@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/initialSync.js

@@ -1,65 +0,0 @@
-import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
-import { importContentKeyMaterial } from "../../data/documents/shared/contentRecordKeys.js";
-import { encryptDocumentPendingUpdate } from "../../data/documents/shared/crypto.js";
-import { containerPathRefs } from "../../data/documents/shared/projection.js";
-import { signDocumentOutgoingUpdate } from "./syncPlanIdentity.js";
-/**
- * Builds the single encrypted initial write for a provisioned document. The
- * server commits it with the organization and document manifest transaction.
- */
-export async function buildInitialDocumentSyncRequest(input) {
-    const pendingFields = createPendingUpdateFields(input.initialUpdate);
-    if (!pendingFields) {
-        throw new Error("Initial document sync update is empty");
-    }
-    const documentId = input.materializedDocument.plan.documentId;
-    const contentKeyBundle = input.materializedDocument.plan.request.contentKeyBundle;
-    const pendingUpdate = {
-        id: crypto.randomUUID(),
-        ...pendingFields,
-    };
-    const encrypted = await encryptDocumentPendingUpdate({
-        contentKeyMaterial: await importContentKeyMaterial(input.materializedDocument.contentKey),
-        contentKeyEpoch: contentKeyBundle.contentKeyEpoch,
-        documentId,
-        organizationId: input.containerProjection.organizationId,
-        update: pendingUpdate,
-    });
-    const outgoingUpdate = await signDocumentOutgoingUpdate({
-        authorizingContainerPathRefs: [
-            containerPathRefs(input.containerProjection.path),
-        ],
-        author: input.author,
-        contentKeyEpoch: contentKeyBundle.contentKeyEpoch,
-        documentId,
-        expectedLinkSetManifestHash: contentKeyBundle.linkSetManifestHash,
-        expectedTargetHash: contentKeyBundle.targetHash,
-        organizationId: input.containerProjection.organizationId,
-        signedAt: new Date().toISOString(),
-        update: {
-            contentRecordId: encrypted.contentRecordId,
-            encryptedData: encrypted.encryptedData,
-            id: pendingUpdate.id,
-            partialEndVersionVector: pendingUpdate.partialEndVersionVector,
-            partialStartVersionVector: pendingUpdate.partialStartVersionVector,
-            metadataHash: encrypted.metadataHash,
-            ciphertextHash: encrypted.ciphertextHash,
-            plaintextHash: encrypted.plaintextHash,
-        },
-    });
-    return {
-        authorizingContainerPathRefs: [
-            containerPathRefs(input.containerProjection.path),
-        ],
-        contentKeyBundle,
-        contentKeyEpoch: contentKeyBundle.contentKeyEpoch,
-        expectedLinkSetManifestHash: contentKeyBundle.linkSetManifestHash,
-        expectedTargetHash: contentKeyBundle.targetHash,
-        // The provisioning device already holds this exact initialized snapshot,
-        // so it does not need the transaction response to echo the update back.
-        localVersionVector: pendingUpdate.partialEndVersionVector,
-        outgoingUpdates: [outgoingUpdate],
-        supportsPullPagination: true,
-    };
-}
-//# sourceMappingURL=initialSync.js.map

package/workflows/documents/initialSync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"initialSync.js","sourceRoot":"","sources":["initialSync.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAM3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAKrD;IACC,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9D,MAAM,gBAAgB,GACpB,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3D,MAAM,aAAa,GAAwB;QACzC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,MAAM,wBAAwB,CAChD,KAAK,CAAC,oBAAoB,CAAC,UAAU,CACtC;QACD,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,UAAU;QACV,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;QACxD,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC;QACtD,4BAA4B,EAAE;YAC5B,iBAAiB,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAClD;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,UAAU;QACV,2BAA2B,EAAE,gBAAgB,CAAC,mBAAmB;QACjE,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;QAC/C,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;QACxD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE;YACN,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,uBAAuB,EAAE,aAAa,CAAC,uBAAuB;YAC9D,yBAAyB,EAAE,aAAa,CAAC,yBAAyB;YAClE,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,aAAa,EAAE,SAAS,CAAC,aAAa;SACvC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,4BAA4B,EAAE;YAC5B,iBAAiB,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAClD;QACD,gBAAgB;QAChB,eAAe,EAAE,gBAAgB,CAAC,eAAe;QACjD,2BAA2B,EAAE,gBAAgB,CAAC,mBAAmB;QACjE,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;QAC/C,yEAAyE;QACzE,wEAAwE;QACxE,kBAAkB,EAAE,aAAa,CAAC,uBAAuB;QACzD,eAAe,EAAE,CAAC,cAAc,CAAC;QACjC,sBAAsB,EAAE,IAAI;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentSyncRequest } from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { createPendingUpdateFields } from \"../../data/documents/documentSync\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { encryptDocumentPendingUpdate } from \"../../data/documents/shared/crypto\";\nimport { containerPathRefs } from \"../../data/documents/shared/projection\";\nimport type {\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n} from \"../../data/documents/shared/types\";\nimport type { PendingUpdateRecord } from \"../../data/sqlite/documentPersistence\";\nimport { signDocumentOutgoingUpdate } from \"./syncPlanIdentity\";\n\n/**\n * Builds the single encrypted initial write for a provisioned document. The\n * server commits it with the organization and document manifest transaction.\n */\nexport async function buildInitialDocumentSyncRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly containerProjection: ContainerWriterProjectionResponse;\n  readonly initialUpdate: Uint8Array;\n  readonly materializedDocument: MaterializedDocumentCreatePlan;\n}): Promise<DocumentSyncRequest> {\n  const pendingFields = createPendingUpdateFields(input.initialUpdate);\n  if (!pendingFields) {\n    throw new Error(\"Initial document sync update is empty\");\n  }\n\n  const documentId = input.materializedDocument.plan.documentId;\n  const contentKeyBundle =\n    input.materializedDocument.plan.request.contentKeyBundle;\n  const pendingUpdate: PendingUpdateRecord = {\n    id: crypto.randomUUID(),\n    ...pendingFields,\n  };\n  const encrypted = await encryptDocumentPendingUpdate({\n    contentKeyMaterial: await importContentKeyMaterial(\n      input.materializedDocument.contentKey,\n    ),\n    contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n    documentId,\n    organizationId: input.containerProjection.organizationId,\n    update: pendingUpdate,\n  });\n  const outgoingUpdate = await signDocumentOutgoingUpdate({\n    authorizingContainerPathRefs: [\n      containerPathRefs(input.containerProjection.path),\n    ],\n    author: input.author,\n    contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n    documentId,\n    expectedLinkSetManifestHash: contentKeyBundle.linkSetManifestHash,\n    expectedTargetHash: contentKeyBundle.targetHash,\n    organizationId: input.containerProjection.organizationId,\n    signedAt: new Date().toISOString(),\n    update: {\n      contentRecordId: encrypted.contentRecordId,\n      encryptedData: encrypted.encryptedData,\n      id: pendingUpdate.id,\n      partialEndVersionVector: pendingUpdate.partialEndVersionVector,\n      partialStartVersionVector: pendingUpdate.partialStartVersionVector,\n      metadataHash: encrypted.metadataHash,\n      ciphertextHash: encrypted.ciphertextHash,\n      plaintextHash: encrypted.plaintextHash,\n    },\n  });\n\n  return {\n    authorizingContainerPathRefs: [\n      containerPathRefs(input.containerProjection.path),\n    ],\n    contentKeyBundle,\n    contentKeyEpoch: contentKeyBundle.contentKeyEpoch,\n    expectedLinkSetManifestHash: contentKeyBundle.linkSetManifestHash,\n    expectedTargetHash: contentKeyBundle.targetHash,\n    // The provisioning device already holds this exact initialized snapshot,\n    // so it does not need the transaction response to echo the update back.\n    localVersionVector: pendingUpdate.partialEndVersionVector,\n    outgoingUpdates: [outgoingUpdate],\n    supportsPullPagination: true,\n  };\n}\n"]}

package/workflows/documents/linkSet.d.ts

@@ -1,20 +0,0 @@
-import { type DocumentContentKeyTarget } from "../../internal/crypto/index.js";
-import type { ContainerWriterProjectionResponse, DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import { type BuildDocumentLinkSetMutationPlanInput, type DocumentCreateAuthor, type DocumentLinkSetMutationOperation, type MaterializedDocumentLinkSetMutationPlan, type ProjectionVerificationOptions } from "../../data/documents/shared/types.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import { type SubtreePurgeRoot } from "./subtreePurgeScope.js";
-export declare function assertDocumentLinkTargetCapacity(currentTargetCount: number): void;
-export declare function assertDocumentLinkAuthorizationPathCapacity(currentPathLengths: readonly number[], targetPathLength: number): void;
-export declare function buildMaterializedDocumentLinkSetMutationPlan(input: {
-    author: DocumentCreateAuthor;
-    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    prepareBlobRewraps: (targets: readonly DocumentContentKeyTarget[]) => Promise<BuildDocumentLinkSetMutationPlanInput["blobRewraps"]>;
-    contentKey?: Uint8Array | undefined;
-    eventId?: string | undefined;
-    execSql?: ExecSql | undefined;
-    operation: DocumentLinkSetMutationOperation;
-    signedAt?: string | undefined;
-    targetContainerProjection: ContainerWriterProjectionResponse;
-    targetSecretKey: Uint8Array;
-    writerProjection: DocumentWriterProjectionResponse;
-} & ProjectionVerificationOptions): Promise<MaterializedDocumentLinkSetMutationPlan>;

package/workflows/documents/linkSet.js

@@ -1,290 +0,0 @@
-import { computeAccessManifestHash, computeDocumentContentKeyTargetHash, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveDocumentLinkSetManifest, wrapContentKey, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { isPlainObject as isPlainRecord } from "../../internal/validators/isPlainObject.js";
-import { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, } from "../../internal/validators/util/index.js";
-import { assertContainerKekPathCurrent, assertDocumentKekPathsCurrent, } from "../../data/documents/shared/containerKekCurrency.js";
-import { buildDocumentLinkSetEventPlan } from "../../data/documents/shared/events.js";
-import { assertDocumentWriterProjectionConsistent, collectContainerKeksForDocumentSync, containerPathRefs, currentDocumentTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, unwrapContainerKekPath, unwrapDocumentContentKeyFromWriterProjection, verifiedDocumentWrapTargets, } from "../../data/documents/shared/projection.js";
-import { assertDocumentManifestBundleConsistent, describeDocumentTargetKek, sortDocumentTargets, targetKey, uniqueSortedStrings, } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions, } from "../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../data/keying/canonicalJson.js";
-import { assertDocumentLinkAuthorAccess, verifyDocumentLinkSetCurrentPolicies, } from "./linkSetAuthority.js";
-import { assertSubtreePurgePath, } from "./subtreePurgeScope.js";
-function deriveDocumentLinkSetTargetState(input) {
-    const currentTargets = currentDocumentTargets(input.writerProjection);
-    const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
-    const target = deriveDocumentTargetFromProjection(input.targetContainerProjection);
-    const currentTarget = currentTargets.find((candidate) => candidate.containerId === target.containerId);
-    if (input.operation === "link") {
-        if (currentTarget) {
-            throw new Error("Document link target is already linked");
-        }
-        assertDocumentLinkTargetCapacity(currentTargets.length);
-        assertDocumentLinkAuthorizationPathCapacity(input.writerProjection.authorizingContainerPaths.map((projection) => projection.path.length), input.targetContainerProjection.path.length);
-        return {
-            currentTargets,
-            linkedContainerIds: uniqueSortedStrings([
-                ...currentLinkedContainerIds,
-                target.containerId,
-            ]),
-            target,
-            targets: sortDocumentTargets([...currentTargets, target]),
-        };
-    }
-    if (!currentTarget) {
-        throw new Error("Document unlink target is not linked");
-    }
-    if (targetKey(currentTarget) !== targetKey(target)) {
-        throw new Error("Document unlink target projection is stale");
-    }
-    const linkedContainerIds = currentLinkedContainerIds.filter((containerId) => containerId !== target.containerId);
-    if (linkedContainerIds.length === 0) {
-        throw new Error("Document unlink must leave a linked container");
-    }
-    return {
-        currentTargets,
-        linkedContainerIds,
-        target,
-        targets: currentTargets.filter((candidate) => candidate.containerId !== target.containerId),
-    };
-}
-export function assertDocumentLinkTargetCapacity(currentTargetCount) {
-    if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {
-        throw new RangeError(`A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`);
-    }
-}
-export function assertDocumentLinkAuthorizationPathCapacity(currentPathLengths, targetPathLength) {
-    const totalReferences = currentPathLengths.reduce((total, length) => total + length, targetPathLength);
-    if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {
-        throw new RangeError(`Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`);
-    }
-}
-async function wrapDocumentContentKeyForTargets(input) {
-    return Promise.all(sortDocumentTargets(input.targets).map(async (target) => {
-        const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);
-        if (!targetKek) {
-            throw new Error(`Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`);
-        }
-        const wrapped = await wrapContentKey(input.contentKey, targetKek, {
-            kind: "Document",
-            objectId: input.documentId,
-            contentKeyEpoch: input.contentKeyEpoch,
-            containerId: target.containerId,
-            containerKeyEpochId: target.containerKeyEpochId,
-        });
-        return {
-            ...target,
-            wrappedKey: bytesToBase64(wrapped.ciphertext),
-            wrappingMetadata: {
-                suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,
-                iv: bytesToBase64(wrapped.iv),
-            },
-        };
-    }));
-}
-// Resolve the organization a link/unlink mutation belongs to: the document's
-// own org (from its manifest), which must equal the target container's org —
-// both are owned by the same organization. The acting member's personal org is
-// intentionally not part of this check; a member may link documents within any
-// org they belong to. Returns the document org so the plan stamps it onto the
-// signed event and manifest rather than the author's org.
-async function resolveDocumentLinkSetMutationOrganization(input) {
-    const manifestIdentity = await assertDocumentManifestBundleConsistent({
-        bundle: input.writerProjection.documentManifest,
-        label: "Document link-set manifest",
-    });
-    if (manifestIdentity.organizationId !==
-        input.targetContainerProjection.organizationId) {
-        throw new Error("Document target container organization mismatch");
-    }
-    return manifestIdentity.organizationId;
-}
-function readDocumentLinkSetPreviousEpoch(writerProjection) {
-    const previousState = writerProjection.documentManifest.state;
-    const previousEpoch = isPlainRecord(previousState)
-        ? Reflect.get(previousState, "epoch")
-        : undefined;
-    if (typeof previousEpoch !== "number" ||
-        !Number.isInteger(previousEpoch) ||
-        previousEpoch <= 0) {
-        throw new Error("Document link-set previous epoch is invalid");
-    }
-    return previousEpoch;
-}
-async function buildDocumentLinkSetMutationPlan({ author, blobRewraps, contentKeyEpoch, eventId = crypto.randomUUID(), operation, signedAt = new Date().toISOString(), targetContainerProjection, targetEnvelopes, writerProjection, }) {
-    const organizationId = await resolveDocumentLinkSetMutationOrganization({
-        targetContainerProjection,
-        writerProjection,
-    });
-    const targetState = deriveDocumentLinkSetTargetState({
-        operation,
-        targetContainerProjection,
-        writerProjection,
-    });
-    const targetEnvelopesForRequest = mergeTargetEnvelopes(targetState.targets, targetEnvelopes);
-    const targetContainerPathRefs = containerPathRefs(targetContainerProjection.path);
-    const eventPlan = await buildDocumentLinkSetEventPlan({
-        author,
-        blobRewraps,
-        eventId,
-        operation,
-        organizationId,
-        signedAt,
-        targetContainerPathRefs,
-        targetState,
-        writerProjection,
-    });
-    const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);
-    const state = {
-        version: 1,
-        documentId: writerProjection.documentId,
-        organizationId,
-        epoch: previousEpoch + 1,
-        previousManifestHash: writerProjection.documentManifest.manifestHash,
-        eventHash: eventPlan.eventHash,
-        linkedContainerIds: [...targetState.linkedContainerIds],
-    };
-    const manifest = await deriveDocumentLinkSetManifest(state);
-    const manifestHash = await computeAccessManifestHash(manifest);
-    const targetHash = await computeDocumentContentKeyTargetHash(targetState.targets);
-    return {
-        body: eventPlan.body,
-        contentKeyEpoch,
-        documentId: writerProjection.documentId,
-        event: eventPlan.event,
-        eventHash: eventPlan.eventHash,
-        manifest,
-        manifestHash,
-        operation,
-        request: {
-            event: readCanonicalRecord(eventPlan.event, "Document link-set event"),
-            body: readCanonicalRecord(eventPlan.body, "Document link-set body"),
-            expectedManifestHash: manifestHash,
-            manifest: readCanonicalRecord(manifest, "Document link-set manifest"),
-            targetContainerPathRefs,
-            authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,
-            contentKeyBundle: {
-                contentKeyEpoch,
-                linkSetManifestHash: manifestHash,
-                targetHash,
-                targets: targetEnvelopesForRequest,
-            },
-        },
-        state,
-        targetHash,
-        targets: sortDocumentTargets(targetState.targets),
-    };
-}
-export async function buildMaterializedDocumentLinkSetMutationPlan(input) {
-    const verificationOptions = projectionVerificationOptions(input);
-    const principalPolicyCache = new Map();
-    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
-        execSql: input.execSql,
-        principalPolicyCache,
-        ...verificationOptions,
-    });
-    await verifyDocumentLinkSetCurrentPolicies({
-        execSql: input.execSql,
-        principalPolicyCache,
-        targetContainerProjection: input.targetContainerProjection,
-        writerProjection: input.writerProjection,
-        ...verificationOptions,
-    });
-    assertSubtreePurgePath(input.targetContainerProjection.path, input.expectedSubtreeRoot);
-    if (input.resolveProjectionUserKey)
-        assertDocumentLinkAuthorAccess({
-            ...input,
-            principalPolicies: [...principalPolicyCache.values()],
-        });
-    const targetState = deriveDocumentLinkSetTargetState({
-        operation: input.operation,
-        targetContainerProjection: input.targetContainerProjection,
-        writerProjection: input.writerProjection,
-    });
-    assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);
-    const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({
-        execSql: input.execSql,
-        secretKey: input.targetSecretKey,
-        writerProjection: input.writerProjection,
-        ...verificationOptions,
-    });
-    const contentKeyRotated = input.operation === "unlink";
-    const contentKey = contentKeyRotated
-        ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))
-        : currentContentKey;
-    if (contentKey.byteLength !== 32) {
-        throw new Error("Document content key must be 32 bytes");
-    }
-    // A link carries the existing envelopes forward at the same epoch; an
-    // unlink rotates to a fresh key at the next one.
-    const contentKeyEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch +
-        (contentKeyRotated ? 1 : 0);
-    const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {
-        contentKey,
-        contentKeyEpoch,
-        targetState,
-    });
-    const plan = await buildDocumentLinkSetMutationPlan({
-        author: input.author,
-        blobRewraps: await input.prepareBlobRewraps(targetState.targets),
-        contentKeyEpoch,
-        eventId: input.eventId,
-        operation: input.operation,
-        signedAt: input.signedAt,
-        targetContainerProjection: input.targetContainerProjection,
-        targetEnvelopes,
-        writerProjection: input.writerProjection,
-    });
-    return {
-        contentKey,
-        contentKeyRotated,
-        plan,
-    };
-}
-async function buildLinkSetTargetEnvelopes(input, wrap) {
-    const verificationOptions = projectionVerificationOptions(input);
-    const sealing = {
-        contentKey: wrap.contentKey,
-        contentKeyEpoch: wrap.contentKeyEpoch,
-        documentId: input.writerProjection.documentId,
-    };
-    if (input.operation === "link") {
-        return [
-            ...input.writerProjection.contentKeyBundle.targets,
-            ...(await wrapDocumentContentKeyForTargets({
-                ...sealing,
-                keksByEpochId: await unwrapContainerKekPath({
-                    execSql: input.execSql,
-                    projection: input.targetContainerProjection,
-                    secretKey: input.targetSecretKey,
-                    ...verificationOptions,
-                }),
-                targets: [wrap.targetState.target],
-            })),
-        ];
-    }
-    return wrapDocumentContentKeyForTargets({
-        ...sealing,
-        keksByEpochId: (await collectContainerKeksForDocumentSync({
-            execSql: input.execSql,
-            secretKey: input.targetSecretKey,
-            writerProjection: input.writerProjection,
-            ...verificationOptions,
-        })).keksByEpochId,
-        // The rotated key is wrapped only to verified current heads of the
-        // remaining linked containers, never to a server-listed epoch.
-        targets: verifiedDocumentWrapTargets({
-            linkedContainerIds: wrap.targetState.linkedContainerIds,
-            serverTargets: wrap.targetState.targets,
-            writerProjection: input.writerProjection,
-        }),
-    });
-}
-function assertLinkSetWriteKeksCurrent(input, linkedContainerIds) {
-    // Unlink can escape a stale branch; only recipients of the successor key must be current.
-    assertDocumentKekPathsCurrent(input.writerProjection, new Set(linkedContainerIds));
-    if (input.operation === "link") {
-        assertContainerKekPathCurrent(input.targetContainerProjection.containerKeks);
-    }
-}
-//# sourceMappingURL=linkSet.js.map

package/workflows/documents/linkSet.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linkSet.js","sourceRoot":"","sources":["linkSet.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAG/B,6BAA6B,EAC7B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,sBAAsB,EACtB,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,mBAAmB,EACnB,SAAS,EACT,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAQL,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAE7B,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,yBAAyB,GAAG,0CAA0C,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxD,2CAA2C,CACzC,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAClD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CACvC,EACD,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAC5C,CAAC;QAEF,OAAO;YACL,cAAc;YACd,kBAAkB,EAAE,mBAAmB,CAAC;gBACtC,GAAG,yBAAyB;gBAC5B,MAAM,CAAC,WAAW;aACnB,CAAC;YACF,MAAM;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CACpD,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,kBAA0B;IAE1B,IAAI,kBAAkB,IAAI,qCAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,4CAA4C,qCAAqC,aAAa,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,kBAAqC,EACrC,gBAAwB;IAExB,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,EACjC,gBAAgB,CACjB,CAAC;IACF,IAAI,eAAe,GAAG,yCAAyC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,2CAA2C,yCAAyC,2BAA2B,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAM/C;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kDAAkD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;YAChE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,KAAK,UAAU,0CAA0C,CAAC,KAGzD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IACE,gBAAgB,CAAC,cAAc;QAC/B,KAAK,CAAC,yBAAyB,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,gBAAgB,CAAC,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,gCAAgC,CACvC,gBAAkD;IAElD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,EAC9C,MAAM,EACN,WAAW,EACX,eAAe,EACf,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,yBAAyB,EACzB,eAAe,EACf,gBAAgB,GACsB;IACtC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS;QACT,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,oBAAoB,CACpD,WAAW,CAAC,OAAO,EACnB,eAAe,CAChB,CAAC;IACF,MAAM,uBAAuB,GAAG,iBAAiB,CAC/C,yBAAyB,CAAC,IAAI,CAC/B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,MAAM;QACN,WAAW;QACX,OAAO;QACP,SAAS;QACT,cAAc;QACd,QAAQ;QACR,uBAAuB;QACvB,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAiC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,cAAc;QACd,KAAK,EAAE,aAAa,GAAG,CAAC;QACxB,oBAAoB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QACpE,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,kBAAkB,EAAE,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,WAAW,CAAC,OAAO,CACpB,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,OAAO,EAAE;YACP,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC;YACtE,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC;YACnE,oBAAoB,EAAE,YAAY;YAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;YACrE,uBAAuB;YACvB,4BAA4B,EAAE,SAAS,CAAC,4BAA4B;YACpE,gBAAgB,EAAE;gBAChB,eAAe;gBACf,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,OAAO,EAAE,yBAAyB;aACnC;SACF;QACD,KAAK;QACL,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAciC;IAEjC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC7D,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,sBAAsB,CACpB,KAAK,CAAC,yBAAyB,CAAC,IAAI,EACpC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB;QAChC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,MAAM,4CAA4C,CAAC;QAC3E,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QACvD,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE;QAC/D,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC;QAChE,eAAe;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyE,EACzE,IAIC;IAED,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;KAC9C,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO;YAClD,GAAG,CAAC,MAAM,gCAAgC,CAAC;gBACzC,GAAG,OAAO;gBACV,aAAa,EAAE,MAAM,sBAAsB,CAAC;oBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,yBAAyB;oBAC3C,SAAS,EAAE,KAAK,CAAC,eAAe;oBAChC,GAAG,mBAAmB;iBACvB,CAAC;gBACF,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,CAAC;QACtC,GAAG,OAAO;QACV,aAAa,EAAE,CACb,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,mBAAmB;SACvB,CAAC,CACH,CAAC,aAAa;QACf,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,2BAA2B,CAAC;YACnC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;YACvD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACvC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,KAGC,EACD,kBAAqC;IAErC,0FAA0F;IAC1F,6BAA6B,CAC3B,KAAK,CAAC,gBAAgB,EACtB,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,6BAA6B,CAC3B,KAAK,CAAC,yBAAyB,CAAC,aAAa,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkSetManifestState,\n  deriveDocumentLinkSetManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n} from \"@tearleads/validators/util\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"../../data/documents/shared/containerKekCurrency\";\nimport { buildDocumentLinkSetEventPlan } from \"../../data/documents/shared/events\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  collectContainerKeksForDocumentSync,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyFromWriterProjection,\n  verifiedDocumentWrapTargets,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  describeDocumentTargetKek,\n  sortDocumentTargets,\n  targetKey,\n  uniqueSortedStrings,\n} from \"../../data/documents/shared/readers\";\nimport {\n  type BuildDocumentLinkSetMutationPlanInput,\n  type DocumentCreateAuthor,\n  type DocumentLinkSetMutationOperation,\n  type DocumentLinkSetMutationPlan,\n  type DocumentLinkSetTargetState,\n  type MaterializedDocumentLinkSetMutationPlan,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCache } from \"../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  assertDocumentLinkAuthorAccess,\n  verifyDocumentLinkSetCurrentPolicies,\n} from \"./linkSetAuthority\";\n\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"./subtreePurgeScope\";\n\nfunction deriveDocumentLinkSetTargetState(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentLinkSetTargetState {\n  const currentTargets = currentDocumentTargets(input.writerProjection);\n  const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  const target = deriveDocumentTargetFromProjection(\n    input.targetContainerProjection,\n  );\n  const currentTarget = currentTargets.find(\n    (candidate) => candidate.containerId === target.containerId,\n  );\n\n  if (input.operation === \"link\") {\n    if (currentTarget) {\n      throw new Error(\"Document link target is already linked\");\n    }\n    assertDocumentLinkTargetCapacity(currentTargets.length);\n    assertDocumentLinkAuthorizationPathCapacity(\n      input.writerProjection.authorizingContainerPaths.map(\n        (projection) => projection.path.length,\n      ),\n      input.targetContainerProjection.path.length,\n    );\n\n    return {\n      currentTargets,\n      linkedContainerIds: uniqueSortedStrings([\n        ...currentLinkedContainerIds,\n        target.containerId,\n      ]),\n      target,\n      targets: sortDocumentTargets([...currentTargets, target]),\n    };\n  }\n\n  if (!currentTarget) {\n    throw new Error(\"Document unlink target is not linked\");\n  }\n  if (targetKey(currentTarget) !== targetKey(target)) {\n    throw new Error(\"Document unlink target projection is stale\");\n  }\n\n  const linkedContainerIds = currentLinkedContainerIds.filter(\n    (containerId) => containerId !== target.containerId,\n  );\n  if (linkedContainerIds.length === 0) {\n    throw new Error(\"Document unlink must leave a linked container\");\n  }\n\n  return {\n    currentTargets,\n    linkedContainerIds,\n    target,\n    targets: currentTargets.filter(\n      (candidate) => candidate.containerId !== target.containerId,\n    ),\n  };\n}\n\nexport function assertDocumentLinkTargetCapacity(\n  currentTargetCount: number,\n): void {\n  if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {\n    throw new RangeError(\n      `A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`,\n    );\n  }\n}\n\nexport function assertDocumentLinkAuthorizationPathCapacity(\n  currentPathLengths: readonly number[],\n  targetPathLength: number,\n): void {\n  const totalReferences = currentPathLengths.reduce(\n    (total, length) => total + length,\n    targetPathLength,\n  );\n  if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {\n    throw new RangeError(\n      `Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`,\n    );\n  }\n}\n\nasync function wrapDocumentContentKeyForTargets(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  targets: readonly DocumentContentKeyTarget[];\n}): Promise<DocumentContentKeyTargetEnvelope[]> {\n  return Promise.all(\n    sortDocumentTargets(input.targets).map(async (target) => {\n      const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);\n      if (!targetKek) {\n        throw new Error(\n          `Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n\n      const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n        kind: \"Document\",\n        objectId: input.documentId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: target.containerId,\n        containerKeyEpochId: target.containerKeyEpochId,\n      });\n      return {\n        ...target,\n        wrappedKey: bytesToBase64(wrapped.ciphertext),\n        wrappingMetadata: {\n          suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n          iv: bytesToBase64(wrapped.iv),\n        },\n      };\n    }),\n  );\n}\n\n// Resolve the organization a link/unlink mutation belongs to: the document's\n// own org (from its manifest), which must equal the target container's org —\n// both are owned by the same organization. The acting member's personal org is\n// intentionally not part of this check; a member may link documents within any\n// org they belong to. Returns the document org so the plan stamps it onto the\n// signed event and manifest rather than the author's org.\nasync function resolveDocumentLinkSetMutationOrganization(input: {\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<string> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document link-set manifest\",\n  });\n  if (\n    manifestIdentity.organizationId !==\n    input.targetContainerProjection.organizationId\n  ) {\n    throw new Error(\"Document target container organization mismatch\");\n  }\n\n  return manifestIdentity.organizationId;\n}\n\nfunction readDocumentLinkSetPreviousEpoch(\n  writerProjection: DocumentWriterProjectionResponse,\n): number {\n  const previousState = writerProjection.documentManifest.state;\n  const previousEpoch = isPlainRecord(previousState)\n    ? Reflect.get(previousState, \"epoch\")\n    : undefined;\n  if (\n    typeof previousEpoch !== \"number\" ||\n    !Number.isInteger(previousEpoch) ||\n    previousEpoch <= 0\n  ) {\n    throw new Error(\"Document link-set previous epoch is invalid\");\n  }\n\n  return previousEpoch;\n}\n\nasync function buildDocumentLinkSetMutationPlan({\n  author,\n  blobRewraps,\n  contentKeyEpoch,\n  eventId = crypto.randomUUID(),\n  operation,\n  signedAt = new Date().toISOString(),\n  targetContainerProjection,\n  targetEnvelopes,\n  writerProjection,\n}: BuildDocumentLinkSetMutationPlanInput): Promise<DocumentLinkSetMutationPlan> {\n  const organizationId = await resolveDocumentLinkSetMutationOrganization({\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation,\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetEnvelopesForRequest = mergeTargetEnvelopes(\n    targetState.targets,\n    targetEnvelopes,\n  );\n  const targetContainerPathRefs = containerPathRefs(\n    targetContainerProjection.path,\n  );\n  const eventPlan = await buildDocumentLinkSetEventPlan({\n    author,\n    blobRewraps,\n    eventId,\n    operation,\n    organizationId,\n    signedAt,\n    targetContainerPathRefs,\n    targetState,\n    writerProjection,\n  });\n  const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);\n\n  const state: DocumentLinkSetManifestState = {\n    version: 1,\n    documentId: writerProjection.documentId,\n    organizationId,\n    epoch: previousEpoch + 1,\n    previousManifestHash: writerProjection.documentManifest.manifestHash,\n    eventHash: eventPlan.eventHash,\n    linkedContainerIds: [...targetState.linkedContainerIds],\n  };\n  const manifest = await deriveDocumentLinkSetManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const targetHash = await computeDocumentContentKeyTargetHash(\n    targetState.targets,\n  );\n\n  return {\n    body: eventPlan.body,\n    contentKeyEpoch,\n    documentId: writerProjection.documentId,\n    event: eventPlan.event,\n    eventHash: eventPlan.eventHash,\n    manifest,\n    manifestHash,\n    operation,\n    request: {\n      event: readCanonicalRecord(eventPlan.event, \"Document link-set event\"),\n      body: readCanonicalRecord(eventPlan.body, \"Document link-set body\"),\n      expectedManifestHash: manifestHash,\n      manifest: readCanonicalRecord(manifest, \"Document link-set manifest\"),\n      targetContainerPathRefs,\n      authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,\n      contentKeyBundle: {\n        contentKeyEpoch,\n        linkSetManifestHash: manifestHash,\n        targetHash,\n        targets: targetEnvelopesForRequest,\n      },\n    },\n    state,\n    targetHash,\n    targets: sortDocumentTargets(targetState.targets),\n  };\n}\n\nexport async function buildMaterializedDocumentLinkSetMutationPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n    prepareBlobRewraps: (\n      targets: readonly DocumentContentKeyTarget[],\n    ) => Promise<BuildDocumentLinkSetMutationPlanInput[\"blobRewraps\"]>;\n    contentKey?: Uint8Array | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    operation: DocumentLinkSetMutationOperation;\n    signedAt?: string | undefined;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentLinkSetMutationPlan> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const principalPolicyCache: PrincipalPolicyCache = new Map();\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    execSql: input.execSql,\n    principalPolicyCache,\n    ...verificationOptions,\n  });\n  await verifyDocumentLinkSetCurrentPolicies({\n    execSql: input.execSql,\n    principalPolicyCache,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  assertSubtreePurgePath(\n    input.targetContainerProjection.path,\n    input.expectedSubtreeRoot,\n  );\n  if (input.resolveProjectionUserKey)\n    assertDocumentLinkAuthorAccess({\n      ...input,\n      principalPolicies: [...principalPolicyCache.values()],\n    });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation: input.operation,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n  });\n  assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);\n  const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  const contentKeyRotated = input.operation === \"unlink\";\n  const contentKey = contentKeyRotated\n    ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))\n    : currentContentKey;\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n  // A link carries the existing envelopes forward at the same epoch; an\n  // unlink rotates to a fresh key at the next one.\n  const contentKeyEpoch =\n    input.writerProjection.contentKeyBundle.contentKeyEpoch +\n    (contentKeyRotated ? 1 : 0);\n  const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {\n    contentKey,\n    contentKeyEpoch,\n    targetState,\n  });\n\n  const plan = await buildDocumentLinkSetMutationPlan({\n    author: input.author,\n    blobRewraps: await input.prepareBlobRewraps(targetState.targets),\n    contentKeyEpoch,\n    eventId: input.eventId,\n    operation: input.operation,\n    signedAt: input.signedAt,\n    targetContainerProjection: input.targetContainerProjection,\n    targetEnvelopes,\n    writerProjection: input.writerProjection,\n  });\n\n  return {\n    contentKey,\n    contentKeyRotated,\n    plan,\n  };\n}\n\nasync function buildLinkSetTargetEnvelopes(\n  input: Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n  wrap: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    targetState: ReturnType<typeof deriveDocumentLinkSetTargetState>;\n  },\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const sealing = {\n    contentKey: wrap.contentKey,\n    contentKeyEpoch: wrap.contentKeyEpoch,\n    documentId: input.writerProjection.documentId,\n  };\n  if (input.operation === \"link\") {\n    return [\n      ...input.writerProjection.contentKeyBundle.targets,\n      ...(await wrapDocumentContentKeyForTargets({\n        ...sealing,\n        keksByEpochId: await unwrapContainerKekPath({\n          execSql: input.execSql,\n          projection: input.targetContainerProjection,\n          secretKey: input.targetSecretKey,\n          ...verificationOptions,\n        }),\n        targets: [wrap.targetState.target],\n      })),\n    ];\n  }\n  return wrapDocumentContentKeyForTargets({\n    ...sealing,\n    keksByEpochId: (\n      await collectContainerKeksForDocumentSync({\n        execSql: input.execSql,\n        secretKey: input.targetSecretKey,\n        writerProjection: input.writerProjection,\n        ...verificationOptions,\n      })\n    ).keksByEpochId,\n    // The rotated key is wrapped only to verified current heads of the\n    // remaining linked containers, never to a server-listed epoch.\n    targets: verifiedDocumentWrapTargets({\n      linkedContainerIds: wrap.targetState.linkedContainerIds,\n      serverTargets: wrap.targetState.targets,\n      writerProjection: input.writerProjection,\n    }),\n  });\n}\n\nfunction assertLinkSetWriteKeksCurrent(\n  input: Pick<\n    Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n    \"writerProjection\" | \"targetContainerProjection\" | \"operation\"\n  >,\n  linkedContainerIds: readonly string[],\n): void {\n  // Unlink can escape a stale branch; only recipients of the successor key must be current.\n  assertDocumentKekPathsCurrent(\n    input.writerProjection,\n    new Set(linkedContainerIds),\n  );\n  if (input.operation === \"link\") {\n    assertContainerKekPathCurrent(\n      input.targetContainerProjection.containerKeks,\n    );\n  }\n}\n"]}

package/workflows/documents/linkSetAuthority.js

@@ -1,61 +0,0 @@
-import { assertContainerAuthorAccess, ContainerAuthorAccessError, } from "../../data/containers/shared/authorAccess.js";
-import { readLinkedContainerIdsFromDocumentManifest } from "../../data/documents/shared/projection.js";
-import { resolveProjectionVerifier, } from "../../data/documents/shared/types.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../data/keyingProjectionVerification/index.js";
-import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
-import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
-/** Both paths have been verified; a readable proof does not authorize a link. */
-export function assertDocumentLinkAuthorAccess(input) {
-    const author = {
-        ...input.author,
-        organizationId: input.targetContainerProjection.organizationId,
-    };
-    const permission = {
-        author,
-        minimumAccess: "write",
-        principalPolicies: input.principalPolicies,
-    };
-    assertContainerAuthorAccess({
-        ...permission,
-        projection: input.targetContainerProjection,
-    });
-    const linked = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
-    for (const projection of documentContainerProjections(input.writerProjection)) {
-        if (!linked.includes(projection.containerId))
-            continue;
-        try {
-            assertContainerAuthorAccess({ ...permission, projection });
-            return;
-        }
-        catch (error) {
-            if (!(error instanceof ContainerAuthorAccessError))
-                throw error;
-        }
-    }
-    throw new ContainerAuthorAccessError("Document signer lacks write access through a linked container");
-}
-/** Current write authorization needs full policies for the readable paths. */
-export async function verifyDocumentLinkSetCurrentPolicies(input) {
-    resolveProjectionVerifier(input, "Document link-set current policies");
-    if (input.trustedLocalProjection === true)
-        return;
-    try {
-        for (const projection of [
-            input.targetContainerProjection,
-            ...documentContainerProjections(input.writerProjection),
-        ]) {
-            await collectContainerWriterProjectionPrincipalPolicies({
-                execSql: input.execSql,
-                principalPolicyCache: input.principalPolicyCache,
-                projection,
-                resolveUserKey: input.resolveProjectionUserKey,
-                stillCurrent: input.stillCurrent,
-                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-            });
-        }
-    }
-    catch (error) {
-        throwKeyingVerificationErrorWithContext(error, "Document link-set current policy verification failed");
-    }
-}
-//# sourceMappingURL=linkSetAuthority.js.map

package/workflows/documents/linkSetAuthority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iDAAiD,GAElD,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AAIxG,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}