npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.63 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (653) hide show

package/client/runtime/principalMutationDispatch.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationDispatch.js","sourceRoot":"","sources":["principalMutationDispatch.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAEL,gCAAgC,GACjC,MAAM~~,+DAA+D~~,CAAC;~~AAiBvE~~,mFAAmF;AACnF,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,cAAsB,EACtB,QAAmC,EACnC,UAAgC,EAAE;IAElC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,wBAAwB,CACjC,cAAc,EACd,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,mCAAmC,CAC5C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ;YACE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAgB;IAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,OAEoD,EACpD,QAA8D;IAE9D,KAAK,UAAU,MAAM,CACnB,cAAsB,EACtB,QAAmC,EACnC,SAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,GAAG,OAAO,CAAC,cAAc,CAAC;YAC1B,QAAQ;YACR,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CACpC,iCAAiC,CAC/B,GAAG,EACH,cAAc,EACd,KAAK,EACL,eAAe,CAChB,CACF;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAqD,CAC/D,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EACtC,uCAAuC,EACvC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAC3D,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,GAAG,GAA0C,CACjD,KAAK,EACL,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAChD,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,OAAO;QACL,mCAAmC,EAAE,MAAM;QAC3C,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACjC,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,wBAAwB,EAAE,GAAG;QAC7B,kBAAkB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAI,MAAwB;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC","sourcesContent":["import type {\n ApiClient,\n RequestResult,\n RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport {\n isCommitOrganizationGroupPolicyResponse,\n isCreateOrganizationGroupResponse,\n isDeleteOrganizationGroupResponse,\n isPrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport {\n type PrincipalMutationJournalContext,\n submitJournaledPrincipalMutation,\n} from \"../../workflows/organizations/principalMutationJournalSession\";\nimport type { PrincipalMutationResponse } from \"../../workflows/organizations/principalOperationReceipt\";\n\nimport type { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\n\nexport type JournaledPrincipalMutationMethods = Pick<\n ApiClient,\n \| \"commitOrganizationGroupPolicy\"\n \| \"commitOrganizationGroupPolicyResult\"\n \| \"createOrganizationGroup\"\n \| \"createOrganizationGroupResult\"\n \| \"deleteOrganizationGroup\"\n \| \"deleteOrganizationGroupResult\"\n \| \"putPrincipalPolicy\"\n \| \"putPrincipalPolicyResult\"\n>;\n\n/** Dispatch the authenticated operation, with no application planning callback. */\nexport function dispatchAuthoredPrincipalMutation(\n api: ApiClient,\n organizationId: string,\n mutation: AuthoredPrincipalMutation,\n options: RequestResultOptions = {},\n): Promise<RequestResult<PrincipalMutationResponse>> {\n switch (mutation.kind) {\n case \"organization\":\n return api.putPrincipalPolicyResult(\n \"organization\",\n organizationId,\n mutation.request,\n options,\n );\n case \"group-create\":\n return api.createOrganizationGroupResult(\n organizationId,\n mutation.request,\n options,\n );\n case \"group-delete\":\n return api.deleteOrganizationGroupResult(\n organizationId,\n mutation.groupId,\n mutation.request,\n options,\n );\n case \"compound\":\n return api.commitOrganizationGroupPolicyResult(\n organizationId,\n mutation.groupId,\n mutation.request,\n options,\n );\n default:\n return unsupportedMutation(mutation);\n }\n}\n\nfunction unsupportedMutation(_mutation: never): never {\n throw new Error(\"Unsupported principal mutation operation\");\n}\n\nexport function createJournaledPrincipalMutations(\n api: ApiClient,\n context: (\n organizationId: string,\n ) => Omit<PrincipalMutationJournalContext, \"submit\">,\n dispatch: ReturnType<typeof createPrincipalMutationDispatcher>,\n): JournaledPrincipalMutationMethods {\n async function submit<T extends PrincipalMutationResponse>(\n organizationId: string,\n mutation: AuthoredPrincipalMutation,\n validator: (value: unknown) => value is T,\n options: RequestResultOptions = {},\n ): Promise<RequestResult<T>> {\n const result = await submitJournaledPrincipalMutation({\n ...context(organizationId),\n mutation,\n submit: (saved) =>\n dispatch(options, (dispatchOptions) =>\n dispatchAuthoredPrincipalMutation(\n api,\n organizationId,\n saved,\n dispatchOptions,\n ),\n ),\n });\n if (!result.ok) return result;\n // The session already verified this operation before clearing its row.\n // This check narrows the union for each existing public API signature.\n if (!validator(result.data))\n throw new Error(\"Unexpected principal receipt operation\");\n return { ok: true, data: result.data };\n }\n const commit: ApiClient[\"commitOrganizationGroupPolicyResult\"] = (\n organizationId,\n groupId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"compound\", groupId, request },\n isCommitOrganizationGroupPolicyResponse,\n options,\n );\n const create: ApiClient[\"createOrganizationGroupResult\"] = (\n organizationId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"group-create\", groupId: request.groupId, request },\n isCreateOrganizationGroupResponse,\n options,\n );\n const remove: ApiClient[\"deleteOrganizationGroupResult\"] = (\n organizationId,\n groupId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"group-delete\", groupId, request },\n isDeleteOrganizationGroupResponse,\n options,\n );\n const put: ApiClient[\"putPrincipalPolicyResult\"] = (\n _type,\n organizationId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"organization\", groupId: null, request },\n isPrincipalPolicyMutationResponse,\n options,\n );\n return {\n commitOrganizationGroupPolicyResult: commit,\n commitOrganizationGroupPolicy: async (...args) =>\n nullable(await commit(...args)),\n createOrganizationGroupResult: create,\n createOrganizationGroup: async (...args) => nullable(await create(...args)),\n deleteOrganizationGroupResult: remove,\n deleteOrganizationGroup: async (...args) => nullable(await remove(...args)),\n putPrincipalPolicyResult: put,\n putPrincipalPolicy: async (...args) => nullable(await put(...args)),\n };\n}\n\nfunction nullable<T>(result: RequestResult<T>): T \| null {\n return result.ok ? result.data : null;\n}\n"]}
1	+ {"version":3,"file":"principalMutationDispatch.js","sourceRoot":"","sources":["principalMutationDispatch.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAEL,gCAAgC,GACjC,MAAM,kFAAkF,CAAC;AAiB1F,mFAAmF;AACnF,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,cAAsB,EACtB,QAAmC,EACnC,UAAgC,EAAE;IAElC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,wBAAwB,CACjC,cAAc,EACd,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,mCAAmC,CAC5C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ;YACE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAgB;IAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,OAEoD,EACpD,QAA8D;IAE9D,KAAK,UAAU,MAAM,CACnB,cAAsB,EACtB,QAAmC,EACnC,SAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,GAAG,OAAO,CAAC,cAAc,CAAC;YAC1B,QAAQ;YACR,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CACpC,iCAAiC,CAC/B,GAAG,EACH,cAAc,EACd,KAAK,EACL,eAAe,CAChB,CACF;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAqD,CAC/D,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EACtC,uCAAuC,EACvC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAC3D,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,GAAG,GAA0C,CACjD,KAAK,EACL,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAChD,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,OAAO;QACL,mCAAmC,EAAE,MAAM;QAC3C,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACjC,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,wBAAwB,EAAE,GAAG;QAC7B,kBAAkB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAI,MAAwB;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC","sourcesContent":["import type {\n ApiClient,\n RequestResult,\n RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport {\n isCommitOrganizationGroupPolicyResponse,\n isCreateOrganizationGroupResponse,\n isDeleteOrganizationGroupResponse,\n isPrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport {\n type PrincipalMutationJournalContext,\n submitJournaledPrincipalMutation,\n} from \"../../workflows/organizations/principalMutations/principalMutationJournalSession\";\nimport type { PrincipalMutationResponse } from \"../../workflows/organizations/principalMutations/principalOperationReceipt\";\n\nimport type { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\n\nexport type JournaledPrincipalMutationMethods = Pick<\n ApiClient,\n \| \"commitOrganizationGroupPolicy\"\n \| \"commitOrganizationGroupPolicyResult\"\n \| \"createOrganizationGroup\"\n \| \"createOrganizationGroupResult\"\n \| \"deleteOrganizationGroup\"\n \| \"deleteOrganizationGroupResult\"\n \| \"putPrincipalPolicy\"\n \| \"putPrincipalPolicyResult\"\n>;\n\n/** Dispatch the authenticated operation, with no application planning callback. */\nexport function dispatchAuthoredPrincipalMutation(\n api: ApiClient,\n organizationId: string,\n mutation: AuthoredPrincipalMutation,\n options: RequestResultOptions = {},\n): Promise<RequestResult<PrincipalMutationResponse>> {\n switch (mutation.kind) {\n case \"organization\":\n return api.putPrincipalPolicyResult(\n \"organization\",\n organizationId,\n mutation.request,\n options,\n );\n case \"group-create\":\n return api.createOrganizationGroupResult(\n organizationId,\n mutation.request,\n options,\n );\n case \"group-delete\":\n return api.deleteOrganizationGroupResult(\n organizationId,\n mutation.groupId,\n mutation.request,\n options,\n );\n case \"compound\":\n return api.commitOrganizationGroupPolicyResult(\n organizationId,\n mutation.groupId,\n mutation.request,\n options,\n );\n default:\n return unsupportedMutation(mutation);\n }\n}\n\nfunction unsupportedMutation(_mutation: never): never {\n throw new Error(\"Unsupported principal mutation operation\");\n}\n\nexport function createJournaledPrincipalMutations(\n api: ApiClient,\n context: (\n organizationId: string,\n ) => Omit<PrincipalMutationJournalContext, \"submit\">,\n dispatch: ReturnType<typeof createPrincipalMutationDispatcher>,\n): JournaledPrincipalMutationMethods {\n async function submit<T extends PrincipalMutationResponse>(\n organizationId: string,\n mutation: AuthoredPrincipalMutation,\n validator: (value: unknown) => value is T,\n options: RequestResultOptions = {},\n ): Promise<RequestResult<T>> {\n const result = await submitJournaledPrincipalMutation({\n ...context(organizationId),\n mutation,\n submit: (saved) =>\n dispatch(options, (dispatchOptions) =>\n dispatchAuthoredPrincipalMutation(\n api,\n organizationId,\n saved,\n dispatchOptions,\n ),\n ),\n });\n if (!result.ok) return result;\n // The session already verified this operation before clearing its row.\n // This check narrows the union for each existing public API signature.\n if (!validator(result.data))\n throw new Error(\"Unexpected principal receipt operation\");\n return { ok: true, data: result.data };\n }\n const commit: ApiClient[\"commitOrganizationGroupPolicyResult\"] = (\n organizationId,\n groupId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"compound\", groupId, request },\n isCommitOrganizationGroupPolicyResponse,\n options,\n );\n const create: ApiClient[\"createOrganizationGroupResult\"] = (\n organizationId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"group-create\", groupId: request.groupId, request },\n isCreateOrganizationGroupResponse,\n options,\n );\n const remove: ApiClient[\"deleteOrganizationGroupResult\"] = (\n organizationId,\n groupId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"group-delete\", groupId, request },\n isDeleteOrganizationGroupResponse,\n options,\n );\n const put: ApiClient[\"putPrincipalPolicyResult\"] = (\n _type,\n organizationId,\n request,\n options,\n ) =>\n submit(\n organizationId,\n { kind: \"organization\", groupId: null, request },\n isPrincipalPolicyMutationResponse,\n options,\n );\n return {\n commitOrganizationGroupPolicyResult: commit,\n commitOrganizationGroupPolicy: async (...args) =>\n nullable(await commit(...args)),\n createOrganizationGroupResult: create,\n createOrganizationGroup: async (...args) => nullable(await create(...args)),\n deleteOrganizationGroupResult: remove,\n deleteOrganizationGroup: async (...args) => nullable(await remove(...args)),\n putPrincipalPolicyResult: put,\n putPrincipalPolicy: async (...args) => nullable(await put(...args)),\n };\n}\n\nfunction nullable<T>(result: RequestResult<T>): T \| null {\n return result.ok ? result.data : null;\n}\n"]}

package/client/session/index.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { removeNativeSubscriptionRestoreProvisioningAttempt } from "../../workflows/organizations/createOrganization.js";
+import { removeNativeSubscriptionRestoreProvisioningAttempt } from "../../workflows/organizations/provisioning/createOrganization.js";
 import { bootstrapRootContainer, registerIdentity as registerIdentityWorkflow, } from "../../workflows/registration/index.js";
 import { createListenerSet } from "../runtime/listenerSet.js";
 import { emptySessionSnapshot, mergeSessionContext, sessionSnapshotsEqual, } from "./sessionContext.js";

package/client/session/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kDAAkD,EAAE,MAAM,kDAAkD,CAAC;AACtH,OAAO,EACL,sBAAsB,EACtB,gBAAgB,IAAI,wBAAwB,GAC7C,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAgBhC,MAAM,UAAU,aAAa,CAAC,YAAiC;IAC7D,OAAO,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,cAAc;IAOW;IANZ,uBAAuB,GACtC,IAAI,8BAA8B,EAAE,CAAC;IACtB,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,gBAAgB,GAAG,IAAI,CAAC;IACxB,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE/C,YAA6B,YAAiC;QAAjC,iBAAY,GAAZ,YAAY,CAAqB;IAAG,CAAC;IAElE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAClD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,IAAI,CAAC,aAAa,CAAC,MAAM,EACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,2BAA2B;QAI/B,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,EACJ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,IAAI,IAAI,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,6BAA6B,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,wBAAwB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACvE,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAiC;QAC3C,MAAM,cAAc,GAClB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GACf,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,IAAI,CAAC;QAEzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,oBAAoB,GAAG,4BAA4B,CACvD,IAAI,CAAC,YAAY,CAAC,uBAAuB,EACzC,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,YAAY,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,mBAAmB,CACxE,CAAC;QACF,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,CACnD,WAAW,EACX,cAAc,CAAC,iBAAiB,EAChC,YAAY,CACb;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CACtC,WAAW,EACX,cAAc,CAAC,iBAAiB,CACjC,CAAC;QAEN,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,uBAAuB,CAAC,aAAa,CACxC,cAAc,CAAC,MAAM,EACrB,WAAW,CACZ,CAAC;YACF,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE;gBAChD,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,WAAW;gBAClC,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;aACjD,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,SAAS,EAAE,cAAc,CAAC,KAAK;gBAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;gBACpD,eAAe,EAAE,IAAI;gBACrB,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,aAAa,KAAK,eAAe;oBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACtD,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAiC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,mDAAmD,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,wDAAwD,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;YACpC,gBAAgB;YAChB,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;SACnE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,YAAY,EACjB,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,QAA8D,CAAC;QACnE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAChC,WAAW;gBACX,QAAQ;gBACR,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,kBAAkB;gBACxD,oBAAoB;gBACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAC1B,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,uBAAuB,EAAE,OAAO,EAAE,uBAAuB;gBACzD,oBAAoB;gBACpB,qBAAqB,EACnB,IAAI,CAAC,YAAY,CAAC,gCAAgC;gBACpD,2BAA2B,EACzB,IAAI,CAAC,YAAY,CAAC,2BAA2B;gBAC/C,qBAAqB,EAAE,OAAO,EAAE,qBAAqB;gBACrD,qBAAqB,EAAE,gBAAgB,CAAC,kBAAkB;gBAC1D,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,WAAW,EAAE,QAAQ,CAAC,eAAe;gBACrC,qBAAqB,EAAE,QAAQ,CAAC,cAAc;gBAC9C,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAmC,EACnC,sBAA+B,EAC/B,yBAAmC;QAEnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE;YAClE,yBAAyB;YACzB,OAAO;YACP,sBAAsB;YACtB,MAAM;SACP,CAAC,CAAC;QACH,IACE,CAAC,QAAQ;YACT,CAAC,MAAM;YACP,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAExD,OAAO,IAAI,CAAC;QACd,MAAM,+BAA+B,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,QAAQ,CAAC,WAAW;aACtC;YACD,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4CAA4C,CAC1C,OAAmC;QAEnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6CAA6C,CACjD,cAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,kDAAkD,CAAC;YACxD,SAAS,EAAE,GAAG,EAAE,CACd,IAAI,CAAC,MAAM,KAAK,MAAM;gBACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAC1D,QAAQ;YACR,cAAc;YACd,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,cAAsB,EACtB,OAAmC;QAEnC,OAAO,gCAAgC,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,EACJ,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,SAAwB;QACnC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,WAA0B;QACvC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,OAAuB;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAChD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CACnC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,IACE,IAAI,CAAC,aAAa,KAAK,QAAQ;YAC/B,eAAe,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,cAA6B;QAC7C,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,MAAqB;QAC7B,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,IAAI,CAAC,aAAa,EAClB,EAAE,MAAM,EAAE,EACV,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACtD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,WAAW,CAAC,IAAqB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import { removeNativeSubscriptionRestoreProvisioningAttempt } from \"../../workflows/organizations/createOrganization\";\nimport {\n bootstrapRootContainer,\n registerIdentity as registerIdentityWorkflow,\n} from \"../../workflows/registration\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport { createListenerSet } from \"../runtime/listenerSet\";\nimport {\n emptySessionSnapshot,\n mergeSessionContext,\n sessionSnapshotsEqual,\n} from \"./sessionContext\";\nimport {\n registrationKeyAlreadyBound,\n requireRegistrationIdentityPinner,\n requireUserIdentityAvailable,\n SessionIdentityAcknowledgments,\n} from \"./sessionIdentityTrust\";\nimport { userSessionsFromResponse } from \"./sessionListing\";\nimport { refuseSessionLogin } from \"./sessionLoginRefusal\";\nimport { createSessionOrganization } from \"./sessionOrganizationCreation\";\nimport {\n clearSessionRemoteSyncState,\n recoverPurgedSessionOrganization,\n} from \"./sessionPurgeRecovery\";\nimport {\n acknowledgedSessionRoot,\n commitSessionRootAcknowledgment,\n} from \"./sessionRootAuthority\";\nimport type {\n CreateOrganizationOptions,\n RegisterIdentityOptions,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionDependencies,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n UserSession,\n} from \"./sessionTypes\";\n\nexport function createSession(dependencies: SessionDependencies): Session {\n return new SessionService(dependencies);\n}\n\nclass SessionService implements Session {\n private readonly identityAcknowledgments =\n new SessionIdentityAcknowledgments();\n private readonly listeners = createListenerSet();\n private syncEnabledValue = true;\n private snapshotValue = emptySessionSnapshot();\n\n constructor(private readonly dependencies: SessionDependencies) {}\n\n get authToken(): string \| null {\n return this.snapshotValue.authToken;\n }\n\n get containerId(): string \| null {\n return this.snapshotValue.containerId;\n }\n\n get defaultOrganizationId(): string \| null {\n return this.snapshotValue.defaultOrganizationId;\n }\n\n get isAuthenticated(): boolean {\n return this.snapshotValue.isAuthenticated;\n }\n\n get isRoot(): boolean {\n return this.snapshotValue.isRoot;\n }\n\n get organizationId(): string \| null {\n return this.snapshotValue.organizationId;\n }\n\n get snapshot(): SessionSnapshot {\n return this.snapshotValue;\n }\n\n get syncEnabled(): boolean {\n return this.syncEnabledValue;\n }\n\n get userId(): string \| null {\n return this.snapshotValue.userId;\n }\n\n get userIdAcknowledged(): boolean {\n return this.identityAcknowledgments.isAcknowledged(\n this.snapshotValue.userId,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n }\n\n async bootstrapLocalRootContainer(): Promise<{\n containerId: string;\n created: boolean;\n }> {\n // Recovery can request local bootstrap after login. Preserve the root\n // acknowledged by that session instead of replacing it with a local id.\n const acknowledgedRoot = acknowledgedSessionRoot(\n this,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n if (this.isAuthenticated && acknowledgedRoot) {\n return { containerId: acknowledgedRoot, created: false };\n }\n const result = await bootstrapRootContainer(\n this.dependencies.database.requireExecSql(\"bootstrapLocalRootContainer\"),\n );\n this.setContainerId(result.containerId);\n if (result.created) {\n this.dependencies.log(\"Root container created\");\n }\n return result;\n }\n\n async listSessions(): Promise<UserSession[]> {\n return userSessionsFromResponse(await this.dependencies.api.listSessions());\n }\n\n async clearRemoteSyncState(\n organizationId: string,\n ): Promise<ClearRemoteSyncStateResult> {\n return clearSessionRemoteSyncState(this.dependencies, this, organizationId);\n }\n\n async destroySession(sessionId: string): Promise<boolean> {\n const response = await this.dependencies.api.destroySession(sessionId);\n return response?.message === \"ok\";\n }\n\n async login(challengeHex?: string \| undefined): Promise<boolean> {\n const signingKeyPair =\n this.dependencies.identity.requireSigningKeyPair(\"login\");\n const fingerprint =\n (await this.dependencies.identity.refreshSigningFingerprint()) ?? null;\n\n if (!fingerprint) {\n return false;\n }\n // A refusal below clears the session it is evidence against; a session\n // another login committed meanwhile is not that session and stays.\n const snapshotAtStart = this.snapshotValue;\n const identitySnapshot = this.dependencies.identity.snapshot;\n const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n if (!encapsulationKeyPair) {\n return false;\n }\n if (identitySnapshot.signingKeyPair !== signingKeyPair) {\n return false;\n }\n const pinLocalUserIdentity = requireUserIdentityAvailable(\n this.dependencies.onUserIdentityAvailable,\n \"Login\",\n );\n\n this.dependencies.log(\n challengeHex ? \"Authenticating with challenge...\" : \"Authenticating...\",\n );\n const authentication = challengeHex\n ? await this.dependencies.api.authenticateWithChallenge(\n fingerprint,\n signingKeyPair.signingPrivateKey,\n challengeHex,\n )\n : await this.dependencies.api.authenticate(\n fingerprint,\n signingKeyPair.signingPrivateKey,\n );\n\n if (this.dependencies.identity.snapshot !== identitySnapshot) {\n return false;\n }\n\n if (!authentication) {\n this.logout();\n this.dependencies.log(\"Authentication failed\");\n return false;\n }\n\n try {\n this.identityAcknowledgments.assertMatches(\n authentication.userId,\n fingerprint,\n );\n await pinLocalUserIdentity(authentication.userId, {\n encapsulationPublicKey: encapsulationKeyPair.publicKey,\n signingKeyFingerprint: fingerprint,\n signingPublicKey: signingKeyPair.signingPublicKey,\n });\n if (this.dependencies.identity.snapshot !== identitySnapshot)\n return false;\n this.identityAcknowledgments.remember(authentication.userId, fingerprint);\n } catch (error) {\n return refuseSessionLogin(error, authentication.userId, {\n clear: () => this.logout(),\n report: this.dependencies.reportSecurityIncident,\n });\n }\n // A changed root for this identity+org is refused before the token is\n // usable. Decision and commit are one synchronous step against the live\n // snapshot (no await in between); the refusal clears the prior session in\n // that same step and then reports its own incident.\n await commitSessionRootAcknowledgment({\n context: {\n authToken: authentication.token,\n defaultOrganizationId: authentication.organizationId,\n isAuthenticated: true,\n isRoot: authentication.isRoot,\n organizationId: authentication.organizationId,\n userId: authentication.userId,\n },\n onRefused: () => {\n if (this.snapshotValue === snapshotAtStart) this.logout();\n },\n reporter: this.dependencies.reportSecurityIncident,\n root: authentication,\n session: this,\n signingFingerprint: fingerprint,\n });\n this.dependencies.log(\"Authentication successful\");\n return true;\n }\n\n logout(): void {\n this.setContext({ authToken: null, isAuthenticated: false, isRoot: false });\n }\n\n async logoutRemote(): Promise<boolean> {\n const identitySnapshot = this.dependencies.identity.snapshot;\n try {\n if (!this.authToken) {\n return true;\n }\n\n const response = await this.dependencies.api.logout();\n return response?.message === \"ok\";\n } finally {\n if (this.dependencies.identity.snapshot === identitySnapshot) {\n this.logout();\n }\n }\n }\n\n async registerIdentity(\n options?: RegisterIdentityOptions,\n ): Promise<SessionRegistrationResult \| SessionRegistrationRefusal \| null> {\n const containerId = this.containerId;\n if (!containerId) {\n this.dependencies.log(\n \"Registration skipped: container id is unavailable\",\n );\n return null;\n }\n\n const identitySnapshot = this.dependencies.identity.snapshot;\n const signingKeyPair = identitySnapshot.signingKeyPair;\n if (!signingKeyPair) {\n this.dependencies.log(\"Registration skipped: signing key is unavailable\");\n return null;\n }\n\n const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n if (!encapsulationKeyPair) {\n this.dependencies.log(\n \"Registration skipped: encapsulation key is unavailable\",\n );\n return null;\n }\n\n const dbClient = this.dependencies.database.client;\n if (!dbClient) {\n this.dependencies.log(\n \"Registration skipped: database client is unavailable\",\n );\n return null;\n }\n const pinLocalUserIdentity = requireRegistrationIdentityPinner({\n identity: this.dependencies.identity,\n identitySnapshot,\n onUserIdentityAvailable: this.dependencies.onUserIdentityAvailable,\n });\n const keyBound = await registrationKeyAlreadyBound(\n this.dependencies,\n identitySnapshot.signingFingerprint,\n );\n if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n if (keyBound) return keyBound;\n\n let response: Awaited<ReturnType<typeof registerIdentityWorkflow>>;\n try {\n response = await registerIdentityWorkflow({\n apiClient: this.dependencies.api,\n containerId,\n dbClient,\n documentProjectors: this.dependencies.documentProjectors,\n encapsulationKeyPair,\n isIdentityCurrent: () =>\n this.dependencies.identity.snapshot === identitySnapshot,\n log: this.dependencies.log,\n logError: this.dependencies.logError,\n organizationProfileName: options?.organizationProfileName,\n pinLocalUserIdentity,\n primePrincipalHistory:\n this.dependencies.primeProvisionedPrincipalHistory,\n provisionedSystemContainers:\n this.dependencies.provisionedSystemContainers,\n rosterProfileNickname: options?.rosterProfileNickname,\n signingKeyFingerprint: identitySnapshot.signingFingerprint,\n signingKeyPair,\n });\n } catch (error: unknown) {\n this.dependencies.logError(\"Identity registration failed\", error);\n throw error;\n }\n\n if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n if (!response) {\n this.dependencies.log(\"Registration failed\");\n return null;\n }\n\n // The workflow pinned `response.userId` once the server confirmed it,\n // under the same currency check as above.\n await commitSessionRootAcknowledgment({\n context: {\n containerId: response.rootContainerId,\n defaultOrganizationId: response.organizationId,\n organizationId: response.organizationId,\n userId: response.userId,\n },\n reporter: this.dependencies.reportSecurityIncident,\n root: response,\n session: this,\n signingFingerprint: identitySnapshot.signingFingerprint,\n });\n\n return {\n challenge: response.challenge,\n containerId: response.rootContainerId,\n organizationId: response.organizationId,\n userId: response.userId,\n };\n }\n\n async createOrganization(\n options?: CreateOrganizationOptions,\n replacesOrganizationId?: string,\n nativeSubscriptionRestore?: boolean,\n ): Promise<SessionCreateOrganizationResult \| null> {\n const identitySnapshot = this.dependencies.identity.snapshot;\n const userId = this.userId;\n const response = await createSessionOrganization(this.dependencies, {\n nativeSubscriptionRestore,\n options,\n replacesOrganizationId,\n userId,\n });\n if (\n !response \|\|\n !userId \|\|\n this.userId !== userId \|\|\n this.dependencies.identity.snapshot !== identitySnapshot\n )\n return null;\n await commitSessionRootAcknowledgment({\n reporter: this.dependencies.reportSecurityIncident,\n root: {\n userId,\n organizationId: response.organizationId,\n rootContainerId: response.containerId,\n },\n session: this,\n signingFingerprint: identitySnapshot.signingFingerprint,\n });\n return response;\n }\n\n prepareNativeSubscriptionRestoreOrganization(\n options?: CreateOrganizationOptions,\n ): Promise<SessionCreateOrganizationResult \| null> {\n return this.createOrganization(options, undefined, true);\n }\n\n async completeNativeSubscriptionRestoreOrganization(\n organizationId: string,\n ): Promise<boolean> {\n const userId = this.userId;\n const dbClient = this.dependencies.database.client;\n const identitySnapshot = this.dependencies.identity.snapshot;\n if (!userId \|\| !dbClient) return false;\n return removeNativeSubscriptionRestoreProvisioningAttempt({\n canCommit: () =>\n this.userId === userId &&\n this.dependencies.identity.snapshot === identitySnapshot,\n dbClient,\n organizationId,\n userId,\n });\n }\n\n async recoverPurgedOrganization(\n organizationId: string,\n options?: CreateOrganizationOptions,\n ): Promise<SessionRecoverOrganizationResult \| null> {\n return recoverPurgedSessionOrganization(\n this.dependencies,\n this,\n organizationId,\n options,\n );\n }\n\n setAuthToken(authToken: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, authToken });\n }\n\n setContainerId(containerId: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, containerId });\n }\n\n setContext(context: SessionContext): void {\n const wasAcknowledged = this.userIdAcknowledged;\n this.identityAcknowledgments.remember(\n context.userId,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n const previous = this.snapshotValue;\n this.setSnapshot(\n mergeSessionContext(\n previous,\n context,\n this.dependencies.identity.snapshot.signingFingerprint,\n ),\n );\n // Acknowledging an already-held userId changes `userIdAcknowledged` without\n // changing the snapshot; persistence subscribers must still observe it.\n if (\n this.snapshotValue === previous &&\n wasAcknowledged !== this.userIdAcknowledged\n ) {\n this.listeners.notify();\n }\n }\n\n setOrganizationId(organizationId: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, organizationId });\n }\n\n setSyncEnabled(enabled: boolean): void {\n if (this.syncEnabledValue === enabled) {\n return;\n }\n this.syncEnabledValue = enabled;\n this.listeners.notify();\n }\n\n setUserId(userId: string \| null): void {\n this.setSnapshot(\n mergeSessionContext(\n this.snapshotValue,\n { userId },\n this.dependencies.identity.snapshot.signingFingerprint,\n ),\n );\n }\n\n subscribe = (listener: SessionListener): (() => void) =>\n this.listeners.subscribe(listener);\n\n private setSnapshot(next: SessionSnapshot): void {\n const previous = this.snapshotValue;\n if (previous.authToken !== next.authToken) {\n this.dependencies.api.setAuthToken(next.authToken);\n }\n\n if (sessionSnapshotsEqual(previous, next)) {\n return;\n }\n\n this.snapshotValue = next;\n this.listeners.notify();\n }\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kDAAkD,EAAE,MAAM,+DAA+D,CAAC;AACnI,OAAO,EACL,sBAAsB,EACtB,gBAAgB,IAAI,wBAAwB,GAC7C,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAgBhC,MAAM,UAAU,aAAa,CAAC,YAAiC;IAC7D,OAAO,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,cAAc;IAOW;IANZ,uBAAuB,GACtC,IAAI,8BAA8B,EAAE,CAAC;IACtB,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,gBAAgB,GAAG,IAAI,CAAC;IACxB,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE/C,YAA6B,YAAiC;QAAjC,iBAAY,GAAZ,YAAY,CAAqB;IAAG,CAAC;IAElE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAClD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,IAAI,CAAC,aAAa,CAAC,MAAM,EACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,2BAA2B;QAI/B,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,EACJ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,IAAI,IAAI,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,6BAA6B,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,wBAAwB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACvE,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAiC;QAC3C,MAAM,cAAc,GAClB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GACf,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,IAAI,CAAC;QAEzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,oBAAoB,GAAG,4BAA4B,CACvD,IAAI,CAAC,YAAY,CAAC,uBAAuB,EACzC,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,YAAY,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,mBAAmB,CACxE,CAAC;QACF,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,CACnD,WAAW,EACX,cAAc,CAAC,iBAAiB,EAChC,YAAY,CACb;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CACtC,WAAW,EACX,cAAc,CAAC,iBAAiB,CACjC,CAAC;QAEN,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,uBAAuB,CAAC,aAAa,CACxC,cAAc,CAAC,MAAM,EACrB,WAAW,CACZ,CAAC;YACF,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE;gBAChD,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,WAAW;gBAClC,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;aACjD,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,SAAS,EAAE,cAAc,CAAC,KAAK;gBAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;gBACpD,eAAe,EAAE,IAAI;gBACrB,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,aAAa,KAAK,eAAe;oBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACtD,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAiC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,mDAAmD,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,wDAAwD,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;YACpC,gBAAgB;YAChB,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;SACnE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,YAAY,EACjB,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,QAA8D,CAAC;QACnE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAChC,WAAW;gBACX,QAAQ;gBACR,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,kBAAkB;gBACxD,oBAAoB;gBACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAC1B,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,uBAAuB,EAAE,OAAO,EAAE,uBAAuB;gBACzD,oBAAoB;gBACpB,qBAAqB,EACnB,IAAI,CAAC,YAAY,CAAC,gCAAgC;gBACpD,2BAA2B,EACzB,IAAI,CAAC,YAAY,CAAC,2BAA2B;gBAC/C,qBAAqB,EAAE,OAAO,EAAE,qBAAqB;gBACrD,qBAAqB,EAAE,gBAAgB,CAAC,kBAAkB;gBAC1D,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,WAAW,EAAE,QAAQ,CAAC,eAAe;gBACrC,qBAAqB,EAAE,QAAQ,CAAC,cAAc;gBAC9C,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAmC,EACnC,sBAA+B,EAC/B,yBAAmC;QAEnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE;YAClE,yBAAyB;YACzB,OAAO;YACP,sBAAsB;YACtB,MAAM;SACP,CAAC,CAAC;QACH,IACE,CAAC,QAAQ;YACT,CAAC,MAAM;YACP,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAExD,OAAO,IAAI,CAAC;QACd,MAAM,+BAA+B,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,QAAQ,CAAC,WAAW;aACtC;YACD,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4CAA4C,CAC1C,OAAmC;QAEnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6CAA6C,CACjD,cAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,kDAAkD,CAAC;YACxD,SAAS,EAAE,GAAG,EAAE,CACd,IAAI,CAAC,MAAM,KAAK,MAAM;gBACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAC1D,QAAQ;YACR,cAAc;YACd,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,cAAsB,EACtB,OAAmC;QAEnC,OAAO,gCAAgC,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,EACJ,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,SAAwB;QACnC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,WAA0B;QACvC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,OAAuB;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAChD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CACnC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,IACE,IAAI,CAAC,aAAa,KAAK,QAAQ;YAC/B,eAAe,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,cAA6B;QAC7C,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,MAAqB;QAC7B,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,IAAI,CAAC,aAAa,EAClB,EAAE,MAAM,EAAE,EACV,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACtD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,WAAW,CAAC,IAAqB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import { removeNativeSubscriptionRestoreProvisioningAttempt } from \"../../workflows/organizations/provisioning/createOrganization\";\nimport {\n bootstrapRootContainer,\n registerIdentity as registerIdentityWorkflow,\n} from \"../../workflows/registration\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport { createListenerSet } from \"../runtime/listenerSet\";\nimport {\n emptySessionSnapshot,\n mergeSessionContext,\n sessionSnapshotsEqual,\n} from \"./sessionContext\";\nimport {\n registrationKeyAlreadyBound,\n requireRegistrationIdentityPinner,\n requireUserIdentityAvailable,\n SessionIdentityAcknowledgments,\n} from \"./sessionIdentityTrust\";\nimport { userSessionsFromResponse } from \"./sessionListing\";\nimport { refuseSessionLogin } from \"./sessionLoginRefusal\";\nimport { createSessionOrganization } from \"./sessionOrganizationCreation\";\nimport {\n clearSessionRemoteSyncState,\n recoverPurgedSessionOrganization,\n} from \"./sessionPurgeRecovery\";\nimport {\n acknowledgedSessionRoot,\n commitSessionRootAcknowledgment,\n} from \"./sessionRootAuthority\";\nimport type {\n CreateOrganizationOptions,\n RegisterIdentityOptions,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionDependencies,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n UserSession,\n} from \"./sessionTypes\";\n\nexport function createSession(dependencies: SessionDependencies): Session {\n return new SessionService(dependencies);\n}\n\nclass SessionService implements Session {\n private readonly identityAcknowledgments =\n new SessionIdentityAcknowledgments();\n private readonly listeners = createListenerSet();\n private syncEnabledValue = true;\n private snapshotValue = emptySessionSnapshot();\n\n constructor(private readonly dependencies: SessionDependencies) {}\n\n get authToken(): string \| null {\n return this.snapshotValue.authToken;\n }\n\n get containerId(): string \| null {\n return this.snapshotValue.containerId;\n }\n\n get defaultOrganizationId(): string \| null {\n return this.snapshotValue.defaultOrganizationId;\n }\n\n get isAuthenticated(): boolean {\n return this.snapshotValue.isAuthenticated;\n }\n\n get isRoot(): boolean {\n return this.snapshotValue.isRoot;\n }\n\n get organizationId(): string \| null {\n return this.snapshotValue.organizationId;\n }\n\n get snapshot(): SessionSnapshot {\n return this.snapshotValue;\n }\n\n get syncEnabled(): boolean {\n return this.syncEnabledValue;\n }\n\n get userId(): string \| null {\n return this.snapshotValue.userId;\n }\n\n get userIdAcknowledged(): boolean {\n return this.identityAcknowledgments.isAcknowledged(\n this.snapshotValue.userId,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n }\n\n async bootstrapLocalRootContainer(): Promise<{\n containerId: string;\n created: boolean;\n }> {\n // Recovery can request local bootstrap after login. Preserve the root\n // acknowledged by that session instead of replacing it with a local id.\n const acknowledgedRoot = acknowledgedSessionRoot(\n this,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n if (this.isAuthenticated && acknowledgedRoot) {\n return { containerId: acknowledgedRoot, created: false };\n }\n const result = await bootstrapRootContainer(\n this.dependencies.database.requireExecSql(\"bootstrapLocalRootContainer\"),\n );\n this.setContainerId(result.containerId);\n if (result.created) {\n this.dependencies.log(\"Root container created\");\n }\n return result;\n }\n\n async listSessions(): Promise<UserSession[]> {\n return userSessionsFromResponse(await this.dependencies.api.listSessions());\n }\n\n async clearRemoteSyncState(\n organizationId: string,\n ): Promise<ClearRemoteSyncStateResult> {\n return clearSessionRemoteSyncState(this.dependencies, this, organizationId);\n }\n\n async destroySession(sessionId: string): Promise<boolean> {\n const response = await this.dependencies.api.destroySession(sessionId);\n return response?.message === \"ok\";\n }\n\n async login(challengeHex?: string \| undefined): Promise<boolean> {\n const signingKeyPair =\n this.dependencies.identity.requireSigningKeyPair(\"login\");\n const fingerprint =\n (await this.dependencies.identity.refreshSigningFingerprint()) ?? null;\n\n if (!fingerprint) {\n return false;\n }\n // A refusal below clears the session it is evidence against; a session\n // another login committed meanwhile is not that session and stays.\n const snapshotAtStart = this.snapshotValue;\n const identitySnapshot = this.dependencies.identity.snapshot;\n const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n if (!encapsulationKeyPair) {\n return false;\n }\n if (identitySnapshot.signingKeyPair !== signingKeyPair) {\n return false;\n }\n const pinLocalUserIdentity = requireUserIdentityAvailable(\n this.dependencies.onUserIdentityAvailable,\n \"Login\",\n );\n\n this.dependencies.log(\n challengeHex ? \"Authenticating with challenge...\" : \"Authenticating...\",\n );\n const authentication = challengeHex\n ? await this.dependencies.api.authenticateWithChallenge(\n fingerprint,\n signingKeyPair.signingPrivateKey,\n challengeHex,\n )\n : await this.dependencies.api.authenticate(\n fingerprint,\n signingKeyPair.signingPrivateKey,\n );\n\n if (this.dependencies.identity.snapshot !== identitySnapshot) {\n return false;\n }\n\n if (!authentication) {\n this.logout();\n this.dependencies.log(\"Authentication failed\");\n return false;\n }\n\n try {\n this.identityAcknowledgments.assertMatches(\n authentication.userId,\n fingerprint,\n );\n await pinLocalUserIdentity(authentication.userId, {\n encapsulationPublicKey: encapsulationKeyPair.publicKey,\n signingKeyFingerprint: fingerprint,\n signingPublicKey: signingKeyPair.signingPublicKey,\n });\n if (this.dependencies.identity.snapshot !== identitySnapshot)\n return false;\n this.identityAcknowledgments.remember(authentication.userId, fingerprint);\n } catch (error) {\n return refuseSessionLogin(error, authentication.userId, {\n clear: () => this.logout(),\n report: this.dependencies.reportSecurityIncident,\n });\n }\n // A changed root for this identity+org is refused before the token is\n // usable. Decision and commit are one synchronous step against the live\n // snapshot (no await in between); the refusal clears the prior session in\n // that same step and then reports its own incident.\n await commitSessionRootAcknowledgment({\n context: {\n authToken: authentication.token,\n defaultOrganizationId: authentication.organizationId,\n isAuthenticated: true,\n isRoot: authentication.isRoot,\n organizationId: authentication.organizationId,\n userId: authentication.userId,\n },\n onRefused: () => {\n if (this.snapshotValue === snapshotAtStart) this.logout();\n },\n reporter: this.dependencies.reportSecurityIncident,\n root: authentication,\n session: this,\n signingFingerprint: fingerprint,\n });\n this.dependencies.log(\"Authentication successful\");\n return true;\n }\n\n logout(): void {\n this.setContext({ authToken: null, isAuthenticated: false, isRoot: false });\n }\n\n async logoutRemote(): Promise<boolean> {\n const identitySnapshot = this.dependencies.identity.snapshot;\n try {\n if (!this.authToken) {\n return true;\n }\n\n const response = await this.dependencies.api.logout();\n return response?.message === \"ok\";\n } finally {\n if (this.dependencies.identity.snapshot === identitySnapshot) {\n this.logout();\n }\n }\n }\n\n async registerIdentity(\n options?: RegisterIdentityOptions,\n ): Promise<SessionRegistrationResult \| SessionRegistrationRefusal \| null> {\n const containerId = this.containerId;\n if (!containerId) {\n this.dependencies.log(\n \"Registration skipped: container id is unavailable\",\n );\n return null;\n }\n\n const identitySnapshot = this.dependencies.identity.snapshot;\n const signingKeyPair = identitySnapshot.signingKeyPair;\n if (!signingKeyPair) {\n this.dependencies.log(\"Registration skipped: signing key is unavailable\");\n return null;\n }\n\n const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n if (!encapsulationKeyPair) {\n this.dependencies.log(\n \"Registration skipped: encapsulation key is unavailable\",\n );\n return null;\n }\n\n const dbClient = this.dependencies.database.client;\n if (!dbClient) {\n this.dependencies.log(\n \"Registration skipped: database client is unavailable\",\n );\n return null;\n }\n const pinLocalUserIdentity = requireRegistrationIdentityPinner({\n identity: this.dependencies.identity,\n identitySnapshot,\n onUserIdentityAvailable: this.dependencies.onUserIdentityAvailable,\n });\n const keyBound = await registrationKeyAlreadyBound(\n this.dependencies,\n identitySnapshot.signingFingerprint,\n );\n if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n if (keyBound) return keyBound;\n\n let response: Awaited<ReturnType<typeof registerIdentityWorkflow>>;\n try {\n response = await registerIdentityWorkflow({\n apiClient: this.dependencies.api,\n containerId,\n dbClient,\n documentProjectors: this.dependencies.documentProjectors,\n encapsulationKeyPair,\n isIdentityCurrent: () =>\n this.dependencies.identity.snapshot === identitySnapshot,\n log: this.dependencies.log,\n logError: this.dependencies.logError,\n organizationProfileName: options?.organizationProfileName,\n pinLocalUserIdentity,\n primePrincipalHistory:\n this.dependencies.primeProvisionedPrincipalHistory,\n provisionedSystemContainers:\n this.dependencies.provisionedSystemContainers,\n rosterProfileNickname: options?.rosterProfileNickname,\n signingKeyFingerprint: identitySnapshot.signingFingerprint,\n signingKeyPair,\n });\n } catch (error: unknown) {\n this.dependencies.logError(\"Identity registration failed\", error);\n throw error;\n }\n\n if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n if (!response) {\n this.dependencies.log(\"Registration failed\");\n return null;\n }\n\n // The workflow pinned `response.userId` once the server confirmed it,\n // under the same currency check as above.\n await commitSessionRootAcknowledgment({\n context: {\n containerId: response.rootContainerId,\n defaultOrganizationId: response.organizationId,\n organizationId: response.organizationId,\n userId: response.userId,\n },\n reporter: this.dependencies.reportSecurityIncident,\n root: response,\n session: this,\n signingFingerprint: identitySnapshot.signingFingerprint,\n });\n\n return {\n challenge: response.challenge,\n containerId: response.rootContainerId,\n organizationId: response.organizationId,\n userId: response.userId,\n };\n }\n\n async createOrganization(\n options?: CreateOrganizationOptions,\n replacesOrganizationId?: string,\n nativeSubscriptionRestore?: boolean,\n ): Promise<SessionCreateOrganizationResult \| null> {\n const identitySnapshot = this.dependencies.identity.snapshot;\n const userId = this.userId;\n const response = await createSessionOrganization(this.dependencies, {\n nativeSubscriptionRestore,\n options,\n replacesOrganizationId,\n userId,\n });\n if (\n !response \|\|\n !userId \|\|\n this.userId !== userId \|\|\n this.dependencies.identity.snapshot !== identitySnapshot\n )\n return null;\n await commitSessionRootAcknowledgment({\n reporter: this.dependencies.reportSecurityIncident,\n root: {\n userId,\n organizationId: response.organizationId,\n rootContainerId: response.containerId,\n },\n session: this,\n signingFingerprint: identitySnapshot.signingFingerprint,\n });\n return response;\n }\n\n prepareNativeSubscriptionRestoreOrganization(\n options?: CreateOrganizationOptions,\n ): Promise<SessionCreateOrganizationResult \| null> {\n return this.createOrganization(options, undefined, true);\n }\n\n async completeNativeSubscriptionRestoreOrganization(\n organizationId: string,\n ): Promise<boolean> {\n const userId = this.userId;\n const dbClient = this.dependencies.database.client;\n const identitySnapshot = this.dependencies.identity.snapshot;\n if (!userId \|\| !dbClient) return false;\n return removeNativeSubscriptionRestoreProvisioningAttempt({\n canCommit: () =>\n this.userId === userId &&\n this.dependencies.identity.snapshot === identitySnapshot,\n dbClient,\n organizationId,\n userId,\n });\n }\n\n async recoverPurgedOrganization(\n organizationId: string,\n options?: CreateOrganizationOptions,\n ): Promise<SessionRecoverOrganizationResult \| null> {\n return recoverPurgedSessionOrganization(\n this.dependencies,\n this,\n organizationId,\n options,\n );\n }\n\n setAuthToken(authToken: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, authToken });\n }\n\n setContainerId(containerId: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, containerId });\n }\n\n setContext(context: SessionContext): void {\n const wasAcknowledged = this.userIdAcknowledged;\n this.identityAcknowledgments.remember(\n context.userId,\n this.dependencies.identity.snapshot.signingFingerprint,\n );\n const previous = this.snapshotValue;\n this.setSnapshot(\n mergeSessionContext(\n previous,\n context,\n this.dependencies.identity.snapshot.signingFingerprint,\n ),\n );\n // Acknowledging an already-held userId changes `userIdAcknowledged` without\n // changing the snapshot; persistence subscribers must still observe it.\n if (\n this.snapshotValue === previous &&\n wasAcknowledged !== this.userIdAcknowledged\n ) {\n this.listeners.notify();\n }\n }\n\n setOrganizationId(organizationId: string \| null): void {\n this.setSnapshot({ ...this.snapshotValue, organizationId });\n }\n\n setSyncEnabled(enabled: boolean): void {\n if (this.syncEnabledValue === enabled) {\n return;\n }\n this.syncEnabledValue = enabled;\n this.listeners.notify();\n }\n\n setUserId(userId: string \| null): void {\n this.setSnapshot(\n mergeSessionContext(\n this.snapshotValue,\n { userId },\n this.dependencies.identity.snapshot.signingFingerprint,\n ),\n );\n }\n\n subscribe = (listener: SessionListener): (() => void) =>\n this.listeners.subscribe(listener);\n\n private setSnapshot(next: SessionSnapshot): void {\n const previous = this.snapshotValue;\n if (previous.authToken !== next.authToken) {\n this.dependencies.api.setAuthToken(next.authToken);\n }\n\n if (sessionSnapshotsEqual(previous, next)) {\n return;\n }\n\n this.snapshotValue = next;\n this.listeners.notify();\n }\n}\n"]}

package/client/session/sessionOrganizationCreation.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { createOrganization as createOrganizationWorkflow } from "../../workflows/organizations/createOrganization.js";
+import { createOrganization as createOrganizationWorkflow } from "../../workflows/organizations/provisioning/createOrganization.js";
 export async function createSessionOrganization(dependencies, input) {
     if (!input.userId) {
         dependencies.log("Create organization skipped: user id is unavailable");

package/client/session/sessionOrganizationCreation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sessionOrganizationCreation.js","sourceRoot":"","sources":["sessionOrganizationCreation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,IAAI,0BAA0B,EAAE,MAAM,~~kDAAkD,~~CAAC;~~AAyBpH~~,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAqD,EACrD,KAKC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxD,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,YAAY,CAAC,GAAG,CACd,4DAA4D,CAC7D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,YAAY,CAAC,GAAG,CACd,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAgE,CAAC;IACrE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC;YAC1C,SAAS,EAAE,YAAY,CAAC,GAAG;YAC3B,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,oBAAoB;YACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YACrD,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,uBAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB;YAC/D,qBAAqB,EAAE,YAAY,CAAC,gCAAgC;YACpE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,qBAAqB;YAC3D,cAAc;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oEAAoE;IACpE,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,eAAe;QACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { createOrganization as createOrganizationWorkflow } from \"../../workflows/organizations/createOrganization\";\nimport type { ProvisionedSystemContainerSpec } from \"../../workflows/registration\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport type {\n CreateOrganizationOptions,\n SessionCreateOrganizationResult,\n} from \"./sessionTypes\";\n\ninterface SessionOrganizationCreationDependencies {\n readonly api: ApiClient;\n readonly database: Database;\n readonly documentProjectors?: DocumentProjectorRegistryInput \| undefined;\n readonly identity: Identity;\n readonly log: (message: string) => void;\n readonly logError: (message: string \| Error, cause?: unknown) => void;\n readonly primeProvisionedPrincipalHistory?:\n \| ProvisionedPrincipalHistoryPrimer\n \| undefined;\n readonly provisionedSystemContainers?:\n \| ReadonlyArray<ProvisionedSystemContainerSpec>\n \| undefined;\n}\n\nexport async function createSessionOrganization(\n dependencies: SessionOrganizationCreationDependencies,\n input: {\n readonly nativeSubscriptionRestore?: boolean \| undefined;\n readonly options?: CreateOrganizationOptions \| undefined;\n readonly replacesOrganizationId?: string \| undefined;\n readonly userId: string \| null;\n },\n): Promise<SessionCreateOrganizationResult \| null> {\n if (!input.userId) {\n dependencies.log(\"Create organization skipped: user id is unavailable\");\n return null;\n }\n\n const identitySnapshot = dependencies.identity.snapshot;\n const { encapsulationKeyPair, signingKeyPair } = identitySnapshot;\n if (!signingKeyPair \|\| !encapsulationKeyPair) {\n dependencies.log(\n \"Create organization skipped: identity keys are unavailable\",\n );\n return null;\n }\n\n const dbClient = dependencies.database.client;\n if (!dbClient) {\n dependencies.log(\n \"Create organization skipped: database client is unavailable\",\n );\n return null;\n }\n\n let response: Awaited<ReturnType<typeof createOrganizationWorkflow>>;\n try {\n response = await createOrganizationWorkflow({\n apiClient: dependencies.api,\n dbClient,\n documentProjectors: dependencies.documentProjectors,\n encapsulationKeyPair,\n isIdentityCurrent: () =>\n dependencies.identity.snapshot === identitySnapshot,\n log: dependencies.log,\n logError: dependencies.logError,\n nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n organizationProfileName: input.options?.organizationProfileName,\n primePrincipalHistory: dependencies.primeProvisionedPrincipalHistory,\n provisionedSystemContainers: dependencies.provisionedSystemContainers,\n replacesOrganizationId: input.replacesOrganizationId,\n rosterProfileNickname: input.options?.rosterProfileNickname,\n signingKeyPair,\n userId: input.userId,\n });\n } catch (error: unknown) {\n dependencies.logError(\"Organization creation failed\", error);\n throw error;\n }\n\n if (dependencies.identity.snapshot !== identitySnapshot) return null;\n if (!response) {\n dependencies.log(\"Organization creation failed\");\n return null;\n }\n // Creating an organization does not switch the active organization.\n return {\n containerId: response.rootContainerId,\n organizationId: response.organizationId,\n };\n}\n"]}
1	+ {"version":3,"file":"sessionOrganizationCreation.js","sourceRoot":"","sources":["sessionOrganizationCreation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,IAAI,0BAA0B,EAAE,MAAM,+DAA+D,CAAC;AAyBjI,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAqD,EACrD,KAKC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxD,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,YAAY,CAAC,GAAG,CACd,4DAA4D,CAC7D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,YAAY,CAAC,GAAG,CACd,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAgE,CAAC;IACrE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC;YAC1C,SAAS,EAAE,YAAY,CAAC,GAAG;YAC3B,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,oBAAoB;YACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YACrD,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,uBAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB;YAC/D,qBAAqB,EAAE,YAAY,CAAC,gCAAgC;YACpE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,qBAAqB;YAC3D,cAAc;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oEAAoE;IACpE,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,eAAe;QACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { createOrganization as createOrganizationWorkflow } from \"../../workflows/organizations/provisioning/createOrganization\";\nimport type { ProvisionedSystemContainerSpec } from \"../../workflows/registration\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport type {\n CreateOrganizationOptions,\n SessionCreateOrganizationResult,\n} from \"./sessionTypes\";\n\ninterface SessionOrganizationCreationDependencies {\n readonly api: ApiClient;\n readonly database: Database;\n readonly documentProjectors?: DocumentProjectorRegistryInput \| undefined;\n readonly identity: Identity;\n readonly log: (message: string) => void;\n readonly logError: (message: string \| Error, cause?: unknown) => void;\n readonly primeProvisionedPrincipalHistory?:\n \| ProvisionedPrincipalHistoryPrimer\n \| undefined;\n readonly provisionedSystemContainers?:\n \| ReadonlyArray<ProvisionedSystemContainerSpec>\n \| undefined;\n}\n\nexport async function createSessionOrganization(\n dependencies: SessionOrganizationCreationDependencies,\n input: {\n readonly nativeSubscriptionRestore?: boolean \| undefined;\n readonly options?: CreateOrganizationOptions \| undefined;\n readonly replacesOrganizationId?: string \| undefined;\n readonly userId: string \| null;\n },\n): Promise<SessionCreateOrganizationResult \| null> {\n if (!input.userId) {\n dependencies.log(\"Create organization skipped: user id is unavailable\");\n return null;\n }\n\n const identitySnapshot = dependencies.identity.snapshot;\n const { encapsulationKeyPair, signingKeyPair } = identitySnapshot;\n if (!signingKeyPair \|\| !encapsulationKeyPair) {\n dependencies.log(\n \"Create organization skipped: identity keys are unavailable\",\n );\n return null;\n }\n\n const dbClient = dependencies.database.client;\n if (!dbClient) {\n dependencies.log(\n \"Create organization skipped: database client is unavailable\",\n );\n return null;\n }\n\n let response: Awaited<ReturnType<typeof createOrganizationWorkflow>>;\n try {\n response = await createOrganizationWorkflow({\n apiClient: dependencies.api,\n dbClient,\n documentProjectors: dependencies.documentProjectors,\n encapsulationKeyPair,\n isIdentityCurrent: () =>\n dependencies.identity.snapshot === identitySnapshot,\n log: dependencies.log,\n logError: dependencies.logError,\n nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n organizationProfileName: input.options?.organizationProfileName,\n primePrincipalHistory: dependencies.primeProvisionedPrincipalHistory,\n provisionedSystemContainers: dependencies.provisionedSystemContainers,\n replacesOrganizationId: input.replacesOrganizationId,\n rosterProfileNickname: input.options?.rosterProfileNickname,\n signingKeyPair,\n userId: input.userId,\n });\n } catch (error: unknown) {\n dependencies.logError(\"Organization creation failed\", error);\n throw error;\n }\n\n if (dependencies.identity.snapshot !== identitySnapshot) return null;\n if (!response) {\n dependencies.log(\"Organization creation failed\");\n return null;\n }\n // Creating an organization does not switch the active organization.\n return {\n containerId: response.rootContainerId,\n organizationId: response.organizationId,\n };\n}\n"]}

package/client/session/sessionPurgeRecovery.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { resolveOrganizationBillingView } from "../../workflows/organizations/billing.js";
-import { loadOrganizationReplacementFinalizationRequest, removeOrganizationProvisioningAttempt, } from "../../workflows/organizations/organizationProvisioningAttempt.js";
-import { verifyOrganizationReplacementResponse } from "../../workflows/organizations/organizationReplacementVerification.js";
+import { loadOrganizationReplacementFinalizationRequest, removeOrganizationProvisioningAttempt, } from "../../workflows/organizations/provisioning/organizationProvisioningAttempt.js";
+import { verifyOrganizationReplacementResponse } from "../../workflows/organizations/provisioning/organizationReplacementVerification.js";
 import { clearRemoteSyncState } from "../../workflows/sync/index.js";
 import { PurgedOrganizationRecoveryBillingRequiredError } from "./sessionRecoveryErrors.js";
 function requireReplacementCanSync(replacement, billing) {

package/client/session/sessionPurgeRecovery.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sessionPurgeRecovery.js","sourceRoot":"","sources":["sessionPurgeRecovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EACL,8CAA8C,EAC9C,qCAAqC,GACtC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mEAAmE,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,8CAA8C,EAAE,MAAM,yBAAyB,CAAC;AAyBzF,SAAS,yBAAyB,CAChC,WAA4C,EAC5C,OAAiE;IAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,8CAA8C,CACtD,WAAW,CAAC,cAAc,EAC1B,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,WAAW,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAA8C,EAC9C,OAAoC,EACpC,cAAsB;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE;QACjD,cAAc;KACf,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,oBAA0E,EAC1E,WAA4C,EAC5C,sBAA8B,EAC9B,MAAc,EACd,cAAsD;IAEtD,IACE,CAAC,oBAAoB;QACrB,oBAAoB,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;QAClE,oBAAoB,CAAC,eAAe,KAAK,WAAW,CAAC,WAAW;QAChE,oBAAoB,CAAC,MAAM,KAAK,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,qCAAqC,CAAC;QACpC,sBAAsB;QACtB,QAAQ,EAAE,oBAAoB;QAC9B,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,YAOC,EACD,OAAoC,EACpC,cAAsB,EACtB,OAA8C;IAE9C,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxD,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAC7B,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;QACnD,OAAO,CAAC,cAAc,KAAK,qBAAqB;QAChD,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,gBAAgB,cAAc,gDAAgD,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,kBAAkB,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,sBAAsB,CACtE,WAAW,CAAC,cAAc,CAC3B,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAClD,2BAA2B,CAC5B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,OAAO,EACP;QACE,cAAc;QACd,WAAW,EAAE;YACX,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,eAAe,EAAE,WAAW,CAAC,WAAW;SACzC;KACF,EACD,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,mBAAmB,GACvB,MAAM,8CAA8C,CAAC;QACnD,OAAO;QACP,sBAAsB,EAAE,cAAc;QACtC,MAAM;KACP,CAAC,CAAC;IACL,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,oBAAoB,GACxB,MAAM,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,0BAA0B,CACxB,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,MAAM,EACN,gBAAgB,CAAC,cAAc,CAChC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,qCAAqC,CAAC;QACjE,SAAS,EAAE,iBAAiB;QAC5B,OAAO;QACP,sBAAsB,EAAE,cAAc;QACtC,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,YAAY,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAC/C,OAAO,CAAC,UAAU,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,qBAAqB,EAAE,WAAW,CAAC,cAAc;QACjD,cAAc,EAAE,WAAW,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CACd,iCAAiC,WAAW,CAAC,cAAc,GAAG,CAC/D,CAAC;IACF,OAAO;QACL,GAAG,WAAW;QACd,sBAAsB,EAAE,cAAc;QACtC,KAAK;KACN,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport { resolveOrganizationBillingView } from \"../../workflows/organizations/billing\";\nimport {\n loadOrganizationReplacementFinalizationRequest,\n removeOrganizationProvisioningAttempt,\n} from \"../../workflows/organizations/organizationProvisioningAttempt\";\nimport { verifyOrganizationReplacementResponse } from \"../../workflows/organizations/organizationReplacementVerification\";\nimport { clearRemoteSyncState } from \"../../workflows/sync\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport { PurgedOrganizationRecoveryBillingRequiredError } from \"./sessionRecoveryErrors\";\nimport type {\n CreateOrganizationOptions,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionRecoverOrganizationResult,\n} from \"./sessionTypes\";\n\ninterface SessionPurgeRecoveryDependencies {\n api: Pick<ApiClient, \"clearWriterProjectionCaches\">;\n database: Pick<Database, \"requireExecSql\">;\n identity: Pick<Identity, \"snapshot\">;\n log: (message: string) => void;\n}\n\ninterface SessionPurgeRecoveryContext {\n createOrganization: (\n options?: CreateOrganizationOptions,\n replacesOrganizationId?: string,\n ) => Promise<SessionCreateOrganizationResult \| null>;\n organizationId: string \| null;\n setContext: (context: SessionContext) => void;\n userId: string \| null;\n}\n\nfunction requireReplacementCanSync(\n replacement: SessionCreateOrganizationResult,\n billing: Awaited<ReturnType<ApiClient[\"getOrganizationBilling\"]>>,\n): void {\n if (!billing) {\n throw new Error(\"Replacement organization billing could not be loaded\");\n }\n if (!resolveOrganizationBillingView(billing, Date.now()).canSync) {\n throw new PurgedOrganizationRecoveryBillingRequiredError(\n replacement.organizationId,\n billing.status,\n replacement.containerId,\n );\n }\n}\n\nexport async function clearSessionRemoteSyncState(\n dependencies: SessionPurgeRecoveryDependencies,\n session: SessionPurgeRecoveryContext,\n organizationId: string,\n) {\n const execSql = dependencies.database.requireExecSql(\"clearRemoteSyncState\");\n const result = await clearRemoteSyncState(execSql, {\n organizationId,\n });\n dependencies.api.clearWriterProjectionCaches();\n if (session.organizationId === organizationId) {\n session.setContext({ containerId: null, organizationId: null });\n }\n dependencies.log(\"Remote sync state cleared\");\n return result;\n}\n\nfunction verifyFinalizedReplacement(\n finalizedReplacement: Awaited<ReturnType<ApiClient[\"createOrganization\"]>>,\n replacement: SessionCreateOrganizationResult,\n replacesOrganizationId: string,\n userId: string,\n signingKeyPair: Identity[\"snapshot\"][\"signingKeyPair\"],\n): void {\n if (\n !finalizedReplacement \|\|\n finalizedReplacement.organizationId !== replacement.organizationId \|\|\n finalizedReplacement.rootContainerId !== replacement.containerId \|\|\n finalizedReplacement.userId !== userId\n ) {\n throw new Error(\"Organization replacement finalization was inconsistent\");\n }\n if (!signingKeyPair) {\n throw new Error(\n \"Organization replacement requires the current signing identity\",\n );\n }\n verifyOrganizationReplacementResponse({\n replacesOrganizationId,\n response: finalizedReplacement,\n signingPublicKey: signingKeyPair.signingPublicKey,\n userId,\n });\n}\n\nexport async function recoverPurgedSessionOrganization(\n dependencies: SessionPurgeRecoveryDependencies & {\n api: Pick<\n ApiClient,\n \| \"clearWriterProjectionCaches\"\n \| \"createOrganization\"\n \| \"getOrganizationBilling\"\n >;\n },\n session: SessionPurgeRecoveryContext,\n organizationId: string,\n options: CreateOrganizationOptions \| undefined,\n): Promise<SessionRecoverOrganizationResult \| null> {\n const identitySnapshot = dependencies.identity.snapshot;\n const sessionOrganizationId = session.organizationId;\n const userId = session.userId;\n if (!userId) {\n throw new Error(\"Purged organization recovery requires a current user\");\n }\n const isRecoveryCurrent = () =>\n dependencies.identity.snapshot === identitySnapshot &&\n session.organizationId === sessionOrganizationId &&\n session.userId === userId;\n const billing = await dependencies.api.getOrganizationBilling(organizationId);\n if (billing?.status !== \"purged\") {\n throw new Error(\n `Organization ${organizationId} cannot be recovered before its purge finishes`,\n );\n }\n if (!isRecoveryCurrent()) return null;\n const replacement = await session.createOrganization(options, organizationId);\n if (!replacement) return null;\n if (!isRecoveryCurrent()) return null;\n const replacementBilling = await dependencies.api.getOrganizationBilling(\n replacement.organizationId,\n );\n if (!isRecoveryCurrent()) return null;\n requireReplacementCanSync(replacement, replacementBilling);\n const execSql = dependencies.database.requireExecSql(\n \"recoverPurgedOrganization\",\n );\n const reset = await clearRemoteSyncState(\n execSql,\n {\n organizationId,\n replacement: {\n organizationId: replacement.organizationId,\n rootContainerId: replacement.containerId,\n },\n },\n isRecoveryCurrent,\n );\n if (!isRecoveryCurrent()) return null;\n const finalizationRequest =\n await loadOrganizationReplacementFinalizationRequest({\n execSql,\n replacedOrganizationId: organizationId,\n userId,\n });\n if (!isRecoveryCurrent()) return null;\n const finalizedReplacement =\n await dependencies.api.createOrganization(finalizationRequest);\n if (!isRecoveryCurrent()) return null;\n verifyFinalizedReplacement(\n finalizedReplacement,\n replacement,\n organizationId,\n userId,\n identitySnapshot.signingKeyPair,\n );\n const attemptRemoved = await removeOrganizationProvisioningAttempt({\n canCommit: isRecoveryCurrent,\n execSql,\n replacedOrganizationId: organizationId,\n userId,\n });\n if (!attemptRemoved \|\| !isRecoveryCurrent()) return null;\n dependencies.api.clearWriterProjectionCaches();\n session.setContext({\n containerId: replacement.containerId,\n defaultOrganizationId: replacement.organizationId,\n organizationId: replacement.organizationId,\n });\n dependencies.log(\n `Purged organization replaced (${replacement.organizationId})`,\n );\n return {\n ...replacement,\n replacedOrganizationId: organizationId,\n reset,\n };\n}\n"]}
1	+ {"version":3,"file":"sessionPurgeRecovery.js","sourceRoot":"","sources":["sessionPurgeRecovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EACL,8CAA8C,EAC9C,qCAAqC,GACtC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gFAAgF,CAAC;AACvI,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,8CAA8C,EAAE,MAAM,yBAAyB,CAAC;AAyBzF,SAAS,yBAAyB,CAChC,WAA4C,EAC5C,OAAiE;IAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,8CAA8C,CACtD,WAAW,CAAC,cAAc,EAC1B,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,WAAW,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAA8C,EAC9C,OAAoC,EACpC,cAAsB;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE;QACjD,cAAc;KACf,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,oBAA0E,EAC1E,WAA4C,EAC5C,sBAA8B,EAC9B,MAAc,EACd,cAAsD;IAEtD,IACE,CAAC,oBAAoB;QACrB,oBAAoB,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;QAClE,oBAAoB,CAAC,eAAe,KAAK,WAAW,CAAC,WAAW;QAChE,oBAAoB,CAAC,MAAM,KAAK,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,qCAAqC,CAAC;QACpC,sBAAsB;QACtB,QAAQ,EAAE,oBAAoB;QAC9B,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,YAOC,EACD,OAAoC,EACpC,cAAsB,EACtB,OAA8C;IAE9C,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxD,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAC7B,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;QACnD,OAAO,CAAC,cAAc,KAAK,qBAAqB;QAChD,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,gBAAgB,cAAc,gDAAgD,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,kBAAkB,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,sBAAsB,CACtE,WAAW,CAAC,cAAc,CAC3B,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAClD,2BAA2B,CAC5B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,OAAO,EACP;QACE,cAAc;QACd,WAAW,EAAE;YACX,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,eAAe,EAAE,WAAW,CAAC,WAAW;SACzC;KACF,EACD,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,mBAAmB,GACvB,MAAM,8CAA8C,CAAC;QACnD,OAAO;QACP,sBAAsB,EAAE,cAAc;QACtC,MAAM;KACP,CAAC,CAAC;IACL,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,oBAAoB,GACxB,MAAM,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,0BAA0B,CACxB,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,MAAM,EACN,gBAAgB,CAAC,cAAc,CAChC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,qCAAqC,CAAC;QACjE,SAAS,EAAE,iBAAiB;QAC5B,OAAO;QACP,sBAAsB,EAAE,cAAc;QACtC,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,YAAY,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAC/C,OAAO,CAAC,UAAU,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,qBAAqB,EAAE,WAAW,CAAC,cAAc;QACjD,cAAc,EAAE,WAAW,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CACd,iCAAiC,WAAW,CAAC,cAAc,GAAG,CAC/D,CAAC;IACF,OAAO;QACL,GAAG,WAAW;QACd,sBAAsB,EAAE,cAAc;QACtC,KAAK;KACN,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport { resolveOrganizationBillingView } from \"../../workflows/organizations/billing\";\nimport {\n loadOrganizationReplacementFinalizationRequest,\n removeOrganizationProvisioningAttempt,\n} from \"../../workflows/organizations/provisioning/organizationProvisioningAttempt\";\nimport { verifyOrganizationReplacementResponse } from \"../../workflows/organizations/provisioning/organizationReplacementVerification\";\nimport { clearRemoteSyncState } from \"../../workflows/sync\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport { PurgedOrganizationRecoveryBillingRequiredError } from \"./sessionRecoveryErrors\";\nimport type {\n CreateOrganizationOptions,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionRecoverOrganizationResult,\n} from \"./sessionTypes\";\n\ninterface SessionPurgeRecoveryDependencies {\n api: Pick<ApiClient, \"clearWriterProjectionCaches\">;\n database: Pick<Database, \"requireExecSql\">;\n identity: Pick<Identity, \"snapshot\">;\n log: (message: string) => void;\n}\n\ninterface SessionPurgeRecoveryContext {\n createOrganization: (\n options?: CreateOrganizationOptions,\n replacesOrganizationId?: string,\n ) => Promise<SessionCreateOrganizationResult \| null>;\n organizationId: string \| null;\n setContext: (context: SessionContext) => void;\n userId: string \| null;\n}\n\nfunction requireReplacementCanSync(\n replacement: SessionCreateOrganizationResult,\n billing: Awaited<ReturnType<ApiClient[\"getOrganizationBilling\"]>>,\n): void {\n if (!billing) {\n throw new Error(\"Replacement organization billing could not be loaded\");\n }\n if (!resolveOrganizationBillingView(billing, Date.now()).canSync) {\n throw new PurgedOrganizationRecoveryBillingRequiredError(\n replacement.organizationId,\n billing.status,\n replacement.containerId,\n );\n }\n}\n\nexport async function clearSessionRemoteSyncState(\n dependencies: SessionPurgeRecoveryDependencies,\n session: SessionPurgeRecoveryContext,\n organizationId: string,\n) {\n const execSql = dependencies.database.requireExecSql(\"clearRemoteSyncState\");\n const result = await clearRemoteSyncState(execSql, {\n organizationId,\n });\n dependencies.api.clearWriterProjectionCaches();\n if (session.organizationId === organizationId) {\n session.setContext({ containerId: null, organizationId: null });\n }\n dependencies.log(\"Remote sync state cleared\");\n return result;\n}\n\nfunction verifyFinalizedReplacement(\n finalizedReplacement: Awaited<ReturnType<ApiClient[\"createOrganization\"]>>,\n replacement: SessionCreateOrganizationResult,\n replacesOrganizationId: string,\n userId: string,\n signingKeyPair: Identity[\"snapshot\"][\"signingKeyPair\"],\n): void {\n if (\n !finalizedReplacement \|\|\n finalizedReplacement.organizationId !== replacement.organizationId \|\|\n finalizedReplacement.rootContainerId !== replacement.containerId \|\|\n finalizedReplacement.userId !== userId\n ) {\n throw new Error(\"Organization replacement finalization was inconsistent\");\n }\n if (!signingKeyPair) {\n throw new Error(\n \"Organization replacement requires the current signing identity\",\n );\n }\n verifyOrganizationReplacementResponse({\n replacesOrganizationId,\n response: finalizedReplacement,\n signingPublicKey: signingKeyPair.signingPublicKey,\n userId,\n });\n}\n\nexport async function recoverPurgedSessionOrganization(\n dependencies: SessionPurgeRecoveryDependencies & {\n api: Pick<\n ApiClient,\n \| \"clearWriterProjectionCaches\"\n \| \"createOrganization\"\n \| \"getOrganizationBilling\"\n >;\n },\n session: SessionPurgeRecoveryContext,\n organizationId: string,\n options: CreateOrganizationOptions \| undefined,\n): Promise<SessionRecoverOrganizationResult \| null> {\n const identitySnapshot = dependencies.identity.snapshot;\n const sessionOrganizationId = session.organizationId;\n const userId = session.userId;\n if (!userId) {\n throw new Error(\"Purged organization recovery requires a current user\");\n }\n const isRecoveryCurrent = () =>\n dependencies.identity.snapshot === identitySnapshot &&\n session.organizationId === sessionOrganizationId &&\n session.userId === userId;\n const billing = await dependencies.api.getOrganizationBilling(organizationId);\n if (billing?.status !== \"purged\") {\n throw new Error(\n `Organization ${organizationId} cannot be recovered before its purge finishes`,\n );\n }\n if (!isRecoveryCurrent()) return null;\n const replacement = await session.createOrganization(options, organizationId);\n if (!replacement) return null;\n if (!isRecoveryCurrent()) return null;\n const replacementBilling = await dependencies.api.getOrganizationBilling(\n replacement.organizationId,\n );\n if (!isRecoveryCurrent()) return null;\n requireReplacementCanSync(replacement, replacementBilling);\n const execSql = dependencies.database.requireExecSql(\n \"recoverPurgedOrganization\",\n );\n const reset = await clearRemoteSyncState(\n execSql,\n {\n organizationId,\n replacement: {\n organizationId: replacement.organizationId,\n rootContainerId: replacement.containerId,\n },\n },\n isRecoveryCurrent,\n );\n if (!isRecoveryCurrent()) return null;\n const finalizationRequest =\n await loadOrganizationReplacementFinalizationRequest({\n execSql,\n replacedOrganizationId: organizationId,\n userId,\n });\n if (!isRecoveryCurrent()) return null;\n const finalizedReplacement =\n await dependencies.api.createOrganization(finalizationRequest);\n if (!isRecoveryCurrent()) return null;\n verifyFinalizedReplacement(\n finalizedReplacement,\n replacement,\n organizationId,\n userId,\n identitySnapshot.signingKeyPair,\n );\n const attemptRemoved = await removeOrganizationProvisioningAttempt({\n canCommit: isRecoveryCurrent,\n execSql,\n replacedOrganizationId: organizationId,\n userId,\n });\n if (!attemptRemoved \|\| !isRecoveryCurrent()) return null;\n dependencies.api.clearWriterProjectionCaches();\n session.setContext({\n containerId: replacement.containerId,\n defaultOrganizationId: replacement.organizationId,\n organizationId: replacement.organizationId,\n });\n dependencies.log(\n `Purged organization replaced (${replacement.organizationId})`,\n );\n return {\n ...replacement,\n replacedOrganizationId: organizationId,\n reset,\n };\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.62",
+  "version": "0.1.63",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/stores/documents/documentStore/attachmentHydrationCommit.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
 import { runSerializedDocumentBlobMutation, } from "../../../workflows/documents/index.js";
-import { saveHydratedDocumentAttachment } from "../../../workflows/documents/attachmentPersistence.js";
+import { saveHydratedDocumentAttachment } from "../../../workflows/documents/attachments/attachmentPersistence.js";
 import { installLocalAttachmentRecords, removeLocalAttachmentSlot, } from "./attachmentPersistence.js";
 export async function commitHydratedAttachment(input) {
     const { state, currentDoc, hydratedBlob, expectedStorageKey, generationIsCurrent, } = input;

package/stores/documents/documentStore/attachmentHydrationCommit.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"attachmentHydrationCommit.js","sourceRoot":"","sources":["attachmentHydrationCommit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAEL,iCAAiC,GAClC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,~~oDAAoD~~,CAAC;~~AACpG~~,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAOjC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAW9C;IACC,MAAM,EACJ,KAAK,EACL,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,GACpB,GAAG,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;IAC5E,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,mBAAmB,EAAE;QACrB,KAAK,CAAC,GAAG,KAAK,UAAU;QACxB,sBAAsB,CAAC,UAAU,CAAC,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,UAAU,CAAC,MAAM;YACpD,UAAU,CAAC,aAAa,KAAK,YAAY,CAAC,UAAU,CAAC,aAAa,CACrE,CAAC;IACJ,MAAM,iCAAiC,CACrC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CACtC,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,KAAK,CACnB,CAAC;QACF,MAAM,UAAU,GAA0B;YACxC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM;YACnC,gEAAgE;YAChE,oEAAoE;YACpE,yCAAyC;YACzC,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU;YACzC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,QAAQ;YAC1C,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM;YACtC,UAAU,EAAE,YAAY,CAAC,UAAU;SACpC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU;YACV,kBAAkB;YAClB,0BAA0B;YAC1B,YAAY;SACb,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,YAAY,EAAE;YAC7B,6BAA6B,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;aAC5D,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE;YACnC,MAAM,4BAA4B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAqD,EACrD,YAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,oBAAoB,CACvD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;IAC9C,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,6BAA6B,CAC3B,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAC3C,UAAU,CACX,CAAC;AACJ,CAAC","sourcesContent":["import { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport type { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n type LocalAttachmentRecord,\n runSerializedDocumentBlobMutation,\n} from \"../../../workflows/documents\";\nimport { saveHydratedDocumentAttachment } from \"../../../workflows/documents/attachmentPersistence\";\nimport {\n installLocalAttachmentRecords,\n removeLocalAttachmentSlot,\n} from \"./attachmentPersistence\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\n\ntype HydratedBlob = NonNullable<\n Awaited<ReturnType<typeof hydrateDocumentAttachmentBlobs>>\n>[number];\n\nexport async function commitHydratedAttachment(input: {\n state: DocumentStoreState;\n currentDoc: DocumentState;\n hydratedBlob: Pick<\n HydratedBlob,\n \"attachment\" \| \"bytes\" \| \"contentSha256\" \| \"storageKey\"\n > & {\n binding: Pick<HydratedBlob[\"binding\"], \"blobId\">;\n };\n expectedStorageKey: string \| null;\n generationIsCurrent: () => boolean;\n}): Promise<void> {\n const {\n state,\n currentDoc,\n hydratedBlob,\n expectedStorageKey,\n generationIsCurrent,\n } = input;\n const runtime = state.runtime;\n const expectedSnapshotEndVersion = state.record?.snapshotEndVersion ?? null;\n const stillCurrent = () =>\n generationIsCurrent() &&\n state.doc === currentDoc &&\n getDocumentAttachments(currentDoc).some(\n (attachment) =>\n attachment.slotId === hydratedBlob.attachment.slotId &&\n attachment.contentSha256 === hydratedBlob.attachment.contentSha256,\n );\n await runSerializedDocumentBlobMutation(\n runtime.infra.execSql,\n hydratedBlob.storageKey,\n async () => {\n if (!stillCurrent()) return;\n await runtime.infra.blobStore.writeBytes(\n hydratedBlob.storageKey,\n hydratedBlob.bytes,\n );\n const attachment: LocalAttachmentRecord = {\n blobId: hydratedBlob.binding.blobId,\n // The held bytes' own size, not the document intent's: a served\n // binding the intent has not recorded yet may differ in length, and\n // preview gating reads the local record.\n byteLength: hydratedBlob.bytes.byteLength,\n contentSha256: hydratedBlob.contentSha256,\n detachedAt: null,\n localId: state.localId,\n mimeType: hydratedBlob.attachment.mimeType,\n slotId: hydratedBlob.attachment.slotId,\n storageKey: hydratedBlob.storageKey,\n };\n const committed = await saveHydratedDocumentAttachment({\n execSql: runtime.infra.execSql,\n persistence: state.persistence,\n attachment,\n expectedStorageKey,\n expectedSnapshotEndVersion,\n stillCurrent,\n });\n if (committed && stillCurrent())\n installLocalAttachmentRecords(state, [attachment], currentDoc);\n else if (!committed && stillCurrent())\n await refreshRefusedAttachmentSlot(input, stillCurrent);\n },\n );\n}\n\nasync function refreshRefusedAttachmentSlot(\n input: Parameters<typeof commitHydratedAttachment>[0],\n stillCurrent: () => boolean,\n): Promise<void> {\n const { state, currentDoc, hydratedBlob } = input;\n const rows = await state.persistence.listLocalAttachments(\n state.runtime.infra.execSql,\n state.localId,\n );\n if (!stillCurrent()) return;\n const slotId = hydratedBlob.attachment.slotId;\n removeLocalAttachmentSlot(state, slotId);\n installLocalAttachmentRecords(\n state,\n rows.filter((row) => row.slotId === slotId),\n currentDoc,\n );\n}\n"]}
1	+ {"version":3,"file":"attachmentHydrationCommit.js","sourceRoot":"","sources":["attachmentHydrationCommit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAEL,iCAAiC,GAClC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AAChH,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAOjC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAW9C;IACC,MAAM,EACJ,KAAK,EACL,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,GACpB,GAAG,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;IAC5E,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,mBAAmB,EAAE;QACrB,KAAK,CAAC,GAAG,KAAK,UAAU;QACxB,sBAAsB,CAAC,UAAU,CAAC,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,UAAU,CAAC,MAAM;YACpD,UAAU,CAAC,aAAa,KAAK,YAAY,CAAC,UAAU,CAAC,aAAa,CACrE,CAAC;IACJ,MAAM,iCAAiC,CACrC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CACtC,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,KAAK,CACnB,CAAC;QACF,MAAM,UAAU,GAA0B;YACxC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM;YACnC,gEAAgE;YAChE,oEAAoE;YACpE,yCAAyC;YACzC,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU;YACzC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,QAAQ;YAC1C,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM;YACtC,UAAU,EAAE,YAAY,CAAC,UAAU;SACpC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU;YACV,kBAAkB;YAClB,0BAA0B;YAC1B,YAAY;SACb,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,YAAY,EAAE;YAC7B,6BAA6B,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;aAC5D,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE;YACnC,MAAM,4BAA4B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAqD,EACrD,YAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,oBAAoB,CACvD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;IAC9C,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,6BAA6B,CAC3B,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAC3C,UAAU,CACX,CAAC;AACJ,CAAC","sourcesContent":["import { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport type { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n type LocalAttachmentRecord,\n runSerializedDocumentBlobMutation,\n} from \"../../../workflows/documents\";\nimport { saveHydratedDocumentAttachment } from \"../../../workflows/documents/attachments/attachmentPersistence\";\nimport {\n installLocalAttachmentRecords,\n removeLocalAttachmentSlot,\n} from \"./attachmentPersistence\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\n\ntype HydratedBlob = NonNullable<\n Awaited<ReturnType<typeof hydrateDocumentAttachmentBlobs>>\n>[number];\n\nexport async function commitHydratedAttachment(input: {\n state: DocumentStoreState;\n currentDoc: DocumentState;\n hydratedBlob: Pick<\n HydratedBlob,\n \"attachment\" \| \"bytes\" \| \"contentSha256\" \| \"storageKey\"\n > & {\n binding: Pick<HydratedBlob[\"binding\"], \"blobId\">;\n };\n expectedStorageKey: string \| null;\n generationIsCurrent: () => boolean;\n}): Promise<void> {\n const {\n state,\n currentDoc,\n hydratedBlob,\n expectedStorageKey,\n generationIsCurrent,\n } = input;\n const runtime = state.runtime;\n const expectedSnapshotEndVersion = state.record?.snapshotEndVersion ?? null;\n const stillCurrent = () =>\n generationIsCurrent() &&\n state.doc === currentDoc &&\n getDocumentAttachments(currentDoc).some(\n (attachment) =>\n attachment.slotId === hydratedBlob.attachment.slotId &&\n attachment.contentSha256 === hydratedBlob.attachment.contentSha256,\n );\n await runSerializedDocumentBlobMutation(\n runtime.infra.execSql,\n hydratedBlob.storageKey,\n async () => {\n if (!stillCurrent()) return;\n await runtime.infra.blobStore.writeBytes(\n hydratedBlob.storageKey,\n hydratedBlob.bytes,\n );\n const attachment: LocalAttachmentRecord = {\n blobId: hydratedBlob.binding.blobId,\n // The held bytes' own size, not the document intent's: a served\n // binding the intent has not recorded yet may differ in length, and\n // preview gating reads the local record.\n byteLength: hydratedBlob.bytes.byteLength,\n contentSha256: hydratedBlob.contentSha256,\n detachedAt: null,\n localId: state.localId,\n mimeType: hydratedBlob.attachment.mimeType,\n slotId: hydratedBlob.attachment.slotId,\n storageKey: hydratedBlob.storageKey,\n };\n const committed = await saveHydratedDocumentAttachment({\n execSql: runtime.infra.execSql,\n persistence: state.persistence,\n attachment,\n expectedStorageKey,\n expectedSnapshotEndVersion,\n stillCurrent,\n });\n if (committed && stillCurrent())\n installLocalAttachmentRecords(state, [attachment], currentDoc);\n else if (!committed && stillCurrent())\n await refreshRefusedAttachmentSlot(input, stillCurrent);\n },\n );\n}\n\nasync function refreshRefusedAttachmentSlot(\n input: Parameters<typeof commitHydratedAttachment>[0],\n stillCurrent: () => boolean,\n): Promise<void> {\n const { state, currentDoc, hydratedBlob } = input;\n const rows = await state.persistence.listLocalAttachments(\n state.runtime.infra.execSql,\n state.localId,\n );\n if (!stillCurrent()) return;\n const slotId = hydratedBlob.attachment.slotId;\n removeLocalAttachmentSlot(state, slotId);\n installLocalAttachmentRecords(\n state,\n rows.filter((row) => row.slotId === slotId),\n currentDoc,\n );\n}\n"]}

package/stores/documents/documentStore/attachmentUploadAttempt.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { reportAndRethrowKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
-import { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from "../../../workflows/blobs/upload.js";
+import { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from "../../../workflows/blobs/upload/index.js";
 export async function uploadAttachmentWithWriterProjectionRetry(input) {
     let remoteSyncBlocked = false;
     let checkedOrganizationId;

package/stores/documents/documentStore/syncRemoteSignals.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { isContainerProjectionInvalidationHint, isDocumentUpdateCreatedEvent, } from "../../../data/documents/documentSync.js";
-import { sequenceUnchanged } from "../../../workflows/documents/syncLane.js";
+import { sequenceUnchanged } from "../../../workflows/documents/sync/syncLane.js";
 import { resumeAfterAncestorRepairHint } from "./ancestorRepairPark.js";
 import { allowDocumentStoreRemoteSync, markDocumentStoreRemoteSyncPending, } from "./syncGeneration.js";
 import { invalidateDocumentWriterProjection } from "./writerProjectionGeneration.js";

package/stores/documents/documentStore/syncRemoteSignals.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"syncRemoteSignals.js","sourceRoot":"","sources":["syncRemoteSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,~~uCAAuC~~,CAAC;~~AAC1E~~,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAElF,MAAM,UAAU,4BAA4B,CAC1C,KAAyB,EACzB,MAA8B;IAE9B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,CAAC,4BAA4B,CAAC,KAAK,CAAC;YACpC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,EAC7C,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClD,iBAAiB,GAAG,IAAI,CAAC;oBACzB,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;YACD,SAAS;QACX,CAAC;QAED,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,iBAAiB,CAAC;AAErE,MAAM,UAAU,+BAA+B,CAC7C,KAAyB,EACzB,sBAA8B;IAE9B,0EAA0E;IAC1E,4EAA4E;IAC5E,IACE,mCAAmC,CACjC,KAAK,CAAC,qBAAqB,EAC3B,sBAAsB,CACvB,EACD,CAAC;QACD,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC;QAC9D,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAyB,EACzB,YAAwB;IAExB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1E,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAEzD,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAC3C,qCAAqC,CACtC,CAAC;IACF,IAAI,qBAAqB;QAAE,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;QAAE,OAAO;IAEtC,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,qBAAqB,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACpC,oEAAoE;QACpE,uCAAuC;QACvC,kCAAkC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzD,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import {\n isContainerProjectionInvalidationHint,\n isDocumentUpdateCreatedEvent,\n} from \"../../../data/documents/documentSync\";\nimport { sequenceUnchanged } from \"../../../workflows/documents/syncLane\";\nimport { resumeAfterAncestorRepairHint } from \"./ancestorRepairPark\";\nimport type { DocumentStoreState } from \"./state\";\nimport {\n allowDocumentStoreRemoteSync,\n markDocumentStoreRemoteSyncPending,\n} from \"./syncGeneration\";\nimport { invalidateDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\nexport function hasRemoteDocumentUpdateEvent(\n state: DocumentStoreState,\n events: ReadonlyArray<unknown>,\n): boolean {\n let remoteUpdateFound = false;\n\n for (const event of events) {\n if (\n !isDocumentUpdateCreatedEvent(event) \|\|\n event.documentId !== state.record?.documentId\n ) {\n continue;\n }\n\n if (event.updateIds && event.updateIds.length > 0) {\n for (const updateId of event.updateIds) {\n if (!state.locallyAcceptedUpdateIds.has(updateId)) {\n remoteUpdateFound = true;\n continue;\n }\n\n state.locallyAcceptedUpdateIds.delete(updateId);\n }\n continue;\n }\n\n remoteUpdateFound = true;\n }\n\n return remoteUpdateFound;\n}\n\n/** Clear the remote-update signal only when its consumed sequence is unchanged.\n * A moved sequence means a newer remote event arrived mid-pass and must survive\n * for the coalesced re-run to avoid the convergence-stall race.\n */\nexport const canClearRemoteUpdateSignalAfterSync = sequenceUnchanged;\n\nexport function clearConsumedRemoteUpdateSignal(\n state: DocumentStoreState,\n consumedSignalSequence: number,\n): void {\n // A peer event can arrive while the HTTP request is in flight. Clear only\n // the sequence this pass consumed so the newer event survives for a re-run.\n if (\n canClearRemoteUpdateSignalAfterSync(\n state.remoteUpdateSignalSeq,\n consumedSignalSequence,\n )\n ) {\n state.remoteUpdateCompletedSignalSeq = consumedSignalSequence;\n state.remoteUpdatePending = false;\n }\n}\n\nexport function handleDocumentRemoteEvents(\n state: DocumentStoreState,\n scheduleSync: () => void,\n): void {\n const nextEvents = state.runtime.state.events.slice(state.lastEventCount);\n state.lastEventCount = state.runtime.state.events.length;\n\n // A container the document's path cites may have moved its manifest; the\n // store cannot tell which containers this document links into, so the held\n // projection goes and the next mutation fetches a fresh one. This runs even\n // before the document has a remote id: a create in flight captured the\n // generation when it started and must not install its pre-hint projection.\n const projectionInvalidated = nextEvents.some(\n isContainerProjectionInvalidationHint,\n );\n if (projectionInvalidated) invalidateDocumentWriterProjection(state);\n\n if (!state.record?.documentId) return;\n\n // Writes parked behind an ancestor another member must re-key: this hint is\n // the only signal that the repair may have landed. It names no ancestor, so\n // any one re-runs the pass, which parks again if the path is still stale.\n if (projectionInvalidated && resumeAfterAncestorRepairHint(state)) {\n scheduleSync();\n }\n\n if (hasRemoteDocumentUpdateEvent(state, nextEvents)) {\n allowDocumentStoreRemoteSync(state);\n // Let an in-flight pass distinguish this new signal from the one it\n // consumed before its network request.\n markDocumentStoreRemoteSyncPending(state, \"independent\");\n scheduleSync();\n }\n}\n"]}
1	+ {"version":3,"file":"syncRemoteSignals.js","sourceRoot":"","sources":["syncRemoteSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAElF,MAAM,UAAU,4BAA4B,CAC1C,KAAyB,EACzB,MAA8B;IAE9B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,CAAC,4BAA4B,CAAC,KAAK,CAAC;YACpC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,EAC7C,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClD,iBAAiB,GAAG,IAAI,CAAC;oBACzB,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;YACD,SAAS;QACX,CAAC;QAED,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,iBAAiB,CAAC;AAErE,MAAM,UAAU,+BAA+B,CAC7C,KAAyB,EACzB,sBAA8B;IAE9B,0EAA0E;IAC1E,4EAA4E;IAC5E,IACE,mCAAmC,CACjC,KAAK,CAAC,qBAAqB,EAC3B,sBAAsB,CACvB,EACD,CAAC;QACD,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC;QAC9D,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAyB,EACzB,YAAwB;IAExB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1E,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAEzD,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAC3C,qCAAqC,CACtC,CAAC;IACF,IAAI,qBAAqB;QAAE,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;QAAE,OAAO;IAEtC,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,qBAAqB,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACpC,oEAAoE;QACpE,uCAAuC;QACvC,kCAAkC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzD,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import {\n isContainerProjectionInvalidationHint,\n isDocumentUpdateCreatedEvent,\n} from \"../../../data/documents/documentSync\";\nimport { sequenceUnchanged } from \"../../../workflows/documents/sync/syncLane\";\nimport { resumeAfterAncestorRepairHint } from \"./ancestorRepairPark\";\nimport type { DocumentStoreState } from \"./state\";\nimport {\n allowDocumentStoreRemoteSync,\n markDocumentStoreRemoteSyncPending,\n} from \"./syncGeneration\";\nimport { invalidateDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\nexport function hasRemoteDocumentUpdateEvent(\n state: DocumentStoreState,\n events: ReadonlyArray<unknown>,\n): boolean {\n let remoteUpdateFound = false;\n\n for (const event of events) {\n if (\n !isDocumentUpdateCreatedEvent(event) \|\|\n event.documentId !== state.record?.documentId\n ) {\n continue;\n }\n\n if (event.updateIds && event.updateIds.length > 0) {\n for (const updateId of event.updateIds) {\n if (!state.locallyAcceptedUpdateIds.has(updateId)) {\n remoteUpdateFound = true;\n continue;\n }\n\n state.locallyAcceptedUpdateIds.delete(updateId);\n }\n continue;\n }\n\n remoteUpdateFound = true;\n }\n\n return remoteUpdateFound;\n}\n\n/** Clear the remote-update signal only when its consumed sequence is unchanged.\n * A moved sequence means a newer remote event arrived mid-pass and must survive\n * for the coalesced re-run to avoid the convergence-stall race.\n */\nexport const canClearRemoteUpdateSignalAfterSync = sequenceUnchanged;\n\nexport function clearConsumedRemoteUpdateSignal(\n state: DocumentStoreState,\n consumedSignalSequence: number,\n): void {\n // A peer event can arrive while the HTTP request is in flight. Clear only\n // the sequence this pass consumed so the newer event survives for a re-run.\n if (\n canClearRemoteUpdateSignalAfterSync(\n state.remoteUpdateSignalSeq,\n consumedSignalSequence,\n )\n ) {\n state.remoteUpdateCompletedSignalSeq = consumedSignalSequence;\n state.remoteUpdatePending = false;\n }\n}\n\nexport function handleDocumentRemoteEvents(\n state: DocumentStoreState,\n scheduleSync: () => void,\n): void {\n const nextEvents = state.runtime.state.events.slice(state.lastEventCount);\n state.lastEventCount = state.runtime.state.events.length;\n\n // A container the document's path cites may have moved its manifest; the\n // store cannot tell which containers this document links into, so the held\n // projection goes and the next mutation fetches a fresh one. This runs even\n // before the document has a remote id: a create in flight captured the\n // generation when it started and must not install its pre-hint projection.\n const projectionInvalidated = nextEvents.some(\n isContainerProjectionInvalidationHint,\n );\n if (projectionInvalidated) invalidateDocumentWriterProjection(state);\n\n if (!state.record?.documentId) return;\n\n // Writes parked behind an ancestor another member must re-key: this hint is\n // the only signal that the repair may have landed. It names no ancestor, so\n // any one re-runs the pass, which parks again if the path is still stale.\n if (projectionInvalidated && resumeAfterAncestorRepairHint(state)) {\n scheduleSync();\n }\n\n if (hasRemoteDocumentUpdateEvent(state, nextEvents)) {\n allowDocumentStoreRemoteSync(state);\n // Let an in-flight pass distinguish this new signal from the one it\n // consumed before its network request.\n markDocumentStoreRemoteSyncPending(state, \"independent\");\n scheduleSync();\n }\n}\n"]}

package/stores/documents/documentStore/syncShared.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { deriveStableDocumentId } from "../../../data/documents/shared/stableDocumentId.js";
 import { createRemoteDocument, DOCUMENTS_APP_KIND, describeDocumentRevalidationFailure, describeDocumentSyncSubmitFailure, recordDocumentSyncFailure, resolveDocumentCreateAuthor, runSerializedSqlMutation, } from "../../../workflows/documents/index.js";
-import { reportDocumentSyncQuarantine } from "../../../workflows/documents/reportDocumentSyncQuarantine.js";
+import { reportDocumentSyncQuarantine } from "../../../workflows/documents/sync/reportDocumentSyncQuarantine.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../../workflows/principals/runtimePolicyWarmer.js";
 import { chainIdentityWrite } from "./identityWriteChain.js";
 import { persistDocument } from "./persistence.js";

package/stores/documents/documentStore/syncShared.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"syncShared.js","sourceRoot":"","sources":["syncShared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAGlB,mCAAmC,EACnC,iCAAiC,EAEjC,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAIL,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAyB,EACzB,UAAwC;IAExC,OAAO,0BAA0B,CAAC;QAChC,eAAe,EAAE,mCAAmC;QACpD,UAAU;QACV,KAAK;QACL,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAyB,EACzB,UAAwC;IAExC,OAAO,0BAA0B,CAAC;QAChC,eAAe,EAAE,iCAAiC;QAClD,UAAU;QACV,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6CAA6C,CAC3D,KAAyB,EACzB,UAAwC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;QAC7C,UAAU;QACV,KAAK;KACN,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAyC,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;YACxE,OAAO;QACT,4BAA4B,CAC1B,UAAU,EAAE,UAAU,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAC5C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAC3B,OAAO,CACR,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAQnC;IACC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,KAAK,EAAE,OAGb,EAAE,EAAE;QACH,IAAI,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,wBAAwB,CAC5B,UAAU,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAClD,KAAK,EAAE,aAAa,EAAE,EAAE;YACtB,IACE,UAAU;gBACV,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EACxD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,aAAa,EACb,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACvD;gBACE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC;gBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAAC,MAAsB;IACjE,OAAO,CACL,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAChC,MAAM,CAAC,kBAAkB,KAAK,IAAI;QAClC,MAAM,CAAC,sBAAsB,KAAK,IAAI,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAIpD;IACC,OAAO,CACL,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,IAAI;QACrC,CAAC,KAAK,CAAC,aAAa,CAAC,gCAAgC;QACrD,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB;QAChC,mCAAmC,CAAC,KAAK,CAAC,aAAa,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAyB;IAEzB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5C,kEAAkE,EAClE,EAAE,cAAc,EAAE,WAAW,EAAE,CAChC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyB,EACzB,SAAwB;IAExB,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAyB,EACzB,UAAyB,EACzB,UAAiC,EACjC,oBAA0C,EAC1C,UAAwC;IAExC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,UAAU,IAAI,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAE9D,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,iEAAiE,CAClE,CAAC;QACF,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,oCAAoC,CACxC,KAAK,EACL,UAAU,CACX,CAAC;YACA,OAAO,EAAE,uDAAuD;YAChE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,6EAA6E,CAC9E,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GACd,UAAU,EAAE,kBAAkB;QAC9B,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEtB,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;QACtC,wEAAwE;QACxE,sEAAsE;QACtE,4CAA4C;QAC5C,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB;QACrD,uBAAuB,EAAE,oCAAoC,CAC3D,KAAK,EACL,UAAU,CACX;QACD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,mBAAmB;QACjC,eAAe,EAAE,oBAAoB,CAAC,SAAS;QAC/C,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,mBAAmB,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;QAE9D,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;QAChD,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5D,+BAA+B,CAC7B,KAAK,EACL,OAAO,CAAC,gBAAgB,EACxB,0BAA0B,CAC3B,CAAC;QAEF,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG;YACrB,gCAAgC,EAAE,IAAI;YACtC,oBAAoB,EAAE,IAAI;SAC3B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,KAAK,EACL,UAAU,EACV,YAAY,EACZ,cAAc,EACd,UAAU,CACX,CAAC;QACF,OAAO,SAAS,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { deriveStableDocumentId } from \"../../../data/documents/shared/stableDocumentId\";\nimport {\n createRemoteDocument,\n DOCUMENTS_APP_KIND,\n type DocumentRecord,\n type DocumentSyncUpdateIsolationError,\n describeDocumentRevalidationFailure,\n describeDocumentSyncSubmitFailure,\n type PendingUpdateRecord,\n recordDocumentSyncFailure,\n resolveDocumentCreateAuthor,\n runSerializedSqlMutation,\n} from \"../../../workflows/documents\";\nimport { reportDocumentSyncQuarantine } from \"../../../workflows/documents/reportDocumentSyncQuarantine\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../workflows/principals/runtimePolicyWarmer\";\nimport { chainIdentityWrite } from \"./identityWriteChain\";\nimport { persistDocument } from \"./persistence\";\nimport {\n type DocumentState,\n type DocumentStoreState,\n type EncapsulationKeyPair,\n markDocumentStoreRemoved,\n} from \"./state\";\nimport {\n type DocumentStoreSyncGeneration,\n isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { installDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\n/*\n Record a refused read-only revalidation on this document's failure row, so\n * a document that can never refresh stops failing silently (edge-case row\n * 13). 403s stay suppressed on purpose — a read-only 403 must never flag\n * unattempted local edits (row 9) — and the row clears on the next clean\n * pass like every other sync failure.\n /\nexport function documentRevalidationFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n return documentSyncFailureHandler({\n describeFailure: describeDocumentRevalidationFailure,\n generation,\n state,\n suppressForbidden: true,\n });\n}\n\n/\n Record a terminal submit failure on this document's write-queue row. Shared\n * by every store pass that can submit queued writes (create and sync), so\n * re-key exhaustion and denial failures surface no matter which pass hits\n * them first.\n /\nexport function documentTerminalSubmitFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n return documentSyncFailureHandler({\n describeFailure: describeDocumentSyncSubmitFailure,\n generation,\n state,\n });\n}\n\n/* Persist quarantine and report its Error through the host's diagnostics. /\nexport function documentIncomingUpdateIsolationFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n const recordFailure = documentSyncFailureHandler({\n describeFailure: (failure) => failure.message,\n generation,\n state,\n });\n return async (failure: DocumentSyncUpdateIsolationError) => {\n await recordFailure({ message: failure.message, status: null });\n if (generation && !isDocumentStoreSyncGenerationCurrent(state, generation))\n return;\n reportDocumentSyncQuarantine(\n generation?.currentDoc ?? state.doc ?? state,\n state.runtime.util.logError,\n failure,\n );\n };\n}\n\n/\n The generation recheck runs INSIDE the serialized mutation (like the\n * attachment failure path): a teardown (discard/reset) that wins the ordering\n * deletes this document's rows first and invalidates the generation, so a\n * stale handler can never resurrect a deleted or orphan failure row\n * afterwards.\n /\nfunction documentSyncFailureHandler(input: {\n describeFailure: (failure: {\n readonly message: string;\n readonly status: number \| null;\n }) => string;\n generation: DocumentStoreSyncGeneration \| undefined;\n state: DocumentStoreState;\n suppressForbidden?: boolean;\n}) {\n const { generation, state } = input;\n return async (failure: {\n readonly message: string;\n readonly status: number \| null;\n }) => {\n if (input.suppressForbidden && failure.status === 403) {\n return;\n }\n\n await runSerializedSqlMutation(\n generation?.execSql ?? state.runtime.infra.execSql,\n async (lockedExecSql) => {\n if (\n generation &&\n !isDocumentStoreSyncGenerationCurrent(state, generation)\n ) {\n return;\n }\n await recordDocumentSyncFailure(\n lockedExecSql,\n { appKind: DOCUMENTS_APP_KIND, localId: state.localId },\n {\n attemptedAt: new Date().toISOString(),\n message: input.describeFailure(failure),\n status: failure.status,\n },\n );\n },\n );\n };\n}\n\nfunction hasPersistedRemoteDocumentSyncState(record: DocumentRecord): boolean {\n return (\n record.lastCommitLsn !== null &&\n record.contentKeyBundle !== null &&\n record.documentKekTargets !== null &&\n record.documentManifestBundle !== null\n );\n}\n\nexport function shouldSkipCleanScheduledDocumentSync(input: {\n currentRecord: DocumentRecord;\n pendingUpdates: readonly PendingUpdateRecord[];\n state: DocumentStoreState;\n}): boolean {\n return (\n input.pendingUpdates.length === 0 &&\n input.state.pendingAttachments.length === 0 &&\n input.state.pullContinuation === null &&\n !input.currentRecord.pullContinuationRecoveryRequired &&\n !input.state.remoteUpdatePending &&\n hasPersistedRemoteDocumentSyncState(input.currentRecord)\n );\n}\n\n/\n True when the store's container exists locally but has not been created on\n * the server yet (its own create intent is still pending). Creating a document\n * inside it would 404 on the container writer projection and surface a\n * spurious sync error; the container-contents lane re-arms document sync once\n * the container lands. An unknown or unqueryable container resolves false so\n * store-level consumers without container persistence keep creating eagerly.\n */\nexport async function isContainerAwaitingRemoteCreate(\n state: DocumentStoreState,\n): Promise<boolean> {\n const containerId = state.runtime.state.containerId;\n if (!containerId) {\n return false;\n }\n\n try {\n const rows = await state.runtime.infra.execSql(\n \"SELECT server_created_at FROM containers WHERE id = :containerId\",\n { \":containerId\": containerId },\n );\n const row = rows[0];\n return row !== undefined && Reflect.get(row, \"server_created_at\") == null;\n } catch {\n return false;\n }\n}\n\nasync function hasDurableDocumentForCreate(\n state: DocumentStoreState,\n isCurrent: () => boolean,\n): Promise<boolean> {\n // A bulk import can leave this store queued long after trash purged its\n // durable row. The persistence guard runs too late to prevent an orphaned\n // remote create, so check existence before beginning the network work.\n const record = await state.persistence.loadDocument(\n state.runtime.infra.execSql,\n state.localId,\n );\n if (!isCurrent()) return false;\n if (record) return true;\n markDocumentStoreRemoved(state);\n return false;\n}\n\nexport async function ensureRemoteDocument(\n state: DocumentStoreState,\n currentDoc: DocumentState,\n nextRecord: DocumentRecord \| null,\n encapsulationKeyPair: EncapsulationKeyPair,\n generation?: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord \| null> {\n const generationIsCurrent = () =>\n !generation \|\| isDocumentStoreSyncGenerationCurrent(state, generation);\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n if (nextRecord?.documentId) {\n return nextRecord;\n }\n\n const runtime = state.runtime;\n if (!runtime.state.containerId) {\n runtime.util.log(\n \"Documents: cannot create a remote document without a container.\",\n );\n // A local-only document with no container scope (e.g. a last-link orphan\n // from a tombstone cascade, docs/sync-edge-cases.md row 3) can never\n // create; record the stuck state durably so the write queue surfaces it\n // instead of this lane going silent on every trigger.\n await documentTerminalSubmitFailureHandler(\n state,\n generation,\n )({\n message: \"Local document has no container for its remote create\",\n status: null,\n });\n return nextRecord;\n }\n\n const author = resolveDocumentCreateAuthor(runtime);\n if (!author) {\n runtime.util.log(\n \"Documents: skipped remote create because the writer context is unavailable.\",\n );\n return nextRecord;\n }\n\n const documentId =\n nextRecord?.recoveryDocumentId ??\n (await deriveStableDocumentId(state.localId));\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n if (!(await hasDurableDocumentForCreate(state, generationIsCurrent)))\n return state.record;\n\n const writerProjectionGeneration = state.writerProjectionGeneration;\n const created = await createRemoteDocument({\n apiClient: runtime.apiClient,\n author,\n containerId: runtime.state.containerId,\n // Derive the remote id from the stable local id so a retry after a lost\n // create response re-sends the same id and adopts the existing remote\n // document instead of creating a duplicate.\n documentId,\n execSql: runtime.infra.execSql,\n isRemoteSyncBlocked: runtime.util.isRemoteSyncBlocked,\n onTerminalSubmitFailure: documentTerminalSubmitFailureHandler(\n state,\n generation,\n ),\n resolveProjectionUserKey: state.resolveProjectionUserKey,\n stillCurrent: generationIsCurrent,\n targetSecretKey: encapsulationKeyPair.secretKey,\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n });\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n if (!created) {\n return nextRecord;\n }\n\n return chainIdentityWrite(state, async () => {\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n // A concurrent relink (e.g. live duplicate-facade resolution) may have\n // assigned this store a different remote identity while the create round\n // trip was in flight. That identity wins: persisting the created one here\n // would clobber the relink. The just-created remote document is left an\n // orphan, the same benign outcome as a lost create response.\n const liveDocumentId = state.record?.documentId;\n if (liveDocumentId && liveDocumentId !== created.documentId) {\n return state.record;\n }\n\n runtime.util.log(`Created document: ${created.documentId}`);\n installDocumentWriterProjection(\n state,\n created.writerProjection,\n writerProjectionGeneration,\n );\n\n // This persist is a remote-identity write (documentId + content keys), not a\n // content change. It runs after a network round trip, during which the user\n // may have kept typing into a brand-new note. The Loro doc is mutated\n // asynchronously on the write chain, so it can lag the optimistic snapshot;\n // re-deriving text/structured fields from the doc here would republish that\n // stale read over the live editor value and drop the just-typed characters\n // (the new-note \"type immediately\" race). Preserve the optimistic snapshot —\n // documentId/keys still propagate via state.record, independent of the\n // snapshot text — matching finalizeDocumentSync and the keystroke writes.\n const persistPatch = { ...created.persistedState };\n const persistOptions = {\n preserveSnapshotStructuredFields: true,\n preserveSnapshotText: true,\n };\n const persisted = await persistDocument(\n state,\n currentDoc,\n persistPatch,\n persistOptions,\n generation,\n );\n return persisted?.record ?? state.record ?? nextRecord;\n });\n}\n"]}
1	+ {"version":3,"file":"syncShared.js","sourceRoot":"","sources":["syncShared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAGlB,mCAAmC,EACnC,iCAAiC,EAEjC,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gEAAgE,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAIL,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAyB,EACzB,UAAwC;IAExC,OAAO,0BAA0B,CAAC;QAChC,eAAe,EAAE,mCAAmC;QACpD,UAAU;QACV,KAAK;QACL,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAyB,EACzB,UAAwC;IAExC,OAAO,0BAA0B,CAAC;QAChC,eAAe,EAAE,iCAAiC;QAClD,UAAU;QACV,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6CAA6C,CAC3D,KAAyB,EACzB,UAAwC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;QAC7C,UAAU;QACV,KAAK;KACN,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAyC,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC;YACxE,OAAO;QACT,4BAA4B,CAC1B,UAAU,EAAE,UAAU,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAC5C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAC3B,OAAO,CACR,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAQnC;IACC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,KAAK,EAAE,OAGb,EAAE,EAAE;QACH,IAAI,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,wBAAwB,CAC5B,UAAU,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAClD,KAAK,EAAE,aAAa,EAAE,EAAE;YACtB,IACE,UAAU;gBACV,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EACxD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,aAAa,EACb,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACvD;gBACE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC;gBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAAC,MAAsB;IACjE,OAAO,CACL,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAChC,MAAM,CAAC,kBAAkB,KAAK,IAAI;QAClC,MAAM,CAAC,sBAAsB,KAAK,IAAI,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAIpD;IACC,OAAO,CACL,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,IAAI;QACrC,CAAC,KAAK,CAAC,aAAa,CAAC,gCAAgC;QACrD,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB;QAChC,mCAAmC,CAAC,KAAK,CAAC,aAAa,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAyB;IAEzB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5C,kEAAkE,EAClE,EAAE,cAAc,EAAE,WAAW,EAAE,CAChC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyB,EACzB,SAAwB;IAExB,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAyB,EACzB,UAAyB,EACzB,UAAiC,EACjC,oBAA0C,EAC1C,UAAwC;IAExC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,UAAU,IAAI,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAE9D,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,iEAAiE,CAClE,CAAC;QACF,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,oCAAoC,CACxC,KAAK,EACL,UAAU,CACX,CAAC;YACA,OAAO,EAAE,uDAAuD;YAChE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,6EAA6E,CAC9E,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GACd,UAAU,EAAE,kBAAkB;QAC9B,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEtB,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;QACtC,wEAAwE;QACxE,sEAAsE;QACtE,4CAA4C;QAC5C,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB;QACrD,uBAAuB,EAAE,oCAAoC,CAC3D,KAAK,EACL,UAAU,CACX;QACD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,mBAAmB;QACjC,eAAe,EAAE,oBAAoB,CAAC,SAAS;QAC/C,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,mBAAmB,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;QAE9D,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;QAChD,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5D,+BAA+B,CAC7B,KAAK,EACL,OAAO,CAAC,gBAAgB,EACxB,0BAA0B,CAC3B,CAAC;QAEF,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG;YACrB,gCAAgC,EAAE,IAAI;YACtC,oBAAoB,EAAE,IAAI;SAC3B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,KAAK,EACL,UAAU,EACV,YAAY,EACZ,cAAc,EACd,UAAU,CACX,CAAC;QACF,OAAO,SAAS,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { deriveStableDocumentId } from \"../../../data/documents/shared/stableDocumentId\";\nimport {\n createRemoteDocument,\n DOCUMENTS_APP_KIND,\n type DocumentRecord,\n type DocumentSyncUpdateIsolationError,\n describeDocumentRevalidationFailure,\n describeDocumentSyncSubmitFailure,\n type PendingUpdateRecord,\n recordDocumentSyncFailure,\n resolveDocumentCreateAuthor,\n runSerializedSqlMutation,\n} from \"../../../workflows/documents\";\nimport { reportDocumentSyncQuarantine } from \"../../../workflows/documents/sync/reportDocumentSyncQuarantine\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../workflows/principals/runtimePolicyWarmer\";\nimport { chainIdentityWrite } from \"./identityWriteChain\";\nimport { persistDocument } from \"./persistence\";\nimport {\n type DocumentState,\n type DocumentStoreState,\n type EncapsulationKeyPair,\n markDocumentStoreRemoved,\n} from \"./state\";\nimport {\n type DocumentStoreSyncGeneration,\n isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { installDocumentWriterProjection } from \"./writerProjectionGeneration\";\n\n/*\n Record a refused read-only revalidation on this document's failure row, so\n * a document that can never refresh stops failing silently (edge-case row\n * 13). 403s stay suppressed on purpose — a read-only 403 must never flag\n * unattempted local edits (row 9) — and the row clears on the next clean\n * pass like every other sync failure.\n /\nexport function documentRevalidationFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n return documentSyncFailureHandler({\n describeFailure: describeDocumentRevalidationFailure,\n generation,\n state,\n suppressForbidden: true,\n });\n}\n\n/\n Record a terminal submit failure on this document's write-queue row. Shared\n * by every store pass that can submit queued writes (create and sync), so\n * re-key exhaustion and denial failures surface no matter which pass hits\n * them first.\n /\nexport function documentTerminalSubmitFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n return documentSyncFailureHandler({\n describeFailure: describeDocumentSyncSubmitFailure,\n generation,\n state,\n });\n}\n\n/* Persist quarantine and report its Error through the host's diagnostics. /\nexport function documentIncomingUpdateIsolationFailureHandler(\n state: DocumentStoreState,\n generation?: DocumentStoreSyncGeneration,\n) {\n const recordFailure = documentSyncFailureHandler({\n describeFailure: (failure) => failure.message,\n generation,\n state,\n });\n return async (failure: DocumentSyncUpdateIsolationError) => {\n await recordFailure({ message: failure.message, status: null });\n if (generation && !isDocumentStoreSyncGenerationCurrent(state, generation))\n return;\n reportDocumentSyncQuarantine(\n generation?.currentDoc ?? state.doc ?? state,\n state.runtime.util.logError,\n failure,\n );\n };\n}\n\n/\n The generation recheck runs INSIDE the serialized mutation (like the\n * attachment failure path): a teardown (discard/reset) that wins the ordering\n * deletes this document's rows first and invalidates the generation, so a\n * stale handler can never resurrect a deleted or orphan failure row\n * afterwards.\n /\nfunction documentSyncFailureHandler(input: {\n describeFailure: (failure: {\n readonly message: string;\n readonly status: number \| null;\n }) => string;\n generation: DocumentStoreSyncGeneration \| undefined;\n state: DocumentStoreState;\n suppressForbidden?: boolean;\n}) {\n const { generation, state } = input;\n return async (failure: {\n readonly message: string;\n readonly status: number \| null;\n }) => {\n if (input.suppressForbidden && failure.status === 403) {\n return;\n }\n\n await runSerializedSqlMutation(\n generation?.execSql ?? state.runtime.infra.execSql,\n async (lockedExecSql) => {\n if (\n generation &&\n !isDocumentStoreSyncGenerationCurrent(state, generation)\n ) {\n return;\n }\n await recordDocumentSyncFailure(\n lockedExecSql,\n { appKind: DOCUMENTS_APP_KIND, localId: state.localId },\n {\n attemptedAt: new Date().toISOString(),\n message: input.describeFailure(failure),\n status: failure.status,\n },\n );\n },\n );\n };\n}\n\nfunction hasPersistedRemoteDocumentSyncState(record: DocumentRecord): boolean {\n return (\n record.lastCommitLsn !== null &&\n record.contentKeyBundle !== null &&\n record.documentKekTargets !== null &&\n record.documentManifestBundle !== null\n );\n}\n\nexport function shouldSkipCleanScheduledDocumentSync(input: {\n currentRecord: DocumentRecord;\n pendingUpdates: readonly PendingUpdateRecord[];\n state: DocumentStoreState;\n}): boolean {\n return (\n input.pendingUpdates.length === 0 &&\n input.state.pendingAttachments.length === 0 &&\n input.state.pullContinuation === null &&\n !input.currentRecord.pullContinuationRecoveryRequired &&\n !input.state.remoteUpdatePending &&\n hasPersistedRemoteDocumentSyncState(input.currentRecord)\n );\n}\n\n/\n True when the store's container exists locally but has not been created on\n * the server yet (its own create intent is still pending). Creating a document\n * inside it would 404 on the container writer projection and surface a\n * spurious sync error; the container-contents lane re-arms document sync once\n * the container lands. An unknown or unqueryable container resolves false so\n * store-level consumers without container persistence keep creating eagerly.\n */\nexport async function isContainerAwaitingRemoteCreate(\n state: DocumentStoreState,\n): Promise<boolean> {\n const containerId = state.runtime.state.containerId;\n if (!containerId) {\n return false;\n }\n\n try {\n const rows = await state.runtime.infra.execSql(\n \"SELECT server_created_at FROM containers WHERE id = :containerId\",\n { \":containerId\": containerId },\n );\n const row = rows[0];\n return row !== undefined && Reflect.get(row, \"server_created_at\") == null;\n } catch {\n return false;\n }\n}\n\nasync function hasDurableDocumentForCreate(\n state: DocumentStoreState,\n isCurrent: () => boolean,\n): Promise<boolean> {\n // A bulk import can leave this store queued long after trash purged its\n // durable row. The persistence guard runs too late to prevent an orphaned\n // remote create, so check existence before beginning the network work.\n const record = await state.persistence.loadDocument(\n state.runtime.infra.execSql,\n state.localId,\n );\n if (!isCurrent()) return false;\n if (record) return true;\n markDocumentStoreRemoved(state);\n return false;\n}\n\nexport async function ensureRemoteDocument(\n state: DocumentStoreState,\n currentDoc: DocumentState,\n nextRecord: DocumentRecord \| null,\n encapsulationKeyPair: EncapsulationKeyPair,\n generation?: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord \| null> {\n const generationIsCurrent = () =>\n !generation \|\| isDocumentStoreSyncGenerationCurrent(state, generation);\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n if (nextRecord?.documentId) {\n return nextRecord;\n }\n\n const runtime = state.runtime;\n if (!runtime.state.containerId) {\n runtime.util.log(\n \"Documents: cannot create a remote document without a container.\",\n );\n // A local-only document with no container scope (e.g. a last-link orphan\n // from a tombstone cascade, docs/sync-edge-cases.md row 3) can never\n // create; record the stuck state durably so the write queue surfaces it\n // instead of this lane going silent on every trigger.\n await documentTerminalSubmitFailureHandler(\n state,\n generation,\n )({\n message: \"Local document has no container for its remote create\",\n status: null,\n });\n return nextRecord;\n }\n\n const author = resolveDocumentCreateAuthor(runtime);\n if (!author) {\n runtime.util.log(\n \"Documents: skipped remote create because the writer context is unavailable.\",\n );\n return nextRecord;\n }\n\n const documentId =\n nextRecord?.recoveryDocumentId ??\n (await deriveStableDocumentId(state.localId));\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n if (!(await hasDurableDocumentForCreate(state, generationIsCurrent)))\n return state.record;\n\n const writerProjectionGeneration = state.writerProjectionGeneration;\n const created = await createRemoteDocument({\n apiClient: runtime.apiClient,\n author,\n containerId: runtime.state.containerId,\n // Derive the remote id from the stable local id so a retry after a lost\n // create response re-sends the same id and adopts the existing remote\n // document instead of creating a duplicate.\n documentId,\n execSql: runtime.infra.execSql,\n isRemoteSyncBlocked: runtime.util.isRemoteSyncBlocked,\n onTerminalSubmitFailure: documentTerminalSubmitFailureHandler(\n state,\n generation,\n ),\n resolveProjectionUserKey: state.resolveProjectionUserKey,\n stillCurrent: generationIsCurrent,\n targetSecretKey: encapsulationKeyPair.secretKey,\n warmReferencedPrincipalPolicies:\n createRuntimePrincipalPolicyWarmer(runtime),\n });\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n if (!created) {\n return nextRecord;\n }\n\n return chainIdentityWrite(state, async () => {\n if (!generationIsCurrent()) return state.record ?? nextRecord;\n\n // A concurrent relink (e.g. live duplicate-facade resolution) may have\n // assigned this store a different remote identity while the create round\n // trip was in flight. That identity wins: persisting the created one here\n // would clobber the relink. The just-created remote document is left an\n // orphan, the same benign outcome as a lost create response.\n const liveDocumentId = state.record?.documentId;\n if (liveDocumentId && liveDocumentId !== created.documentId) {\n return state.record;\n }\n\n runtime.util.log(`Created document: ${created.documentId}`);\n installDocumentWriterProjection(\n state,\n created.writerProjection,\n writerProjectionGeneration,\n );\n\n // This persist is a remote-identity write (documentId + content keys), not a\n // content change. It runs after a network round trip, during which the user\n // may have kept typing into a brand-new note. The Loro doc is mutated\n // asynchronously on the write chain, so it can lag the optimistic snapshot;\n // re-deriving text/structured fields from the doc here would republish that\n // stale read over the live editor value and drop the just-typed characters\n // (the new-note \"type immediately\" race). Preserve the optimistic snapshot —\n // documentId/keys still propagate via state.record, independent of the\n // snapshot text — matching finalizeDocumentSync and the keystroke writes.\n const persistPatch = { ...created.persistedState };\n const persistOptions = {\n preserveSnapshotStructuredFields: true,\n preserveSnapshotText: true,\n };\n const persisted = await persistDocument(\n state,\n currentDoc,\n persistPatch,\n persistOptions,\n generation,\n );\n return persisted?.record ?? state.record ?? nextRecord;\n });\n}\n"]}

package/workflows/blobs/detach.js CHANGED Viewed

@@ -4,7 +4,7 @@ import { authorizingContainerPathRefs } from "../../data/documents/shared/projec
 import { readCanonicalRecord } from "../../data/keying/canonicalJson.js";
 import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { resolveBlobMutationWriterProjection } from "./writerProjection.js";
+import { resolveBlobMutationWriterProjection } from "./verification/writerProjection.js";
 export async function detachDocumentAttachment({ apiClient, author, bindingId, blobId, documentId, eventId = crypto.randomUUID(), execSql, isRemoteSyncBlocked, resolveProjectionUserKey, signedAt = new Date().toISOString(), slotId, stillCurrent, warmReferencedPrincipalPolicies, writerProjection, }) {
     const resolved = await resolveBlobMutationWriterProjection({
         apiClient,

package/workflows/blobs/detach.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAKhG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,~~oBAAoB~~,CAAC;~~AAEzE~~,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAElD,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/documents/blob/shared/events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/documents/blob/shared/responses\";\nimport type {\n DetachDocumentAttachmentInput,\n DetachDocumentAttachmentResult,\n} from \"../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { resolveBlobMutationWriterProjection } from \"./writerProjection\";\n\nexport async function detachDocumentAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n isRemoteSyncBlocked,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient,\n documentId,\n errorLabel: \"Blob attachment detach\",\n execSql,\n isRemoteSyncBlocked,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment detach\",\n ),\n writerProjection,\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n resolved;\n\n const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n const { body, event } = await signBlobAttachmentDetachEvent({\n author,\n bindingId,\n blobId,\n documentId,\n eventId,\n manifestIdentity,\n signedAt,\n slotId,\n authorizingContainerPathRefs: pathRefs,\n });\n const request: BlobAttachmentDetachRequest = {\n event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n authorizingContainerPathRefs: pathRefs,\n };\n assertProjectionVerificationCurrent(stillCurrent);\n const response = await apiClient.detachBlobAttachment(\n blobId,\n bindingId,\n request,\n {\n expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n assertProjectionVerificationCurrent(stillCurrent);\n\n assertBlobAttachmentDetachResponse({\n bindingId,\n blobId,\n documentId,\n response,\n slotId,\n });\n\n return {\n request,\n response,\n writerProjection: resolvedWriterProjection,\n };\n}\n"]}
1	+ {"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAKhG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAElD,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/documents/blob/shared/events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/documents/blob/shared/responses\";\nimport type {\n DetachDocumentAttachmentInput,\n DetachDocumentAttachmentResult,\n} from \"../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { resolveBlobMutationWriterProjection } from \"./verification/writerProjection\";\n\nexport async function detachDocumentAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n isRemoteSyncBlocked,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient,\n documentId,\n errorLabel: \"Blob attachment detach\",\n execSql,\n isRemoteSyncBlocked,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment detach\",\n ),\n writerProjection,\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n resolved;\n\n const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n const { body, event } = await signBlobAttachmentDetachEvent({\n author,\n bindingId,\n blobId,\n documentId,\n eventId,\n manifestIdentity,\n signedAt,\n slotId,\n authorizingContainerPathRefs: pathRefs,\n });\n const request: BlobAttachmentDetachRequest = {\n event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n authorizingContainerPathRefs: pathRefs,\n };\n assertProjectionVerificationCurrent(stillCurrent);\n const response = await apiClient.detachBlobAttachment(\n blobId,\n bindingId,\n request,\n {\n expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n assertProjectionVerificationCurrent(stillCurrent);\n\n assertBlobAttachmentDetachResponse({\n bindingId,\n blobId,\n documentId,\n response,\n slotId,\n });\n\n return {\n request,\n response,\n writerProjection: resolvedWriterProjection,\n };\n}\n"]}

package/workflows/blobs/{blobChunkDecryption.js → hydration/blobChunkDecryption.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { deriveBlobChunkIv } from "../../internal/crypto/index.js";
-import { contentRecordAdditionalDataBytes } from "../../data/documents/blob/shared/crypto.js";
-import { asWebCryptoBytes } from "../../data/documents/shared/readers.js";
+import { deriveBlobChunkIv } from "../../../internal/crypto/index.js";
+import { contentRecordAdditionalDataBytes } from "../../../data/documents/blob/shared/crypto.js";
+import { asWebCryptoBytes } from "../../../data/documents/shared/readers.js";
 export async function decryptBlobChunk(input) {
     const { encrypted, expectedBlobId, organizationId, recordKey, chunk } = input;
     const plaintext = new Uint8Array(await crypto.subtle.decrypt({

package/workflows/blobs/hydration/blobChunkDecryption.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"blobChunkDecryption.js","sourceRoot":"","sources":["blobChunkDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAM9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAS1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAEC;IAED,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;QAChD,cAAc,EAAE,gCAAgC,CAAC;YAC/C,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,wBAAwB,EAAE,KAAK,CAAC,mBAAmB;YACnD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,cAAc;YACd,mBAAmB,EAAE,SAAS,CAAC,UAAU;SAC1C,CAAC;KACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CACnC,CACF,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,mBAAmB;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAEC;IAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,SAAS,CAAC,GAAG,CACX,MAAM,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC3C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { deriveBlobChunkIv } from \"@tearleads/crypto\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport { contentRecordAdditionalDataBytes } from \"../../../data/documents/blob/shared/crypto\";\nimport type {\n BlobEncryptedBytesHeader,\n BlobEncryptedBytesRecord,\n BlobEncryptedChunk,\n} from \"../../../data/documents/blob/shared/types\";\nimport { asWebCryptoBytes } from \"../../../data/documents/shared/readers\";\n\ninterface BlobChunkDecryption {\n encrypted: BlobEncryptedBytesHeader;\n expectedBlobId: string;\n organizationId: string;\n recordKey: CryptoKey;\n}\n\nexport async function decryptBlobChunk(\n input: BlobChunkDecryption & {\n chunk: BlobEncryptedChunk;\n },\n): Promise<BlobBytes> {\n const { encrypted, expectedBlobId, organizationId, recordKey, chunk } = input;\n const plaintext = new Uint8Array(\n await crypto.subtle.decrypt(\n {\n name: \"AES-GCM\",\n iv: deriveBlobChunkIv(encrypted.iv, chunk.index),\n additionalData: contentRecordAdditionalDataBytes({\n blobId: expectedBlobId,\n chunkCount: encrypted.chunkCount,\n chunkIndex: chunk.index,\n chunkPlaintextByteLength: chunk.plaintextByteLength,\n chunkSize: encrypted.chunkSize,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n contentRecordId: encrypted.contentRecordId,\n metadataHash: encrypted.metadataHash,\n nonceDomainHash: encrypted.nonceDomainHash,\n organizationId,\n plaintextByteLength: encrypted.byteLength,\n }),\n },\n recordKey,\n asWebCryptoBytes(chunk.ciphertext),\n ),\n );\n if (plaintext.byteLength !== chunk.plaintextByteLength)\n throw new Error(\"Blob decrypted chunk byte length mismatch\");\n return plaintext;\n}\n\nexport async function decryptBlobChunks(\n input: Omit<BlobChunkDecryption, \"encrypted\"> & {\n encrypted: BlobEncryptedBytesRecord;\n },\n): Promise<BlobBytes> {\n const decrypted = new Uint8Array(input.encrypted.byteLength);\n for (const chunk of input.encrypted.chunks) {\n decrypted.set(\n await decryptBlobChunk({ ...input, chunk }),\n chunk.index * input.encrypted.chunkSize,\n );\n }\n return decrypted;\n}\n"]}

package/workflows/blobs/{decrypt.d.ts → hydration/decrypt.d.ts} RENAMED Viewed

@@ -1,5 +1,5 @@
-import type { BlobBytes } from "../../data/blobs/blobContracts.js";
-import type { BlobEncryptedBytesHeader, DecryptDocumentAttachmentBlobInput } from "../../data/documents/blob/shared/types.js";
+import type { BlobBytes } from "../../../data/blobs/blobContracts.js";
+import type { BlobEncryptedBytesHeader, DecryptDocumentAttachmentBlobInput } from "../../../data/documents/blob/shared/types.js";
 export type AttachmentBlobDecryptionInput = Omit<DecryptDocumentAttachmentBlobInput, "encryptedBytes"> & {
     encrypted: BlobEncryptedBytesHeader;
 };