\n * Builds the rotation baseline that anchors a stale-bundle heal: a full\n * history snapshot of the local document, re-encrypted under the fresh\n * content key so every current member (including post-rotation newcomers)\n * has an efficient current-epoch redirect. Predecessor KEKs remain the\n * correctness path when no covering baseline exists.\n */\nasync function buildStaleRecoveryBaselinePendingUpdate(\n buildRotationSnapshot: (() => Promise<Uint8Array | null>) | undefined,\n): Promise<PendingUpdateRecord> {\n const snapshot = buildRotationSnapshot ? await buildRotationSnapshot() : null;\n if (!snapshot) {\n throw new Error(\n \"Document content-key bundle is stale and no rotation snapshot is available to heal it\",\n );\n }\n const metadata = getImportBlobMetadata(snapshot);\n if (\n metadata.mode !== \"snapshot\" ||\n !versionVectorsEqual(\n metadata.partialStartVersionVector,\n emptyVersionVector(),\n )\n ) {\n throw new Error(\n \"Document stale-bundle recovery requires a full-history rotation snapshot\",\n );\n }\n const pendingFields = createPendingUpdateFields(\n snapshot,\n metadata.partialEndVersionVector,\n );\n if (!pendingFields) {\n throw new Error(\"Document stale-bundle recovery snapshot is empty\");\n }\n\n return {\n id: crypto.randomUUID(),\n ...pendingFields,\n };\n}\n\n/**\n * Resolves the content material a sync plan encrypts and carries. A stale\n * bundle names predecessor KEK targets while the document's current targets\n * name successor epochs, so it splits by intent: a write-bearing pass heals\n * the document with a FRESH content key at the next epoch, anchored by a\n * covering rotation baseline, while a read-only pass keeps the stale pair and\n * unwraps it through predecessor KEKs so the server can settle a complete pull.\n */\n/**\n * The manifest bundle a stale read-only plan must pair with: the one the\n * stale content-key bundle actually references. A stale bundle normally\n * still carries the current link-set manifest hash (KEK rotations do not\n * advance the document manifest), but the projection consistency check\n * defensively admits a bundle lagging the head as long as it appears in the\n * manifest history — pair with that historical bundle so the plan's own\n * identity checks hold.\n */\nfunction staleBundleDocumentManifest(\n writerProjection: DocumentWriterProjectionResponse,\n): DocumentCreateResponse[\"accessManifest\"] {\n const { contentKeyBundle, documentManifest } = writerProjection;\n if (contentKeyBundle.linkSetManifestHash === documentManifest.manifestHash) {\n return documentManifest;\n }\n const historicalManifest = writerProjection.documentManifestHistory.find(\n (bundle) => bundle.manifestHash === contentKeyBundle.linkSetManifestHash,\n );\n if (!historicalManifest) {\n throw new Error(\n \"Document stale bundle manifest is missing from the projection history\",\n );\n }\n return historicalManifest;\n}\n\n/**\n * Settling a superseded checkpoint deletes its queue row, so the fresh\n * baseline must PROVABLY subsume it — assumed coverage would silently drop\n * any ops the checkpoint alone carried.\n */\nfunction assertRecoveryBaselineCoversCheckpoints(\n recoveryBaseline: PendingUpdateRecord,\n checkpoints: readonly PendingUpdateRecord[],\n): void {\n for (const checkpoint of checkpoints) {\n if (\n !satisfiesVersionVector(\n recoveryBaseline.partialEndVersionVector,\n checkpoint.partialEndVersionVector,\n )\n ) {\n throw new Error(\n \"Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint\",\n );\n }\n }\n}\n\ninterface ResolvedSyncPlanContentMaterial {\n contentKey: Uint8Array;\n contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n documentManifest: DocumentCreateResponse[\"accessManifest\"];\n healedStaleContentKeyBundle: boolean;\n heldBackPendingUpdateIds: readonly string[];\n pendingUpdates: readonly PendingUpdateRecord[];\n staleRecoveryBaselineUpdateId?: string;\n}\n\nasync function resolveStaleHealMaterial(\n input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n containerKeksByEpochId: ReadonlyMap<string, Uint8Array>,\n pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n const contentKey = crypto.getRandomValues(new Uint8Array(32));\n // A rotation checkpoint left in the queue by an interrupted earlier\n // recovery is superseded by the fresh covering baseline built below:\n // submitting it alongside would trip the server's covering-baseline gate,\n // and resubmitting it after the heal could become the latest baseline at\n // the healed epoch and mask the covering one. Hold it out of the request;\n // on heal success its id is reported settled (the committed baseline\n // subsumes its full-history content) so the queue row is removed.\n //\n // A heal whose OWN baseline does not cover the committed frontier is\n // rejected by that same gate and surfaces as a terminal queue failure.\n // This write-bearing pass does not pull first. A device missing committed\n // history can independently rematerialize it through predecessor KEKs on a\n // read-only pass, then retry with a covering snapshot. The coverage proof\n // prevents a partial local view from becoming the redirect baseline.\n const ordinaryPendingUpdates = pendingUpdates.filter(\n (update) => update.sourceVersionVector == null,\n );\n const heldBackCheckpoints = pendingUpdates.filter(\n (update) => update.sourceVersionVector != null,\n );\n const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n input.buildRotationSnapshot,\n );\n const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n ordinaryPendingUpdates,\n {\n reservedDataCharacters: recoveryBaseline.updateData.length,\n reservedUpdateCount: 1,\n },\n );\n assertRecoveryBaselineCoversCheckpoints(\n recoveryBaseline,\n heldBackCheckpoints,\n );\n const staleEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch;\n const contentKeyBundle = await buildRotatedDocumentContentKeyBundle({\n containerKeksByEpochId,\n contentKey,\n writerProjection: input.writerProjection,\n });\n traceHealPlanned(input.onSyncTrace, {\n documentId: input.writerProjection.documentId,\n fromEpoch: staleEpoch,\n heldBack: heldBackCheckpoints.length,\n toEpoch: contentKeyBundle.contentKeyEpoch,\n updates: selectedOrdinaryPendingUpdates.length,\n });\n return {\n contentKey,\n contentKeyBundle,\n documentKekTargets: input.writerProjection.documentKekTargets,\n documentManifest: input.writerProjection.documentManifest,\n healedStaleContentKeyBundle: true,\n heldBackPendingUpdateIds: heldBackCheckpoints.map((update) => update.id),\n pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n };\n}\n\n/**\n * Reactive repair for a healthy-projection pass whose queued rotation\n * checkpoint the server rejected via the covering-baseline gate (a leftover\n * from an interrupted recovery, a heal whose ack was lost, or a lost heal\n * race). Queued checkpoints normally pass through untouched — reset and\n * rotation flows legitimately submit them — but a rejected one would strand\n * the whole queue, and committing it could shrink redirect coverage. Replace\n * the stale checkpoints with one freshly regenerated covering baseline and\n * settle them on success (coverage proven above).\n */\nasync function resolveCheckpointRegenerationMaterial(\n input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n base: ResolvedSyncPlanContentMaterial,\n pendingUpdates: readonly PendingUpdateRecord[],\n): Promise<ResolvedSyncPlanContentMaterial> {\n const ordinaryPendingUpdates = pendingUpdates.filter(\n (update) => update.sourceVersionVector == null,\n );\n const queuedCheckpoints = pendingUpdates.filter(\n (update) => update.sourceVersionVector != null,\n );\n const recoveryBaseline = await buildStaleRecoveryBaselinePendingUpdate(\n input.buildRotationSnapshot,\n );\n const selectedOrdinaryPendingUpdates = selectDocumentSyncOutgoingBatch(\n ordinaryPendingUpdates,\n {\n reservedDataCharacters: recoveryBaseline.updateData.length,\n reservedUpdateCount: 1,\n },\n );\n assertRecoveryBaselineCoversCheckpoints(recoveryBaseline, queuedCheckpoints);\n traceCheckpointRegeneration(input.onSyncTrace, {\n checkpoints: queuedCheckpoints.length,\n documentId: input.writerProjection.documentId,\n updates: selectedOrdinaryPendingUpdates.length,\n });\n return {\n ...base,\n heldBackPendingUpdateIds: queuedCheckpoints.map((update) => update.id),\n pendingUpdates: [recoveryBaseline, ...selectedOrdinaryPendingUpdates],\n staleRecoveryBaselineUpdateId: recoveryBaseline.id,\n };\n}\n\nasync function resolveSyncPlanContentMaterial(\n input: Parameters<typeof buildMaterializedDocumentSyncPlan>[0],\n collectedKeks: Awaited<\n ReturnType<typeof collectContainerKeksForDocumentSync>\n >,\n): Promise<ResolvedSyncPlanContentMaterial> {\n const allPendingUpdates = input.pendingUpdates ?? [];\n if (allPendingUpdates.length > 0 || input.regenerateQueuedCheckpoints) {\n assertDocumentKekPathsCurrent(input.writerProjection);\n }\n const staleContentKeyBundle =\n input.writerProjection.contentKeyBundleStale === true;\n\n if (staleContentKeyBundle && allPendingUpdates.length > 0) {\n traceStaleBundle(input.onSyncTrace, {\n documentId: input.writerProjection.documentId,\n epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n pending: allPendingUpdates.length,\n });\n return resolveStaleHealMaterial(\n input,\n collectedKeks.keksByEpochId,\n allPendingUpdates,\n );\n }\n\n const pendingUpdates = selectDocumentSyncOutgoingBatch(allPendingUpdates);\n\n if (staleContentKeyBundle) {\n traceStaleRead(input.onSyncTrace, {\n documentId: input.writerProjection.documentId,\n epoch: input.writerProjection.contentKeyBundle.contentKeyEpoch,\n });\n // Current access includes every predecessor KEK. If damaged history makes\n // this old bundle unreachable, preserve the bridge-integrity failure: this\n // read actually needs that historical epoch and cannot safely continue.\n let staleContentKey: Uint8Array;\n try {\n staleContentKey = await unwrapDocumentContentKeyFromBundle(\n input.writerProjection.contentKeyBundle,\n input.writerProjection.documentId,\n collectedKeks.keksByEpochId,\n collectedKeks.predecessorFailuresByEpochId,\n collectedKeks.unattributedPredecessorFailuresByContainerId,\n );\n } catch (error) {\n if (error instanceof DocumentHistoryUnavailableError) {\n if (\n input.historyMode !== \"raw\" ||\n !(error.historyCause instanceof ContainerKekHistoryUnavailableError)\n ) {\n throw error;\n }\n }\n // A stale bundle can predate the requester's current authorizing links.\n // Keep the read-only pass alive; served updates that need this absent key\n // remain undecryptable until a spanning member heals the bundle.\n staleContentKey = new Uint8Array();\n }\n return {\n contentKey: staleContentKey,\n contentKeyBundle: input.writerProjection.contentKeyBundle,\n documentKekTargets: documentKekTargetsFromContentKeyBundle(\n input.writerProjection.contentKeyBundle,\n ),\n documentManifest: staleBundleDocumentManifest(input.writerProjection),\n healedStaleContentKeyBundle: false,\n heldBackPendingUpdateIds: [],\n pendingUpdates,\n };\n }\n\n const normalMaterial: ResolvedSyncPlanContentMaterial = {\n contentKey: await unwrapDocumentContentKeyFromBundle(\n input.writerProjection.contentKeyBundle,\n input.writerProjection.documentId,\n collectedKeks.keksByEpochId,\n collectedKeks.predecessorFailuresByEpochId,\n collectedKeks.unattributedPredecessorFailuresByContainerId,\n ),\n contentKeyBundle: input.writerProjection.contentKeyBundle,\n documentKekTargets: input.writerProjection.documentKekTargets,\n documentManifest: input.writerProjection.documentManifest,\n healedStaleContentKeyBundle: false,\n heldBackPendingUpdateIds: [],\n pendingUpdates,\n };\n if (\n input.regenerateQueuedCheckpoints === true &&\n allPendingUpdates.some((update) => update.sourceVersionVector != null)\n ) {\n return resolveCheckpointRegenerationMaterial(\n input,\n normalMaterial,\n allPendingUpdates,\n );\n }\n\n return normalMaterial;\n}\n\nexport async function buildMaterializedDocumentSyncPlan(\n input: {\n author: DocumentCreateAuthor;\n /**\n * Supplies a full-history Loro snapshot of the local document when a\n * stale content-key bundle must be healed, or when a leftover queued\n * rotation checkpoint must be regenerated as a covering baseline.\n * Without it those passes fail with a descriptive error instead.\n */\n buildRotationSnapshot?: (() => Promise<Uint8Array | null>) | undefined;\n containerRekeys?: BuildDocumentSyncPlanInput[\"containerRekeys\"];\n execSql?: ExecSql | undefined;\n historyMode?: \"raw\" | undefined;\n inlineRekeyCommitId?: string | undefined;\n localVersionVector: string | null;\n minLsn?: string | undefined;\n pullCursor?: string | undefined;\n /** Clipboard-safe trace sink (see syncTrace.ts); never receives content. */\n onSyncTrace?: DocumentSyncTraceEmitter | undefined;\n pendingUpdates?: readonly PendingUpdateRecord[] | undefined;\n persistVerificationCheckpoints?: boolean | undefined;\n /**\n * Replace queued rotation checkpoints with a freshly regenerated covering\n * baseline instead of passing them through. Set by the sync loop after\n * the server rejected a pass via the covering-baseline gate.\n */\n regenerateQueuedCheckpoints?: boolean | undefined;\n signedAt?: string | undefined;\n targetSecretKey: Uint8Array;\n writerProjection: DocumentWriterProjectionResponse;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentSyncPlan> {\n // Reuse verification across consistency and unwrap passes; unwrap still\n // binds the key material independently.\n const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n const principalPolicyCache = new Map<string, VerifiedPrincipalPolicy>();\n let writerAuthorization: DocumentWriterProjectionAuthorization | undefined;\n await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n allowStaleContentKeyBundle: true,\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n onVerifiedAuthorization: (authorization) => {\n writerAuthorization = authorization;\n },\n principalPolicyCache,\n verifiedByHash,\n ...projectionVerificationOptions(input),\n });\n const collectedKeks = await collectContainerKeksForDocumentSync({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n principalPolicyCache,\n secretKey: input.targetSecretKey,\n verifiedByHash,\n writerProjection: input.writerProjection,\n ...projectionVerificationOptions(input),\n });\n const documentId = input.writerProjection.documentId;\n const manifestIdentity = await assertDocumentManifestBundleConsistent({\n bundle: input.writerProjection.documentManifest,\n label: \"Document sync manifest\",\n });\n let material: ResolvedSyncPlanContentMaterial;\n try {\n material = await resolveSyncPlanContentMaterial(input, collectedKeks);\n } catch (error) {\n // Only a stale-bundle HEAL (write-bearing) or a checkpoint regeneration\n // counts as a blocked recovery; an ordinary pass or a stale READ failing\n // here must not read as one in a support report. Enumerated reason only;\n // unknown errors emit nothing (fail closed).\n if (\n (input.writerProjection.contentKeyBundleStale === true &&\n (input.pendingUpdates ?? []).length > 0) ||\n input.regenerateQueuedCheckpoints === true\n ) {\n traceHealBlocked(input.onSyncTrace, {\n documentId: input.writerProjection.documentId,\n error,\n });\n }\n throw error;\n }\n const {\n contentKey,\n contentKeyBundle,\n documentKekTargets,\n documentManifest,\n pendingUpdates,\n } = material;\n const outgoingUpdates = await prepareDocumentOutgoingUpdates({\n contentKey,\n contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n documentId,\n organizationId: manifestIdentity.organizationId,\n pendingUpdates,\n });\n const basePlan = await buildDocumentSyncPlan({\n author: {\n ...input.author,\n organizationId: manifestIdentity.organizationId,\n },\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.writerProjection,\n ),\n containerRekeys: input.containerRekeys,\n contentKeyBundle,\n documentId,\n documentKekTargets,\n documentManifest,\n historyMode: input.historyMode,\n inlineRekeyCommitId: input.inlineRekeyCommitId,\n localVersionVector: input.localVersionVector,\n minLsn: input.minLsn,\n outgoingUpdates,\n pullCursor: input.pullCursor,\n signedAt: input.signedAt,\n });\n return finalizeMaterializedDocumentSyncPlan({\n basePlan,\n material,\n writerAuthorization,\n writerProjection: input.writerProjection,\n });\n}\n"]}

package/workflows/documents/syncPlan/syncPlanProjection.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncPlanProjection.js","sourceRoot":"","sources":["syncPlanProjection.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAYjC,SAAS,mCAAmC,CAC1C,QAAoC,EACpC,gBAAkD;IAElD,IAAI,CAAC,QAAQ,CAAC,2BAA2B;QAAE,OAAO,gBAAgB,CAAC;IACnE,MAAM,gBAAgB,GAAG;QACvB,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC;IACF,OAAO,gBAAgB,CAAC,qBAAqB,CAAC;IAC9C,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAOpD;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,mBAAmB;QAC7C,CAAC,CAAC;YACE,GAAG,KAAK,CAAC,QAAQ;YACjB,2BAA2B,EAAE,KAAK,CAAC,mBAAmB;SACvD;QACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,4BAA4B,CACvC,aAAa,EACb,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAC7C,CAAC;IACF,OAAO,4BAA4B,CACjC,KAAK,CAAC,QAAQ,EACd,IAAI,EACJ,mCAAmC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAC5E,CAAC;AACJ,CAAC","sourcesContent":["import type {\n DocumentCreateResponse,\n DocumentSyncResponse,\n DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n DocumentSyncPlan,\n MaterializedDocumentSyncPlan,\n} from \"../../../data/documents/shared/types\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport {\n boundDocumentSyncPlanRequest,\n materializedDocumentSyncPlan,\n} from \"./syncPlanRequestBounds\";\n\ninterface SyncPlanProjectionMaterial {\n readonly contentKey: Uint8Array;\n readonly contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n readonly documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n readonly documentManifest: DocumentCreateResponse[\"accessManifest\"];\n readonly healedStaleContentKeyBundle: boolean;\n readonly heldBackPendingUpdateIds: readonly string[];\n readonly staleRecoveryBaselineUpdateId?: string | undefined;\n}\n\nfunction writerProjectionAfterContentKeyHeal(\n material: SyncPlanProjectionMaterial,\n writerProjection: DocumentWriterProjectionResponse,\n): DocumentWriterProjectionResponse {\n if (!material.healedStaleContentKeyBundle) return writerProjection;\n const healedProjection = {\n ...writerProjection,\n contentKeyBundle: material.contentKeyBundle,\n documentKekTargets: material.documentKekTargets,\n documentManifest: material.documentManifest,\n };\n delete healedProjection.contentKeyBundleStale;\n return healedProjection;\n}\n\nexport function finalizeMaterializedDocumentSyncPlan(input: {\n readonly basePlan: DocumentSyncPlan;\n readonly material: SyncPlanProjectionMaterial;\n readonly writerAuthorization:\n | DocumentWriterProjectionAuthorization\n | undefined;\n readonly writerProjection: DocumentWriterProjectionResponse;\n}): MaterializedDocumentSyncPlan {\n const unboundedPlan = input.writerAuthorization\n ? {\n ...input.basePlan,\n documentWriterAuthorization: input.writerAuthorization,\n }\n : input.basePlan;\n const plan = boundDocumentSyncPlanRequest(\n unboundedPlan,\n input.material.staleRecoveryBaselineUpdateId,\n );\n return materializedDocumentSyncPlan(\n input.material,\n plan,\n writerProjectionAfterContentKeyHeal(input.material, input.writerProjection),\n );\n}\n"]}

package/workflows/documents/{syncPlanRequestBounds.js → syncPlan/syncPlanRequestBounds.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { limitDocumentSyncRequestBytes } from "../../data/sync/documentSyncOutgoingBatch.js";
+import { limitDocumentSyncRequestBytes } from "../../../data/sync/documentSyncOutgoingBatch.js";
 export function boundDocumentSyncPlanRequest(plan, requiredOutgoingUpdateId) {
     const request = limitDocumentSyncRequestBytes(plan.request, {
         requiredOutgoingUpdateId,

package/workflows/documents/syncPlan/syncPlanRequestBounds.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncPlanRequestBounds.js","sourceRoot":"","sources":["syncPlanRequestBounds.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAS7F,MAAM,UAAU,4BAA4B,CAC1C,IAA0C,EAC1C,wBAA4C;IAE5C,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,EAAE;QAC1D,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAA0B,EAC1B,IAA0C,EAC1C,gBAAkE;IAElE,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;QAC3D,IAAI;QACJ,gBAAgB;QAChB,GAAG,CAAC,QAAQ,CAAC,6BAA6B,KAAK,SAAS;YACtD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;aACtE,CAAC;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,cAA8C,EAC9C,gBAA8C;IAE9C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CACzE,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,GAAG,YAAY;QACf,GAAG,gBAAgB,CAAC,wBAAwB;KAC7C,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,mBAAmB,GACvB,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvE,OAAO,CACL,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CACzB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,gBAA8C,EAC9C,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,6BAA6B,CAAC;IAC1E,OAAO,CACL,kBAAkB,KAAK,SAAS;QAChC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,gBAA8C,EAC9C,QAA8B;IAE9B,OAAO,gCAAgC,CAAC,gBAAgB,EAAE,QAAQ,CAAC;QACjE,CAAC,CAAC,gBAAgB,CAAC,wBAAwB;QAC3C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC","sourcesContent":["import type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedDocumentSyncPlan } from \"../../../data/documents/shared/types\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport { limitDocumentSyncRequestBytes } from \"../../../data/sync/documentSyncOutgoingBatch\";\n\ninterface SyncPlanMaterial {\n readonly contentKey: Uint8Array;\n readonly healedStaleContentKeyBundle: boolean;\n readonly heldBackPendingUpdateIds: readonly string[];\n readonly staleRecoveryBaselineUpdateId?: string | undefined;\n}\n\nexport function boundDocumentSyncPlanRequest(\n plan: MaterializedDocumentSyncPlan[\"plan\"],\n requiredOutgoingUpdateId: string | undefined,\n): MaterializedDocumentSyncPlan[\"plan\"] {\n const request = limitDocumentSyncRequestBytes(plan.request, {\n requiredOutgoingUpdateId,\n });\n return request === plan.request ? plan : { ...plan, request };\n}\n\nexport function materializedDocumentSyncPlan(\n material: SyncPlanMaterial,\n plan: MaterializedDocumentSyncPlan[\"plan\"],\n writerProjection: MaterializedDocumentSyncPlan[\"writerProjection\"],\n): MaterializedDocumentSyncPlan {\n return {\n contentKey: material.contentKey,\n healedStaleContentKeyBundle: material.healedStaleContentKeyBundle,\n heldBackPendingUpdateIds: material.heldBackPendingUpdateIds,\n plan,\n writerProjection,\n ...(material.staleRecoveryBaselineUpdateId === undefined\n ? {}\n : {\n staleRecoveryBaselineUpdateId: material.staleRecoveryBaselineUpdateId,\n }),\n };\n}\n\nexport function recoverablePendingUpdates(\n pendingUpdates: readonly PendingUpdateRecord[],\n materializedPlan: MaterializedDocumentSyncPlan,\n): PendingUpdateRecord[] {\n const submittedIds = new Set(\n materializedPlan.plan.request.outgoingUpdates.map((update) => update.id),\n );\n const recoverableIds = new Set([\n ...submittedIds,\n ...materializedPlan.heldBackPendingUpdateIds,\n ]);\n return pendingUpdates.filter((update) => recoverableIds.has(update.id));\n}\n\nexport function hasDeferredPendingUpdatesAfterSubmit(input: {\n acceptedRecoveryBaseline: boolean;\n exhaustedPendingUpdateCount: number;\n pendingUpdateIds: readonly string[];\n rekeyedPendingUpdateIds: readonly string[];\n settledPendingUpdateIds: readonly string[];\n}): boolean {\n if (input.exhaustedPendingUpdateCount > 0) {\n return false;\n }\n\n const madeDurableProgress =\n input.acceptedRecoveryBaseline ||\n input.settledPendingUpdateIds.length > 0 ||\n input.rekeyedPendingUpdateIds.length > 0;\n if (!madeDurableProgress) {\n return false;\n }\n\n const settledPendingUpdateIds = new Set(input.settledPendingUpdateIds);\n return (\n input.rekeyedPendingUpdateIds.length > 0 ||\n input.pendingUpdateIds.some(\n (updateId) => !settledPendingUpdateIds.has(updateId),\n )\n );\n}\n\nexport function responseAcceptedRecoveryBaseline(\n materializedPlan: MaterializedDocumentSyncPlan,\n response: DocumentSyncResponse,\n): boolean {\n const recoveryBaselineId = materializedPlan.staleRecoveryBaselineUpdateId;\n return (\n recoveryBaselineId !== undefined &&\n response.acceptedOutgoingUpdateIds.includes(recoveryBaselineId)\n );\n}\n\nexport function acceptedHeldBackPendingUpdateIds(\n materializedPlan: MaterializedDocumentSyncPlan,\n response: DocumentSyncResponse,\n): readonly string[] {\n return responseAcceptedRecoveryBaseline(materializedPlan, response)\n ? materializedPlan.heldBackPendingUpdateIds\n : [];\n}\n"]}

package/workflows/documents/{syncAutomaticContainerRekeys.js → syncRekeys/syncAutomaticContainerRekeys.js} RENAMED Viewed

@@ -1,14 +1,14 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { MAX_INLINE_CONTAINER_REKEYS } from "../../internal/validators/util/index.js";
-import { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
-import { ContainerKekRepairInaccessibleError } from "../../data/documents/shared/containerKekCurrency.js";
-import { ContainerKekTargetUnreachableError } from "../../data/documents/shared/containerKekPath.js";
-import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { buildMaterializedContainerRekeyPlan } from "../containers/child/rekey.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { MAX_INLINE_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
+import { ContainerAuthorAccessError } from "../../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError } from "../../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekTargetUnreachableError } from "../../../data/documents/shared/containerKekPath.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/documentContainerProjections.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { buildMaterializedContainerRekeyPlan } from "../../containers/child/rekey.js";
+import { DocumentAncestorRepairAbandonedError } from "../syncFailures/syncRepairAbandon.js";
+import { hasOtherLinkedWriteAccess } from "../syncFailures/syncRepairAccess.js";
 import { applyContainerRekeyPlan } from "./syncContainerRekeyProjection.js";
-import { DocumentAncestorRepairAbandonedError } from "./syncRepairAbandon.js";
-import { hasOtherLinkedWriteAccess } from "./syncRepairAccess.js";
 function firstStaleContainer(projection) {
     for (const path of documentContainerProjections(projection)) {
         for (let index = 1; index < path.containerKeks.length; index += 1) {

package/workflows/documents/syncRekeys/syncAutomaticContainerRekeys.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncAutomaticContainerRekeys.js","sourceRoot":"","sources":["syncAutomaticContainerRekeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AACvH,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AAEnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAQzE,SAAS,mBAAmB,CAC1B,UAA4C;IAE5C,KAAK,MAAM,IAAI,IAAI,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;gBACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,yBAAyB,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,OAAO;gBACL,YAAY,EAAE,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBACrD,UAAU,EAAE;oBACV,GAAG,IAAI;oBACP,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;oBACrD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;iBACpC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAqB;IACjE,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,CACL,KAAK,YAAY,0BAA0B;QAC3C,CAAC,KAAK,YAAY,kCAAkC;YAClD,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAA6B,EAC7B,iBAAmD;IAEnD,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC7C,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,yEAAyE;QACzE,mEAAmE;QACnE,qDAAqD;QACrD,mCAAmC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,oEAAoE;YACpE,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,IAAI,oCAAoC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,kBAAkB,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACrE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,8BAA8B,EAAE,KAAK;YACrC,kBAAkB;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;YACvD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;YACrE,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAChC,IAAI,KAAK,YAAY,0BAA0B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtE,IACE,MAAM,yBAAyB,CAC7B,IAAI,EACJ,iBAAiB,EACjB,kBAAkB,CAAC,WAAW,CAC/B,EACD,CAAC;oBACD,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,CAAC,WAAW,CAC/B,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACnC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,MAAM,IAAI,oCAAoC,CAAC,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;gBACtC,CAAC,CAAC,IAAI,mCAAmC,CACrC,kBAAkB,CAAC,WAAW,CAC/B;gBACH,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,UAAU,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n ContainerWriterProjectionResponse,\n DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { MAX_INLINE_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { ContainerAuthorAccessError } from \"../../../data/containers/shared/authorAccess\";\nimport type { MaterializedContainerRekeyPlan } from \"../../../data/containers/shared/types\";\nimport { ContainerKekRepairInaccessibleError } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { ContainerKekTargetUnreachableError } from \"../../../data/documents/shared/containerKekPath\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { buildMaterializedContainerRekeyPlan } from \"../../containers/child/rekey\";\nimport type { SyncRemoteDocumentInput } from \"../sync/readOnlySync\";\nimport { DocumentAncestorRepairAbandonedError } from \"../syncFailures/syncRepairAbandon\";\nimport { hasOtherLinkedWriteAccess } from \"../syncFailures/syncRepairAccess\";\nimport { applyContainerRekeyPlan } from \"./syncContainerRekeyProjection\";\n\ninterface StaleContainer {\n /** The stale container is the one the document itself is linked into. */\n readonly isPathTarget: boolean;\n readonly projection: ContainerWriterProjectionResponse;\n}\n\nfunction firstStaleContainer(\n projection: DocumentWriterProjectionResponse,\n): StaleContainer | null {\n for (const path of documentContainerProjections(projection)) {\n for (let index = 1; index < path.containerKeks.length; index += 1) {\n const parent = path.containerKeks[index - 1];\n const child = path.containerKeks[index];\n if (!parent || !child)\n throw new Error(\"Container KEK path is incomplete\");\n if (child.parentContainerKeyEpochId === parent.containerKeyEpochId) {\n continue;\n }\n return {\n isPathTarget: index === path.containerKeks.length - 1,\n projection: {\n ...path,\n containerId: child.containerId,\n containerKeks: path.containerKeks.slice(0, index + 1),\n path: path.path.slice(0, index + 1),\n },\n };\n }\n }\n return null;\n}\n\n/**\n * The stale container is not this writer's to re-key: no wrap on the verified\n * path opens it, or the signed path grants the signer no write access there.\n * Both are judged against the path sliced at the stale container, so a grant\n * held only further down never counts — exactly the API's `container.rekey`\n * rule. Anything else (keyring damage, a forged path) stays an error.\n *\n * A target's write refusal is handled separately: another linked target may\n * still authorize the document write. Key unwrap failures on a target stay\n * errors, because this path's readable grant should open its own key.\n */\nfunction isRepairInaccessible(error: unknown, stale: StaleContainer): boolean {\n if (stale.isPathTarget) return false;\n return (\n error instanceof ContainerAuthorAccessError ||\n (error instanceof ContainerKekTargetUnreachableError &&\n error.containerId === stale.projection.containerId)\n );\n}\n\n/** Prepare parent-first repairs; the sync transaction commits them with the write. */\nexport async function buildAutomaticContainerRekeys(\n sync: SyncRemoteDocumentInput,\n initialProjection: DocumentWriterProjectionResponse,\n): Promise<{ plans: MaterializedContainerRekeyPlan[]; hasMore: boolean }> {\n const plans: MaterializedContainerRekeyPlan[] = [];\n const plannedIds = new Set<string>();\n let projection = initialProjection;\n for (;;) {\n const stale = firstStaleContainer(projection);\n if (!stale) return { plans, hasMore: false };\n const previousProjection = stale.projection;\n if (plans.length >= MAX_INLINE_CONTAINER_REKEYS) {\n return { plans, hasMore: true };\n }\n // Use the shared cancellation sentinel: syncRemoteDocument converts only\n // that to a graceful null, so a plain Error would report a routine\n // generation flip mid-repair as a real sync failure.\n assertProjectionVerificationCurrent(sync.stillCurrent);\n if (plannedIds.has(previousProjection.containerId)) {\n // Abandon like every other routine repair failure: two linked paths\n // disagreeing about a container is a concurrent-rotation race, not a\n // defect, and a raw Error would crash the sync lane instead.\n throw new DocumentAncestorRepairAbandonedError(\"peer-rotation\");\n }\n // Assert rather than adopt: resolveRotationContext compares the verified\n // manifest's organization against the author's, so substituting the path's\n // own organization here would make that the only cross-org check and leave\n // it comparing a server-supplied value with itself.\n if (previousProjection.organizationId !== sync.author.organizationId) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Document ancestor repair crosses the author's organization\",\n );\n }\n const planned = await buildMaterializedContainerRekeyPlan({\n author: sync.author,\n persistVerificationCheckpoints: false,\n previousProjection,\n signedAt: sync.signedAt,\n targetSecretKey: sync.targetSecretKey,\n resolveProjectionUserKey: sync.resolveProjectionUserKey,\n stillCurrent: sync.stillCurrent,\n warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,\n execSql: sync.execSql,\n }).catch(async (error: unknown) => {\n if (error instanceof ContainerAuthorAccessError && stale.isPathTarget) {\n if (\n await hasOtherLinkedWriteAccess(\n sync,\n initialProjection,\n previousProjection.containerId,\n )\n ) {\n throw new ContainerKekRepairInaccessibleError(\n previousProjection.containerId,\n );\n }\n await sync.onTerminalSubmitFailure?.({\n code: error.code,\n message: error.message,\n ok: false,\n report: () => undefined,\n status: error.status,\n });\n throw new DocumentAncestorRepairAbandonedError(\"refused\");\n }\n // Repairs run parent-first and access inherits downward, so only the\n // first stale container can be out of reach. Retry-classified like any\n // stale path: one refetch sees a repair a capable member already made.\n throw isRepairInaccessible(error, stale)\n ? new ContainerKekRepairInaccessibleError(\n previousProjection.containerId,\n )\n : error;\n });\n plannedIds.add(previousProjection.containerId);\n plans.push(planned);\n projection = await applyContainerRekeyPlan(projection, planned);\n }\n}\n"]}

package/workflows/documents/{syncContainerRekeyPreparation.js → syncRekeys/syncContainerRekeyPreparation.js} RENAMED Viewed

@@ -1,15 +1,15 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { MAX_CONTAINER_PATH_LENGTH } from "../../internal/validators/util/index.js";
-import { acknowledgeContainerMutationBatch } from "../../data/containers/shared/mutationAcknowledgement.js";
-import { assertDocumentWriterProjectionConsistent } from "../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { submitContainerRotation, submitRotationCarryingDescendants, } from "../containers/child/mutationSubmit.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { MAX_CONTAINER_PATH_LENGTH } from "../../../internal/validators/util/index.js";
+import { acknowledgeContainerMutationBatch } from "../../../data/containers/shared/mutationAcknowledgement.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { requireProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { submitContainerRotation, submitRotationCarryingDescendants, } from "../../containers/child/mutationSubmit.js";
+import { refreshSyncAttemptWriterProjection } from "../syncFailures/index.js";
+import { shouldRetrySyncWithFreshWriterProjection } from "../syncFailures/syncFailureClassification.js";
+import { DocumentAncestorRepairAbandonedError } from "../syncFailures/syncRepairAbandon.js";
 import { buildAutomaticContainerRekeys } from "./syncAutomaticContainerRekeys.js";
-import { shouldRetrySyncWithFreshWriterProjection } from "./syncFailureClassification.js";
-import { refreshSyncAttemptWriterProjection } from "./syncFailures.js";
-import { DocumentAncestorRepairAbandonedError } from "./syncRepairAbandon.js";
 /**
  * Repairs committed during one sync pass, keyed by the pass's own input object
  * (stable across all three attempts). The sync loop explicitly prepares each

package/workflows/documents/syncRekeys/syncContainerRekeyPreparation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncContainerRekeyPreparation.js","sourceRoot":"","sources":["syncContainerRekeyPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,yDAAyD,CAAC;AAE5G,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EACL,uBAAuB,EACvB,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAmC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAA2B,CAAC;AAEtE,MAAM,UAAU,iCAAiC,CAC/C,IAA6B;IAE7B,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA6B;IAE7B,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,MAAqB;IACnD,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,IAA4C,EAC5C,gBAAoE;IAEpE,MAAM,OAAO,GAAG;QACd,qCAAqC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;KACjE,CAAC;IACF,MAAM,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC9E,OAAO,iCAAiC,CAAC;QACvC,aAAa,EAAE,4BAA4B,IAAI;YAC7C,QAAQ,EAAE;gBACR,SAAS,EAAE;oBACT,4BAA4B,EAAE,4BAA4B,CAAC,IAAI,CAC7D,IAAI,CAAC,SAAS,CACf;iBACF;gBACD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,wBAAwB,EAAE,gCAAgC,CACxD,IAAI,CAAC,wBAAwB,EAC7B,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;aACtE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB;SACtC;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACjB,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACnE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAIjC;IACC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,oCAAoC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAC3D,KAAK,CAAC,IAAI,EACV,IAAI,EACJ,gBAAgB,CACjB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,qDAAqD;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACzC,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,+BAA+B,IAAI,CAAC,WAAW,EAAE;oBAC1D,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,yEAAyE;QACzE,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC;YAC3D,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3B,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAC1D,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,yEAAyE;YACzE,wEAAwE;YACxE,iDAAiD;YACjD,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,SAAS,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;QACrC,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAA6B,EAC7B,iBAAmD,EACnD,UAAU,GAAG,yBAAyB;IAKtC,IAAI,iBAAiB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,4EAA4E;IAC5E,+DAA+D;IAC/D,2EAA2E;IAC3E,0EAA0E;IAC1E,qDAAqD;IACrD,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,iBAAiB,GACrB,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAClE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,wCAAwC,CAAC,UAAU,EAAE;YACzD,GAAG,6BAA6B,CAAC,IAAI,CAAC;YACtC,8BAA8B,EAAE,IAAI;YACpC,0BAA0B,EAAE,IAAI;SACjC,CAAC,CAAC;QACH,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IACE,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM;YACpC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;QACjE,CAAC;QACD,gBAAgB,CAAC,GAAG,CAClB,IAAI,EACJ,eAAe;YACb,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CACxE,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,kCAAkC,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,6DAA6D;YAC7D,iBAAiB,EAAE,IAAI,CAAC,uBAAuB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,wEAAwE;YACxE,mCAAmC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,0EAA0E;YAC1E,0EAA0E;YAC1E,qCAAqC;YACrC,MAAM,IAAI,oCAAoC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,mCAAmC;QACnC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAA6B,EAC7B,UAA4C;IAE5C,IAAI,CAAC;QACH,OAAO,MAAM,+BAA+B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B;YAC7C,CAAC,wCAAwC,CAAC,KAAK,CAAC;YAEhD,MAAM,KAAK,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kCAAkC,CAAC;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,uBAAuB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { acknowledgeContainerMutationBatch } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport type { MaterializedContainerRekeyPlan } from \"../../../data/containers/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport {\n submitContainerRotation,\n submitRotationCarryingDescendants,\n} from \"../../containers/child/mutationSubmit\";\nimport type { SyncRemoteDocumentInput } from \"../sync/readOnlySync\";\nimport { refreshSyncAttemptWriterProjection } from \"../syncFailures\";\nimport { shouldRetrySyncWithFreshWriterProjection } from \"../syncFailures/syncFailureClassification\";\nimport { DocumentAncestorRepairAbandonedError } from \"../syncFailures/syncRepairAbandon\";\nimport { buildAutomaticContainerRekeys } from \"./syncAutomaticContainerRekeys\";\n\n/**\n * Repairs committed during one sync pass, keyed by the pass's own input object\n * (stable across all three attempts). The sync loop explicitly prepares each\n * attempt, so a counter local to one call would not bound the whole pass.\n */\nconst passRepairTotals = new WeakMap<SyncRemoteDocumentInput, number>();\n\n/**\n * Passes whose inline repairs the server refused for stranding a level above a\n * directly granted container. The write's flat rekey list cannot say which\n * descendants each repair must carry; a standalone rekey can, so the rest of\n * the pass commits every repair standalone before writing.\n */\nconst standaloneRepairPasses = new WeakSet<SyncRemoteDocumentInput>();\n\nexport function requiresStandaloneAncestorRepairs(\n sync: SyncRemoteDocumentInput,\n): boolean {\n return standaloneRepairPasses.has(sync);\n}\n\nexport function requireStandaloneAncestorRepairs(\n sync: SyncRemoteDocumentInput,\n): void {\n standaloneRepairPasses.add(sync);\n}\n\n/** A refusal the writer cannot clear by retrying, as opposed to 5xx/offline. */\nfunction isTerminalRepairStatus(status: number | null): boolean {\n return status === 401 || status === 402 || status === 403;\n}\n\n/**\n * One standalone repair. Prefers the status-bearing rekey: a permanent refusal\n * (403 once ancestor write access is revoked, 402) must leave a durable record,\n * while a 5xx or an offline blip must not, and plain `rekeyContainer` collapses\n * both to null. It is also the only way to learn which descendant rekeys this\n * repair must carry. An adapter without it still repairs; its refusals are just\n * reported as an ordinary abandon.\n */\nfunction submitStandaloneRepair(\n sync: SyncRemoteDocumentInput,\n plan: MaterializedContainerRekeyPlan[\"plan\"],\n writerProjection: MaterializedContainerRekeyPlan[\"writerProjection\"],\n) {\n const options = {\n expectedPaymentRequiredOrganizationId: plan.state.organizationId,\n };\n const { getContainerWriterProjection, rekeyContainerResult } = sync.apiClient;\n return submitRotationCarryingDescendants({\n carriedRekeys: getContainerWriterProjection && {\n planning: {\n apiClient: {\n getContainerWriterProjection: getContainerWriterProjection.bind(\n sync.apiClient,\n ),\n },\n author: sync.author,\n execSql: sync.execSql,\n resolveProjectionUserKey: requireProjectionUserKeyResolver(\n sync.resolveProjectionUserKey,\n \"Document ancestor repair\",\n ),\n stillCurrent: sync.stillCurrent,\n targetSecretKey: sync.targetSecretKey,\n warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,\n },\n rotated: async () => writerProjection,\n },\n stillCurrent: sync.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...plan.request, containerRekeys: [...carried] }\n : plan.request;\n return submitContainerRotation({\n plain: () =>\n sync.apiClient.rekeyContainer(plan.containerId, request, options),\n result: rekeyContainerResult\n ? () =>\n rekeyContainerResult.call(\n sync.apiClient,\n plan.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n\nasync function commitRepairPrefix(input: {\n plans: readonly MaterializedContainerRekeyPlan[];\n repairedIds: Set<string>;\n sync: SyncRemoteDocumentInput;\n}): Promise<number> {\n let committed = 0;\n for (const { plan, writerProjection } of input.plans) {\n assertProjectionVerificationCurrent(input.sync.stillCurrent);\n if (input.sync.isRemoteSyncBlocked?.(plan.state.organizationId)) {\n throw new DocumentAncestorRepairAbandonedError(\"blocked\");\n }\n if (input.repairedIds.has(plan.containerId)) {\n throw new DocumentAncestorRepairAbandonedError(\"peer-rotation\");\n }\n const { carriedPlans, result } = await submitStandaloneRepair(\n input.sync,\n plan,\n writerProjection,\n );\n const response = result.ok ? result.data : null;\n // Deliberately not ContainerKekRepairRequiredError: that is classified as\n // retryable, so a handled refusal would re-sign the whole prefix before\n // failing again, and the retry never reaches onTerminalSubmitFailure\n // regardless, because this throws before submission.\n if (!response) {\n if (!result.ok && isTerminalRepairStatus(result.status)) {\n await input.sync.onTerminalSubmitFailure?.({\n code: \"document_ancestor_repair_refused\",\n message: `Ancestor repair refused for ${plan.containerId}`,\n ok: false,\n report: () => undefined,\n status: result.status,\n });\n }\n throw new DocumentAncestorRepairAbandonedError(\"refused\");\n }\n // What a repair carried committed with it, so the pins advance together.\n const acknowledged = await acknowledgeContainerMutationBatch({\n execSql: input.sync.execSql,\n plans: [plan, ...carriedPlans.map((carried) => carried.plan)],\n responses: [response, ...(response.containerRekeys ?? [])],\n stillCurrent: input.sync.stillCurrent,\n });\n if (!acknowledged) {\n // A refused guarded transaction is usually a generation flip; surface it\n // as the shared cancellation so syncRemoteDocument returns null instead\n // of reporting a routine flip as a sync failure.\n assertProjectionVerificationCurrent(input.sync.stillCurrent);\n throw new Error(\"Document ancestor repair was superseded\");\n }\n input.repairedIds.add(plan.containerId);\n for (const carried of carriedPlans) {\n input.repairedIds.add(carried.plan.containerId);\n }\n committed += 1 + carriedPlans.length;\n // The rest of this prefix was signed before the carry. A plan for a carried\n // container extends a superseded head, and one below it pins an epoch that\n // was never minted. Stop here; the caller refetches and re-plans.\n if (carriedPlans.length > 0) return committed;\n }\n return committed;\n}\n\n/**\n * Large repairs commit a bounded prefix; the last batch stays atomic with content.\n * A tighter local resource budget may be used, but never above the protocol cap.\n */\nexport async function prepareAutomaticContainerRekeys(\n sync: SyncRemoteDocumentInput,\n initialProjection: DocumentWriterProjectionResponse,\n maxRepairs = MAX_CONTAINER_PATH_LENGTH,\n): Promise<{\n plans: readonly MaterializedContainerRekeyPlan[];\n projection: DocumentWriterProjectionResponse;\n}> {\n if (initialProjection.documentId !== sync.documentId) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Document ancestor repair projection targets another document\",\n );\n }\n let projection = initialProjection;\n const repairedIds = new Set<string>();\n // `repairedIds` only breaks a loop within one preparation. An explicit sync\n // retry starts another preparation with a fresh set. Bound the\n // work by the deepest authorizing path the protocol allows, counted across\n // the whole pass rather than per call: no honest chain needs more repairs\n // than that, so re-entry cannot multiply the budget.\n for (;;) {\n const batch = await buildAutomaticContainerRekeys(sync, projection);\n const commitsStandalone =\n batch.hasMore ||\n (batch.plans.length > 0 && standaloneRepairPasses.has(sync));\n if (!commitsStandalone) return { plans: batch.plans, projection };\n // Standalone mutations require authentic document scope before any request.\n // Persist the verified heads here, unlike the inline path: a committed\n // repair is acknowledged against the latest durable pin, and a repaired\n // ancestor is always past epoch 1, so a device that has never pinned it\n // would reject its own acknowledgement after the server already committed\n // the rekey. The inline path needs no pin because the sync response\n // re-verifies and pins before anything is acknowledged.\n await assertDocumentWriterProjectionConsistent(projection, {\n ...projectionVerificationOptions(sync),\n persistVerificationCheckpoints: true,\n allowStaleContentKeyBundle: true,\n });\n // Charge what this prefix can still commit, then settle to what it did: it\n // stops early after a repair that carried something, and charging the plans\n // it never submitted would spend the budget on work that did not happen.\n const committedBefore = passRepairTotals.get(sync) ?? 0;\n if (\n committedBefore + batch.plans.length >\n Math.min(maxRepairs, MAX_CONTAINER_PATH_LENGTH)\n ) {\n throw new DocumentAncestorRepairAbandonedError(\"depth-budget\");\n }\n passRepairTotals.set(\n sync,\n committedBefore +\n (await commitRepairPrefix({ plans: batch.plans, repairedIds, sync })),\n );\n const fresh = await refreshSyncAttemptWriterProjection({\n apiClient: sync.apiClient,\n documentId: sync.documentId,\n onRemoteDocumentDeleted: sync.onRemoteDocumentDeleted,\n onSyncAbandoned: sync.onSyncAbandoned,\n onSyncTrace: sync.onSyncTrace,\n // Always a write-bearing pass, so a terminal projection failure (a 403\n // after revocation mid-repair) must leave the durable record that the\n // queued writes are blocked. onReadOnlyProjectionFailure is documented\n // for passes without queued writes and would not apply here.\n onTerminalFailure: sync.onTerminalSubmitFailure,\n stillCurrent: sync.stillCurrent,\n });\n if (!fresh) {\n // refreshSyncAttemptWriterProjection returns null on a generation flip.\n assertProjectionVerificationCurrent(sync.stillCurrent);\n // It has already called onSyncAbandoned by this point, and on a coded 404\n // ran the verified local teardown, so a bare Error would double-signal as\n // an abandon plus a sync-lane crash.\n throw new DocumentAncestorRepairAbandonedError(\"unrefreshable\");\n }\n // The scope check above guards the first round only; a refetched projection\n // is server-supplied too, and nothing in the refresh path proves it names\n // the document this repair is for.\n if (fresh.documentId !== sync.documentId) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Document ancestor repair projection targets another document\",\n );\n }\n projection = fresh;\n }\n}\n\n/** An explicit preparation retry may commit repairs; plan retries never do. */\nexport async function prepareSyncAttemptContainerRekeys(\n sync: SyncRemoteDocumentInput,\n projection: DocumentWriterProjectionResponse,\n) {\n try {\n return await prepareAutomaticContainerRekeys(sync, projection);\n } catch (error) {\n if (\n !sync.apiClient.evictDocumentWriterProjection ||\n !shouldRetrySyncWithFreshWriterProjection(error)\n )\n throw error;\n }\n const fresh = await refreshSyncAttemptWriterProjection({\n apiClient: sync.apiClient,\n documentId: sync.documentId,\n onRemoteDocumentDeleted: sync.onRemoteDocumentDeleted,\n onSyncAbandoned: sync.onSyncAbandoned,\n onSyncTrace: sync.onSyncTrace,\n onTerminalFailure: sync.onTerminalSubmitFailure,\n stillCurrent: sync.stillCurrent,\n });\n return fresh ? prepareAutomaticContainerRekeys(sync, fresh) : null;\n}\n"]}

package/workflows/documents/{syncContainerRekeyProjection.js → syncRekeys/syncContainerRekeyProjection.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { computeDocumentContentKeyTargetHash } from "../../internal/crypto/index.js";
-import { normalizeDocumentKekTargetResponse, readManifestContainerId, } from "../../data/documents/shared/readers.js";
+import { computeDocumentContentKeyTargetHash } from "../../../internal/crypto/index.js";
+import { normalizeDocumentKekTargetResponse, readManifestContainerId, } from "../../../data/documents/shared/readers.js";
 function replaceRekeyedPathNode(input) {
     const index = input.projection.path.findIndex((bundle) => readManifestContainerId(bundle) === input.plan.plan.containerId);
     if (index < 0)

package/workflows/documents/syncRekeys/syncContainerRekeyProjection.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncContainerRekeyProjection.js","sourceRoot":"","sources":["syncContainerRekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EACL,kCAAkC,EAClC,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAEhD,SAAS,sBAAsB,CAAC,KAG/B;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC5E,CAAC;IACF,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,CAAC,YAAY;QACb,CAAC,OAAO;QACR,gBAAgB,CAAC,YAAY;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC/C,WAAW,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,YAAY,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;IAC3B,aAAa,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAC/B,OAAO;QACL,UAAU,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE;QACxD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,gBAAkD,EAClD,IAAoC;IAEpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,yBAAyB,GAC7B,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9D,YAAY,KAAK,QAAQ,CAAC,QAAQ,CAAC;QACnC,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,kCAAkC,CAChD,gBAAgB,CAAC,kBAAkB,CACpC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC;QAChE,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,MAAM;YACT,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,qBAAqB,EAAE,YAAY,CAAC,YAAY;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GACzB,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,gBAAgB;QACnB,yBAAyB;QACzB,GAAG,CAAC,qBAAqB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,UAAU;YACxE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAa,EAAE,CAAC;QAC7C,kBAAkB,EAAE;YAClB,GAAG,gBAAgB,CAAC,kBAAkB;YACtC,qBAAqB;YACrB,0BAA0B,EAAE,OAAO,CAAC,GAAG,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CACvC;YACD,6BAA6B,EAAE,OAAO,CAAC,GAAG,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC;YACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;SAClD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAGtD;IACC,IAAI,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,UAAU,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { computeDocumentContentKeyTargetHash } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedContainerRekeyPlan } from \"../../../data/containers/shared/types\";\nimport {\n normalizeDocumentKekTargetResponse,\n readManifestContainerId,\n} from \"../../../data/documents/shared/readers\";\n\nfunction replaceRekeyedPathNode(input: {\n plan: MaterializedContainerRekeyPlan;\n projection: DocumentWriterProjectionResponse[\"authorizingContainerPaths\"][number];\n}) {\n const index = input.projection.path.findIndex(\n (bundle) => readManifestContainerId(bundle) === input.plan.plan.containerId,\n );\n if (index < 0) return { projection: input.projection, replaced: false };\n const previousManifest = input.projection.path[index];\n const previousKek = input.projection.containerKeks[index];\n const nextManifest = input.plan.writerProjection.path.at(-1);\n const nextKek = input.plan.writerProjection.containerKeks.at(-1);\n if (\n !previousManifest ||\n !previousKek ||\n !nextManifest ||\n !nextKek ||\n previousManifest.manifestHash !==\n input.plan.plan.previousManifest.manifestHash ||\n previousKek.accessManifestHash !== previousManifest.manifestHash\n ) {\n throw new Error(\"Document inline rekey projection predecessor mismatch\");\n }\n const path = [...input.projection.path];\n const containerKeks = [...input.projection.containerKeks];\n path[index] = nextManifest;\n containerKeks[index] = nextKek;\n return {\n projection: { ...input.projection, containerKeks, path },\n replaced: true,\n };\n}\n\nexport async function applyContainerRekeyPlan(\n writerProjection: DocumentWriterProjectionResponse,\n plan: MaterializedContainerRekeyPlan,\n): Promise<DocumentWriterProjectionResponse> {\n let replacedPath = false;\n const authorizingContainerPaths =\n writerProjection.authorizingContainerPaths.map((projection) => {\n const replaced = replaceRekeyedPathNode({ plan, projection });\n replacedPath ||= replaced.replaced;\n return replaced.projection;\n });\n const nextKek = plan.writerProjection.containerKeks.at(-1);\n const nextManifest = plan.writerProjection.path.at(-1);\n if (!nextKek || !nextManifest) {\n throw new Error(\"Document inline rekey projection is empty\");\n }\n let replacedTarget = false;\n const targets = normalizeDocumentKekTargetResponse(\n writerProjection.documentKekTargets,\n ).map((target) => {\n if (target.containerId !== plan.plan.containerId) return target;\n replacedTarget = true;\n return {\n ...target,\n containerKeyEpoch: nextKek.containerKeyEpoch,\n containerKeyEpochId: nextKek.containerKeyEpochId,\n containerManifestHash: nextManifest.manifestHash,\n };\n });\n if (!replacedPath && !replacedTarget) {\n throw new Error(\n \"Document inline rekey does not belong to its writer projection\",\n );\n }\n const documentKeyTargetHash =\n await computeDocumentContentKeyTargetHash(targets);\n return {\n ...writerProjection,\n authorizingContainerPaths,\n ...(documentKeyTargetHash === writerProjection.contentKeyBundle.targetHash\n ? {}\n : { contentKeyBundleStale: true as const }),\n documentKekTargets: {\n ...writerProjection.documentKekTargets,\n documentKeyTargetHash,\n linkedContainerKeyEpochIds: targets.map(\n (target) => target.containerKeyEpochId,\n ),\n linkedContainerManifestHashes: targets.map(\n (target) => target.containerManifestHash,\n ),\n targets: targets.map((target) => ({ ...target })),\n },\n };\n}\n\nexport async function applyDocumentSyncContainerRekeys(input: {\n plans: readonly MaterializedContainerRekeyPlan[];\n writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentWriterProjectionResponse> {\n let projection = input.writerProjection;\n for (const plan of input.plans) {\n projection = await applyContainerRekeyPlan(projection, plan);\n }\n return projection;\n}\n"]}

package/workflows/documents/{syncContainerRekeys.js → syncRekeys/syncContainerRekeys.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { DocumentSyncPreparationRequiredError } from "../syncFailures/syncRepairAbandon.js";
+import { buildMaterializedDocumentSyncPlan } from "../syncPlan/syncPlanMaterial.js";
 import { buildAutomaticContainerRekeys } from "./syncAutomaticContainerRekeys.js";
 import { requiresStandaloneAncestorRepairs } from "./syncContainerRekeyPreparation.js";
 import { applyDocumentSyncContainerRekeys } from "./syncContainerRekeyProjection.js";
-import { buildMaterializedDocumentSyncPlan } from "./syncPlanMaterial.js";
 import { computeInlineRekeyCommitId } from "./syncRekeyCommit.js";
-import { DocumentSyncPreparationRequiredError } from "./syncRepairAbandon.js";
 /** Plan only: standalone server repairs belong to the outer sync attempt. */
 export async function buildRemoteDocumentSyncPlan(input) {
     // Repairing this document's own container moves its key target hash, which

package/workflows/documents/syncRekeys/syncContainerRekeys.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncContainerRekeys.js","sourceRoot":"","sources":["syncContainerRekeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAGrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAC1E,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC1C,IACE,KAAK,CAAC,cAAc,CAAC,MAAM;QAC3B,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB;QAChC,kBAAkB;QAClB,cAAc,KAAK,SAAS,EAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAC/C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,UAAU,CACjB,CAAC;QACF,IACE,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,oCAAoC,EAAE,CAAC;QACnD,CAAC;QACD,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,cAAc,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB;QAC5D,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE;YACtD,8BAA8B,EAAE,KAAK;SACtC,CAAC;QACJ,CAAC,CAAC,cAAc,CAAC;IACrB,MAAM,gBAAgB,GAAG,UAAU,EAAE,MAAM;QACzC,CAAC,CAAC,MAAM,gCAAgC,CAAC;YACrC,KAAK,EAAE,UAAU;YACjB,gBAAgB,EAAE,KAAK,CAAC,UAAU;SACnC,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACrB,IAAI,mBAAuC,CAAC;IAC5C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;YACrD,mBAAmB,EAAE,iBAAiB,CAAC,EAAE;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iCAAiC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;QACzB,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,eAAe,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;QAC3B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,8BAA8B,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;QAC3C,gBAAgB;QAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { MaterializedContainerRekeyPlan } from \"../../../data/containers/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type { SyncRemoteDocumentInput } from \"../sync/readOnlySync\";\nimport { DocumentSyncPreparationRequiredError } from \"../syncFailures/syncRepairAbandon\";\nimport { buildMaterializedDocumentSyncPlan } from \"../syncPlan/syncPlanMaterial\";\nimport { buildAutomaticContainerRekeys } from \"./syncAutomaticContainerRekeys\";\nimport { requiresStandaloneAncestorRepairs } from \"./syncContainerRekeyPreparation\";\nimport { applyDocumentSyncContainerRekeys } from \"./syncContainerRekeyProjection\";\nimport { computeInlineRekeyCommitId } from \"./syncRekeyCommit\";\n\n/** Plan only: standalone server repairs belong to the outer sync attempt. */\nexport async function buildRemoteDocumentSyncPlan(input: {\n preparedRekeys?: readonly MaterializedContainerRekeyPlan[] | undefined;\n minLsn?: string | undefined;\n pendingUpdates: readonly PendingUpdateRecord[];\n pullCursor?: string | undefined;\n projection: DocumentWriterProjectionResponse;\n regenerateQueuedCheckpoints: boolean;\n sync: SyncRemoteDocumentInput;\n}) {\n // Repairing this document's own container moves its key target hash, which\n // marks the content-key bundle stale. Only a pass that can build a rotation\n // snapshot is able to heal that; rotation settlement deliberately cannot\n // (`syncRequest.ts` omits the builder for `allowRecoveryBaseline: false`), so\n // repairing there would trade a classified \"ancestor repair required\" failure\n // for an unhealable bundle — after a standalone prefix may already have been\n // committed. Such a pass is left to fail as it did before automatic repair.\n const canHealStaleBundle = input.sync.buildRotationSnapshot !== undefined;\n let automaticPlans = input.preparedRekeys;\n if (\n input.pendingUpdates.length &&\n !input.sync.buildContainerRekeys &&\n canHealStaleBundle &&\n automaticPlans === undefined\n ) {\n const batch = await buildAutomaticContainerRekeys(\n input.sync,\n input.projection,\n );\n if (\n batch.hasMore ||\n (batch.plans.length > 0 && requiresStandaloneAncestorRepairs(input.sync))\n ) {\n throw new DocumentSyncPreparationRequiredError();\n }\n automaticPlans = batch.plans;\n }\n const rekeyPlans =\n input.pendingUpdates.length && input.sync.buildContainerRekeys\n ? await input.sync.buildContainerRekeys(input.projection, {\n persistVerificationCheckpoints: false,\n })\n : automaticPlans;\n const writerProjection = rekeyPlans?.length\n ? await applyDocumentSyncContainerRekeys({\n plans: rekeyPlans,\n writerProjection: input.projection,\n })\n : input.projection;\n let inlineRekeyCommitId: string | undefined;\n if (rekeyPlans?.length) {\n const headPendingUpdate = input.pendingUpdates[0];\n if (!headPendingUpdate) {\n throw new Error(\"Document inline rekey pending queue is empty\");\n }\n inlineRekeyCommitId = await computeInlineRekeyCommitId({\n headPendingUpdateId: headPendingUpdate.id,\n projection: input.projection,\n });\n }\n return buildMaterializedDocumentSyncPlan({\n author: input.sync.author,\n buildRotationSnapshot: input.sync.buildRotationSnapshot,\n containerRekeys: rekeyPlans?.map(({ plan }) => plan.request),\n execSql: input.sync.execSql,\n historyMode: input.sync.historyMode,\n inlineRekeyCommitId,\n localVersionVector: input.sync.localVersionVector,\n minLsn: input.minLsn,\n onSyncTrace: input.sync.onSyncTrace,\n pendingUpdates: input.pendingUpdates,\n persistVerificationCheckpoints: rekeyPlans?.length ? false : undefined,\n pullCursor: input.pullCursor,\n regenerateQueuedCheckpoints: input.regenerateQueuedCheckpoints,\n signedAt: input.sync.signedAt,\n targetSecretKey: input.sync.targetSecretKey,\n writerProjection,\n ...projectionVerificationOptions(input.sync),\n });\n}\n"]}

package/workflows/documents/{syncRecoveryRekey.d.ts → syncRekeys/syncRecoveryRekey.d.ts} RENAMED Viewed

@@ -1,7 +1,7 @@
-import type { DocumentSyncResponse } from "../../internal/validators/response/index.js";
-import type { DocumentSyncSubmitFailure } from "../../data/documents/shared/types.js";
-import { type PendingUpdateRecord } from "../../data/sqlite/documentPersistence.js";
-import { type ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { DocumentSyncResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentSyncSubmitFailure } from "../../../data/documents/shared/types.js";
+import { type PendingUpdateRecord } from "../../../data/sqlite/documentPersistence.js";
+import { type ExecSql } from "../../../data/sqlite/sqlSchema.js";
 export type RekeyPendingUpdate = (execSql: ExecSql, id: string) => Promise<string | null>;
 interface DecryptedSyncUpdate {
     id: string;

package/workflows/documents/{syncRecoveryRekey.js → syncRekeys/syncRecoveryRekey.js} RENAMED Viewed

@@ -1,7 +1,7 @@
-import { base64ToBytes } from "../../internal/encoding/index.js";
-import { MAX_PENDING_UPDATE_REKEYS, rekeyDocumentPendingUpdate, } from "../../data/sqlite/documentPersistence.js";
-import { getClientSQLitePersistenceRuntime } from "../../data/sqlite/sqlitePersistenceRuntime.js";
-import { runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
+import { base64ToBytes } from "../../../internal/encoding/index.js";
+import { MAX_PENDING_UPDATE_REKEYS, rekeyDocumentPendingUpdate, } from "../../../data/sqlite/documentPersistence.js";
+import { getClientSQLitePersistenceRuntime } from "../../../data/sqlite/sqlitePersistenceRuntime.js";
+import { runSerializedSqlMutation, } from "../../../data/sqlite/sqlSchema.js";
 function bytesEqual(left, right) {
     return (left.byteLength === right.byteLength &&
         left.every((value, index) => value === right[index]));

package/workflows/documents/syncRekeys/syncRecoveryRekey.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"syncRecoveryRekey.js","sourceRoot":"","sources":["syncRecoveryRekey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,yBAAyB,EAEzB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAEL,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAcxC,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACpC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,aAAkC,EAClC,eAAgD;IAEhD,IACE,aAAa,CAAC,yBAAyB;QACrC,eAAe,CAAC,yBAAyB;QAC3C,aAAa,CAAC,uBAAuB;YACnC,eAAe,CAAC,uBAAuB,EACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,UAAU,CACf,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,EACvC,eAAe,CAAC,UAAU,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IACE,aAAa;YACb,mCAAmC,CAAC,aAAa,EAAE,MAAM,CAAC,EAC1D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAM1D;IAIC,MAAM,kBAAkB,GACtB,KAAK,CAAC,kBAAkB,IAAI,0BAA0B,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,uBAAuB,GAAa,EAAE,CAAC;IAC7C,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,MAAM;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;YAC1D,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,KAAK,CAAC,OAAO,EACb,CAAC,aAAa,EAAE,EAAE,CAChB,iCAAiC,CAAC,aAAa,CAAC,CAAC,kBAAkB,CACjE,KAAK,IAAI,EAAE,CACT,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAC9B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,kBAAkB,CAAC,aAAa,EAAE,eAAe,CAAC,EACxD,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACvC,CACJ,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,KAIC;IAKD,MAAM,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,GAC1D,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,uBAAuB,EAAE,CACnC,uBAAuB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,2BAA2B,EAAE,yBAAyB,CAAC,MAAM;QAC7D,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,cAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,0CAA0C,yBAAyB,qBAAqB,cAAc,UAAU,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC3J,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;QAChB,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type { DocumentSyncSubmitFailure } from \"../../../data/documents/shared/types\";\nimport {\n MAX_PENDING_UPDATE_REKEYS,\n type PendingUpdateRecord,\n rekeyDocumentPendingUpdate,\n} from \"../../../data/sqlite/documentPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../../data/sqlite/sqlitePersistenceRuntime\";\nimport {\n type ExecSql,\n runSerializedSqlMutation,\n} from \"../../../data/sqlite/sqlSchema\";\n\nexport type RekeyPendingUpdate = (\n execSql: ExecSql,\n id: string,\n) => Promise<string | null>;\n\ninterface DecryptedSyncUpdate {\n id: string;\n partialEndVersionVector: string;\n partialStartVersionVector: string;\n updateData: Uint8Array;\n}\n\nfunction bytesEqual(left: Uint8Array, right: Uint8Array): boolean {\n return (\n left.byteLength === right.byteLength &&\n left.every((value, index) => value === right[index])\n );\n}\n\nfunction pendingUpdateMatchesDecryptedUpdate(\n pendingUpdate: PendingUpdateRecord,\n decryptedUpdate: Omit<DecryptedSyncUpdate, \"id\">,\n): boolean {\n if (\n pendingUpdate.partialStartVersionVector !==\n decryptedUpdate.partialStartVersionVector ||\n pendingUpdate.partialEndVersionVector !==\n decryptedUpdate.partialEndVersionVector\n ) {\n return false;\n }\n\n return bytesEqual(\n base64ToBytes(pendingUpdate.updateData),\n decryptedUpdate.updateData,\n );\n}\n\nexport function settledPendingUpdateIdsFromSync(input: {\n decryptedUpdates: readonly DecryptedSyncUpdate[];\n recoveryPendingUpdatesById: ReadonlyMap<string, PendingUpdateRecord>;\n response: DocumentSyncResponse;\n}): string[] {\n const settled = new Set(input.response.acceptedOutgoingUpdateIds);\n\n for (const update of input.decryptedUpdates) {\n const pendingUpdate = input.recoveryPendingUpdatesById.get(update.id);\n if (\n pendingUpdate &&\n pendingUpdateMatchesDecryptedUpdate(pendingUpdate, update)\n ) {\n settled.add(update.id);\n }\n }\n\n return [...settled];\n}\n\n/**\n * A read-only recovery sync settles a conflicted pending update only when the\n * response carries it — but the server's frontier filter omits spans the\n * request's localVersionVector already covers, which a locally-applied\n * pending update always is. Left alone, the conflicted id is resubmitted (and\n * 409s the whole outgoing batch) forever: a lost ack leaves the server\n * holding the original ciphertext, and every rebuild encrypts with a fresh\n * IV, so a byte-identical retry can never be reproduced. Re-key what\n * recovery could not settle so the next sync pass submits the same ops under\n * a conflict-free id; the server-side copy stays harmless because CRDT\n * update import is idempotent.\n *\n * Re-keying goes through the caller's persistence implementation when given\n * (defaulting to the built-in pending-update table) and reports only ids\n * whose row actually changed, so a record living in some other queue never\n * counts as progress. Returns the fresh ids so callers can treat re-keying\n * as settlement-like progress and schedule the pass that submits them.\n *\n * A row whose persisted rekeyCount has reached the bound is not re-keyed\n * again: it is reported as exhausted so the caller can surface a terminal\n * failure instead of feeding an unbounded conflict loop that survives\n * restarts (each session's in-memory lane cap resets, this bound does not).\n */\nexport async function rekeyUnsettledRecoveryPendingUpdates(input: {\n execSql: ExecSql;\n recoveryPendingUpdatesById: ReadonlyMap<string, PendingUpdateRecord>;\n rekeyPendingUpdate?: RekeyPendingUpdate | undefined;\n settledPendingUpdateIds: readonly string[];\n stillCurrent?: (() => boolean) | undefined;\n}): Promise<{\n exhaustedPendingUpdateIds: string[];\n rekeyedPendingUpdateIds: string[];\n}> {\n const rekeyPendingUpdate =\n input.rekeyPendingUpdate ?? rekeyDocumentPendingUpdate;\n const settled = new Set(input.settledPendingUpdateIds);\n const rekeyedPendingUpdateIds: string[] = [];\n const exhaustedPendingUpdateIds: string[] = [];\n for (const [pendingUpdateId, record] of input.recoveryPendingUpdatesById) {\n if (input.stillCurrent?.() === false) break;\n if (settled.has(pendingUpdateId)) {\n continue;\n }\n // Known multi-tab limitation: the count is the row as loaded at pass\n // start, so a sibling tab that settle-deleted the row can make this\n // record a failure for work that no longer exists. The stale failure is\n // transient — the document's next clean pass clears it.\n if ((record.rekeyCount ?? 0) >= MAX_PENDING_UPDATE_REKEYS) {\n exhaustedPendingUpdateIds.push(pendingUpdateId);\n continue;\n }\n const outcome = await runSerializedSqlMutation(\n input.execSql,\n (lockedExecSql) =>\n getClientSQLitePersistenceRuntime(lockedExecSql).guardedTransaction(\n async () =>\n input.stillCurrent?.() === false\n ? null\n : rekeyPendingUpdate(lockedExecSql, pendingUpdateId),\n () => input.stillCurrent?.() !== false,\n ),\n );\n if (!outcome.committed) break;\n const nextId = outcome.result;\n if (nextId !== null) {\n rekeyedPendingUpdateIds.push(nextId);\n }\n }\n if (input.stillCurrent?.() === false) {\n return { exhaustedPendingUpdateIds: [], rekeyedPendingUpdateIds: [] };\n }\n return { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds };\n}\n\n/**\n * Re-key what recovery could not settle and surface exhausted rows through\n * the caller's terminal-failure handler. The exhausted count is also\n * returned so the sync result can carry it: a pass that recorded this\n * failure must not read as clean to callers that clear recorded failures\n * on success.\n */\nexport async function rekeyAndReportUnsettledRecoveryPendingUpdates(\n input: Parameters<typeof rekeyUnsettledRecoveryPendingUpdates>[0] & {\n onTerminalSubmitFailure?:\n | ((failure: DocumentSyncSubmitFailure) => Promise<void> | void)\n | undefined;\n },\n): Promise<{\n exhaustedPendingUpdateCount: number;\n rekeyedPendingUpdateIds: string[];\n}> {\n const { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds } =\n await rekeyUnsettledRecoveryPendingUpdates(input);\n if (input.stillCurrent?.() === false) {\n return { exhaustedPendingUpdateCount: 0, rekeyedPendingUpdateIds: [] };\n }\n if (exhaustedPendingUpdateIds.length > 0) {\n await input.onTerminalSubmitFailure?.(\n rekeyLimitSubmitFailure(exhaustedPendingUpdateIds.length),\n );\n }\n return {\n exhaustedPendingUpdateCount: exhaustedPendingUpdateIds.length,\n rekeyedPendingUpdateIds,\n };\n}\n\n/**\n * Terminal failure recorded when conflict recovery gives up on pending\n * updates whose persisted re-key bound is exhausted. Shaped like a submit\n * failure so the existing write-queue surface (recordDocumentSyncFailure via\n * onTerminalSubmitFailure) explains the stuck write without new plumbing.\n */\nexport function rekeyLimitSubmitFailure(\n exhaustedCount: number,\n): DocumentSyncSubmitFailure {\n return {\n message: `Update conflict recovery gave up after ${MAX_PENDING_UPDATE_REKEYS} re-key attempts (${exhaustedCount} update${exhaustedCount === 1 ? \"\" : \"s\"})`,\n ok: false,\n report: () => {},\n status: null,\n };\n}\n"]}

package/workflows/documents/{syncRekeyCommit.js → syncRekeys/syncRekeyCommit.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { serializeKeyingCanonicalJson, toFingerprint } from "../../internal/crypto/index.js";
+import { serializeKeyingCanonicalJson, toFingerprint } from "../../../internal/crypto/index.js";
 const textEncoder = new TextEncoder();
 /**
  * Identifies one logical inline-rekey flush across plan rematerialization.

package/workflows/organizations/{currentGroupMetadataAuthority.js → groupMetadata/currentGroupMetadataAuthority.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { loadCurrentOrganizationAuthority } from "../currentOrganizationAuthority.js";
 import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
 /** Authenticate metadata-root grants with current policies and only its cited predecessors. */
 export function createCurrentGroupMetadataContainerVerifier(input) {

package/workflows/organizations/groupMetadata/currentGroupMetadataAuthority.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,mDAAmD,CAAC;YACxD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mDAAmD,CAAC,KAMnE;IACC,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IACE,qBAAqB,CAAC,aAAa,KAAK,cAAc;gBACtD,qBAAqB,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;gBAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;YACJ,IACE,CAAC,6BAA6B,CAC5B,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAChC,qBAAqB,CACtB;gBAED,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,CACxE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n type ContainerAccessManifestState,\n KeyingVerificationError,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n input: Omit<\n Parameters<typeof loadCurrentOrganizationAuthority>[0],\n \"organizationReference\"\n >,\n) {\n return async (\n state: ContainerAccessManifestState,\n organizationReference?: ReferencedPrincipalHead,\n ): Promise<void> => {\n assertProjectionVerificationCurrent(input.stillCurrent);\n const authority = await loadCurrentOrganizationAuthority({\n ...input,\n organizationReference,\n });\n await createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: input.organizationId,\n stillCurrent: input.stillCurrent,\n })(state, organizationReference);\n };\n}\n\n/** Reuse one mutation's verified authority without broadening its lease or scope. */\nexport function createSelectedCurrentGroupMetadataContainerVerifier(input: {\n readonly authority: Awaited<\n ReturnType<typeof loadCurrentOrganizationAuthority>\n >;\n readonly organizationId: string;\n readonly stillCurrent: () => boolean;\n}) {\n return async (\n state: ContainerAccessManifestState,\n organizationReference?: ReferencedPrincipalHead,\n ): Promise<void> => {\n const { authority } = input;\n const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();\n assertProjectionVerificationCurrent(stillCurrent);\n if (organizationReference) {\n if (\n organizationReference.principalType !== \"organization\" ||\n organizationReference.principalId !== input.organizationId\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Current policy reference is outside its scope\",\n );\n if (\n !principalHeadMatchesReference(\n authority.directory.policy.state,\n organizationReference,\n )\n )\n throw new ProjectionDependencyUnavailableError(\n \"Metadata root belongs to a changed organization directory\",\n );\n }\n const { adminGroupId, memberGroupId } = authority.descriptor;\n const citation = (groupId: string) =>\n state.referencedPrincipalHeads.find(\n (head) =>\n head.principalType === \"group\" && head.principalId === groupId,\n );\n const admins = await authority.readGroup(\n adminGroupId,\n citation(adminGroupId),\n );\n const members = await authority.readGroup(\n memberGroupId,\n citation(memberGroupId),\n );\n assertMetadataRootBinding({\n organizationId: input.organizationId,\n authority: {\n descriptor: authority.descriptor,\n adminGroupId,\n memberGroupId,\n adminPolicy: admins.policy,\n },\n members,\n state,\n });\n assertProjectionVerificationCurrent(\n () => stillCurrent() && admins.stillCurrent() && members.stillCurrent(),\n );\n };\n}\n"]}

package/workflows/organizations/{groupMetadataAccess.d.ts → groupMetadata/groupMetadataAccess.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { type ContainerAccessManifestState, type GroupMetadataKey, type ReferencedPrincipalHead } from "../../internal/crypto/index.js";
-import type { ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { GroupPolicyNameReader } from "./principalPolicyRequest.js";
+import { type ContainerAccessManifestState, type GroupMetadataKey, type ReferencedPrincipalHead } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { GroupPolicyNameReader } from "../principalPolicy/principalPolicyRequest.js";
 export interface GroupMetadataAccessInput {
     readonly apiClient: {
         evictContainerWriterProjection(containerId: string): void;

package/workflows/organizations/{groupMetadataAccess.js → groupMetadata/groupMetadataAccess.js} RENAMED Viewed

@@ -1,9 +1,9 @@
-import { decryptGroupMetadata, readGroupMetadata, } from "../../internal/crypto/index.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "../../internal/validators/containerSystemSlot.js";
-import { getTargetContainerContext, readContainerState, } from "../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../data/documents/shared/containerKekPath.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadContainers } from "../../data/persistence/containers/containerPersistence.js";
+import { decryptGroupMetadata, readGroupMetadata, } from "../../../internal/crypto/index.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../../../internal/validators/containerSystemSlot.js";
+import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/containerKekPath.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadContainers } from "../../../data/persistence/containers/containerPersistence.js";
 import { withMetadataRootReload } from "./groupMetadataErrors.js";
 /**
  * A group's signed name does not open under the metadata key it cites, or opens

package/workflows/organizations/groupMetadata/groupMetadataAccess.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAKzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAG3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAuB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CACjC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAC7C,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n type ContainerAccessManifestState,\n decryptGroupMetadata,\n type GroupMetadataKey,\n type ReferencedPrincipalHead,\n readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n getTargetContainerContext,\n readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/containerKekPath\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../../data/persistence/containers/containerPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { GroupPolicyNameReader } from \"../principalPolicy/principalPolicyRequest\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\n\nexport interface GroupMetadataAccessInput {\n readonly apiClient: {\n evictContainerWriterProjection(containerId: string): void;\n getContainerWriterProjection(\n containerId: string,\n ): Promise<ContainerWriterProjectionResponse | null>;\n };\n readonly verifyMetadataContainer: (\n state: ContainerAccessManifestState,\n organizationReference?: ReferencedPrincipalHead | undefined,\n ) => Promise<void>;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly targetSecretKey: Uint8Array;\n readonly stillCurrent?: (() => boolean) | undefined;\n readonly warmReferencedPrincipalPolicies?:\n | ReferencedPrincipalPolicyWarmer\n | undefined;\n}\n\n/**\n * A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n */\nexport class GroupMetadataUnreadableError extends Error {\n constructor(groupId: string, cause: unknown) {\n super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n this.name = \"GroupMetadataUnreadableError\";\n }\n}\n\nfunction loadMetadataKeyring(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n return withMetadataRootReload(\n () => loadMetadataKeyringOnce(input, containerId),\n () => input.apiClient.evictContainerWriterProjection(containerId),\n );\n}\n\nasync function loadMetadataKeyringOnce(\n input: GroupMetadataAccessInput,\n containerId: string,\n) {\n const projection =\n await input.apiClient.getContainerWriterProjection(containerId);\n if (!projection) return null;\n if (\n projection.containerId !== containerId ||\n projection.organizationId !== input.organizationId\n )\n throw new Error(\"Group metadata container is unavailable\");\n const target = getTargetContainerContext(projection);\n const state = readContainerState(target.manifest);\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n if (\n state.organizationId !== input.organizationId ||\n state.systemSlot !== slot ||\n state.parentContainerId !== null\n )\n throw new Error(\n \"Group metadata requires the signed organization metadata container\",\n );\n await input.verifyMetadataContainer(\n state,\n projection.policyEvidence.organization?.head,\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keys = await unwrapContainerKekPath({\n ...input,\n projection,\n secretKey: input.targetSecretKey,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata container key is unavailable\");\n return {\n current: {\n organizationId: input.organizationId,\n containerId,\n containerKeyEpochId: target.kek.containerKeyEpochId,\n keyMaterial,\n },\n keys,\n };\n}\n\n/** Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n const loads = new Map<\n string,\n Promise<{\n current: GroupMetadataKey;\n keys: ReadonlyMap<string, Uint8Array>;\n } | null>\n >();\n function loaded(containerId: string) {\n let pending = loads.get(containerId);\n if (!pending) {\n pending = loadMetadataKeyring(input, containerId);\n loads.set(containerId, pending);\n }\n return pending;\n }\n const readName: GroupPolicyNameReader = async (bundle) => {\n assertProjectionVerificationCurrent(input.stillCurrent);\n const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n if (\"role\" in metadata)\n return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n if (\n metadata.organizationId !== input.organizationId ||\n metadata.groupId !== bundle.currentState.principalId ||\n bundle.currentState.principalType !== \"group\"\n )\n throw new Error(\"Group metadata scope does not match its signed group\");\n const keyring = await loaded(metadata.containerId);\n const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n if (!keyMaterial)\n throw new Error(\"Group metadata historical key is unavailable\");\n try {\n return await decryptGroupMetadata({\n key: { ...metadata, keyMaterial },\n groupId: bundle.currentState.principalId,\n payload: bundle.currentPayload.ciphertext,\n });\n } catch (cause) {\n throw new GroupMetadataUnreadableError(\n bundle.currentState.principalId,\n cause,\n );\n }\n };\n return {\n readName,\n async loadEncryptionKey(): Promise<GroupMetadataKey> {\n const slot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n const containers = await loadContainers(input.execSql);\n const container = containers.find(\n (row) =>\n row.organizationId === input.organizationId &&\n row.systemSlot === slot,\n );\n if (!container)\n throw new Error(\n \"Organization metadata container has not been discovered\",\n );\n const keyring = await loaded(container.id);\n if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n return keyring.current;\n },\n };\n}\n"]}

package/workflows/organizations/{groupMetadataBinding.js → groupMetadata/groupMetadataBinding.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { readGroupMetadata } from "../../internal/crypto/index.js";
+import { readGroupMetadata } from "../../../internal/crypto/index.js";
 /** Built-in labels derive from the role assigned by the signed organization. */
 export function assertGroupMetadataBinding(bundle, descriptor) {
     const groupId = bundle.currentState.principalId;

package/workflows/organizations/groupMetadata/groupMetadataBinding.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupMetadataBinding.js","sourceRoot":"","sources":["groupMetadataBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,MAGC,EACD,UAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,KAAK,UAAU,CAAC,YAAY;QACjC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACb,IACE,MAAM,IAAI,QAAQ;QAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAChC,CAAC,CAAC,YAAY,KAAK,IAAI;YACrB,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACrD,QAAQ,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { readGroupMetadata } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { OrganizationAuthorityDescriptor } from \"../../../data/principals/organizationAuthorityDescriptor\";\n\n/** Built-in labels derive from the role assigned by the signed organization. */\nexport function assertGroupMetadataBinding(\n bundle: Pick<\n PrincipalPolicyBundleResponse,\n \"currentState\" | \"currentPayload\"\n >,\n descriptor: OrganizationAuthorityDescriptor,\n): void {\n const groupId = bundle.currentState.principalId;\n const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n const expectedRole =\n groupId === descriptor.adminGroupId\n ? \"admins\"\n : groupId === descriptor.memberGroupId\n ? \"members\"\n : null;\n if (\n \"role\" in metadata\n ? metadata.role !== expectedRole\n : expectedRole !== null ||\n metadata.organizationId !== descriptor.organizationId ||\n metadata.groupId !== groupId\n ) {\n throw new Error(\n \"Group metadata does not match the signed organization directory\",\n );\n }\n}\n"]}

package/workflows/organizations/{groupMetadataContainerAuthority.js → groupMetadata/groupMetadataContainerAuthority.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
-import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { verifyDirectoryGroup } from "../groupNames/groupNameUniqueness.js";
+import { loadGroupNameDirectoryAuthority } from "../groupNames/organizationGroupNamePolicies.js";
 import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
-import { verifyDirectoryGroup } from "./groupNameUniqueness.js";
-import { loadGroupNameDirectoryAuthority } from "./organizationGroupNamePolicies.js";
 /** A public system slot alone cannot bind a self-authorized root to an organization. */
 export function createGroupMetadataContainerVerifier(input) {
     return async (state) => {

package/workflows/organizations/groupMetadata/groupMetadataContainerAuthority.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupMetadataContainerAuthority.js","sourceRoot":"","sources":["groupMetadataContainerAuthority.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAE1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAOvE,wFAAwF;AACxF,MAAM,UAAU,oCAAoC,CAAC,KAAY;IAC/D,OAAO,KAAK,EAAE,KAAmC,EAAiB,EAAE;QAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACpD,GAAG,KAAK;YACR,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC;gBAC5C,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IACE,MAAM;YACN,SAAS;YACT,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACJ,EACD,CAAC;YACD,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,4BAA4B,CAC7C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,UAAU,CACX,CAAC;QACF,yBAAyB,CAAC;YACxB,SAAS;YACT,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport {\n principalHeadMatchesReference,\n requireOrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport { verifyDirectoryGroup } from \"../groupNames/groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"../groupNames/organizationGroupNamePolicies\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\ntype Input = Omit<\n Parameters<typeof loadGroupNameDirectoryAuthority>[0],\n \"organizationPolicyReference\"\n> & { readonly reportSecurityIncident: SecurityIncidentReporter };\n\n/** A public system slot alone cannot bind a self-authorized root to an organization. */\nexport function createGroupMetadataContainerVerifier(input: Input) {\n return async (state: ContainerAccessManifestState): Promise<void> => {\n assertProjectionVerificationCurrent(input.stillCurrent);\n const cached = await loadPrincipalPolicyBundle(\n input.execSql,\n \"organization\",\n input.organizationId,\n );\n let authority = await loadGroupNameDirectoryAuthority({\n ...input,\n organizationPolicyReference: cached\n ? principalPolicyReferenceFromBundle(cached)\n : null,\n });\n if (\n cached &&\n authority &&\n state.referencedPrincipalHeads.some(\n (head) =>\n !authority?.descriptor.groupHeads.some((known) =>\n principalHeadMatchesReference(head, known),\n ),\n )\n ) {\n authority = await loadGroupNameDirectoryAuthority(input);\n }\n if (!authority)\n throw new Error(\"Organization metadata authority is unavailable\");\n const memberHead = requireOrganizationGroupHead(\n authority.descriptor,\n authority.memberGroupId,\n );\n const members = await verifyDirectoryGroup(\n {\n ...input,\n descriptor: authority.descriptor,\n externalAuthority: authority.externalAuthority,\n },\n memberHead,\n );\n assertMetadataRootBinding({\n authority,\n members,\n organizationId: input.organizationId,\n state,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n };\n}\n"]}

package/workflows/organizations/{groupMetadataErrors.js → groupMetadata/groupMetadataErrors.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
 /**
  * The organization metadata root was read before a reserved-group commit that
  * the signed directory already reflects: each head it cites that differs from

package/workflows/organizations/{groupMetadataRootBinding.js → groupMetadata/groupMetadataRootBinding.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyEvidenceEntries } from "../../data/principals/principalPolicyEvidence.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyEvidenceEntries } from "../../../data/principals/principalPolicyEvidence.js";
 import { MetadataRootBehindDirectoryError } from "./groupMetadataErrors.js";
 /** Root bindings consume verified current grants and explicitly retained predecessor citations. */
 export function assertMetadataRootBinding(input) {