@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/linkSetBlobRewraps.js

@@ -1,143 +0,0 @@
-import { BLOB_CONTENT_KEY_WRAP_SUITE, wrapContentKey, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { deriveDocumentTargetFromProjection, unwrapContainerKekPath, } from "../../data/documents/shared/projection.js";
-import { assertEqualBytes, targetKey, } from "../../data/documents/shared/readers.js";
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { readCanonicalJson } from "../../data/keying/canonicalJson.js";
-import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { createAttachmentProofReader } from "../blobs/attachmentDecryptor.js";
-import { createAttachmentKeyAuthenticator } from "../blobs/attachmentKeyAuthenticator.js";
-import { verifyRetainedAttachment } from "../blobs/retainedAttachmentVerification.js";
-/** Authenticate the existing bytes before propagating their DEK to a new scope. */
-export async function prepareDocumentLinkBlobRewraps(input) {
-    const documentId = input.writerProjection.documentId;
-    const bindings = await input.apiClient.listDocumentAttachments(documentId);
-    // The API refuses the link unless every active binding is rewrapped, so an
-    // unavailable listing (offline, or a 409 while a bind is mid-flight) is a
-    // retryable availability failure of this mutation, not integrity evidence.
-    if (!bindings)
-        throw new ProjectionDependencyUnavailableError("Document attachments are unavailable for relinking");
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    if (bindings.length === 0)
-        return [];
-    const keks = await collectRelinkKeks(input);
-    const authenticateKey = createAttachmentKeyAuthenticator(input.apiClient, documentId);
-    const verifyRetained = createAttachmentProofReader(input.apiClient, documentId, verifyRetainedAttachment);
-    const rewrapByBlob = new Map();
-    for (const binding of bindings) {
-        const verification = {
-            binding,
-            expectedDocumentId: documentId,
-            expectedSlotId: binding.slotId,
-            execSql: input.execSql,
-            resolveProjectionUserKey: requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Attachment relink"),
-            targetSecretKey: input.targetSecretKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-            writerProjection: input.writerProjection,
-        };
-        const needsKey = input.targets.some((target) => !retainedTarget(binding, target, documentId));
-        const contentKey = needsKey ? await authenticateKey(verification) : null;
-        if (!needsKey)
-            await verifyRetained(verification);
-        const targets = await Promise.all(input.targets.map(async (target) => {
-            const previous = retainedTarget(binding, target, documentId);
-            if (previous)
-                return {
-                    ...previous,
-                    ...target,
-                    wrappingMetadata: readCanonicalJson(previous.wrappingMetadata, "Attachment wrap metadata"),
-                };
-            const kek = keks.get(targetKey(target));
-            if (!kek)
-                throw new Error("Attachment destination is not a verified current container head");
-            if (!contentKey)
-                throw new Error("Attachment content key is unavailable");
-            return wrapBlobKeyForTarget({
-                binding,
-                contentKey,
-                documentId,
-                kek,
-                target,
-            });
-        }));
-        const rewrap = rewrapByBlob.get(binding.blobId) ?? {
-            blobId: binding.blobId,
-            contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,
-            targets: [],
-        };
-        if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)
-            throw new Error("Attachment content epoch changed during relinking");
-        rewrap.targets.push(...targets);
-        rewrapByBlob.set(binding.blobId, rewrap);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-    }
-    return [...rewrapByBlob.values()].sort(compareBlobIds);
-}
-async function wrapBlobKeyForTarget(input) {
-    const { binding, target } = input;
-    const wrapped = await wrapContentKey(input.contentKey, input.kek, {
-        kind: "Blob",
-        objectId: binding.blobId,
-        contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,
-        containerId: target.containerId,
-        containerKeyEpochId: target.containerKeyEpochId,
-    });
-    return {
-        ...target,
-        bindingId: binding.bindingId,
-        documentId: input.documentId,
-        wrappedKey: bytesToBase64(wrapped.ciphertext),
-        wrappingMetadata: {
-            suite: BLOB_CONTENT_KEY_WRAP_SUITE,
-            iv: bytesToBase64(wrapped.iv),
-        },
-    };
-}
-function retainedTarget(binding, target, documentId) {
-    return binding.contentKeyBundle.targets.find((candidate) => candidate.bindingId === binding.bindingId &&
-        candidate.documentId === documentId &&
-        candidate.containerId === target.containerId &&
-        candidate.containerKeyEpochId === target.containerKeyEpochId);
-}
-async function collectRelinkKeks(input) {
-    const keks = new Map();
-    for (const projection of [
-        ...documentContainerProjections(input.writerProjection),
-        input.targetContainerProjection,
-    ]) {
-        const keys = await unwrapContainerKekPath({
-            projection,
-            secretKey: input.targetSecretKey,
-            execSql: input.execSql,
-            ...projectionVerificationOptions(input),
-        });
-        // Every node of this verified path has a current signed head. Historical
-        // keyring entries may open source bytes, but never enter the destination map.
-        for (const [index, head] of projection.containerKeks.entries()) {
-            const target = deriveDocumentTargetFromProjection({
-                ...projection,
-                containerId: head.containerId,
-                path: projection.path.slice(0, index + 1),
-                containerKeks: projection.containerKeks.slice(0, index + 1),
-            });
-            const key = keys.get(target.containerKeyEpochId);
-            // A direct child grantee need not possess any ancestor secret.
-            if (!key)
-                continue;
-            const id = targetKey(target);
-            const previous = keks.get(id);
-            if (previous)
-                assertEqualBytes(previous, key, "Attachment link projections contain conflicting KEKs");
-            keks.set(id, key);
-        }
-    }
-    return keks;
-}
-function compareBlobIds(a, b) {
-    return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;
-}
-//# sourceMappingURL=linkSetBlobRewraps.js.map

package/workflows/documents/linkSetBlobRewraps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linkSetBlobRewraps.js","sourceRoot":"","sources":["linkSetBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAG3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAQnF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAOiC;IAEjC,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,gCAAgC,CACtD,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,2BAA2B,CAChD,KAAK,CAAC,SAAS,EACf,UAAU,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,kBAAkB,EAAE,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,wBAAwB,EAC9B,mBAAmB,CACpB;YACD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBACV,OAAO;oBACL,GAAG,QAAQ;oBACX,GAAG,MAAM;oBACT,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B;iBACF,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,UAAU;gBACV,UAAU;gBACV,GAAG;gBACH,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACzD,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QAChE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,gBAAgB,EAAE;YAChB,KAAK,EAAE,2BAA2B;YAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA8B,EAC9B,MAAgC,EAChC,UAAkB;IAElB,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACzC,SAAS,CAAC,UAAU,KAAK,UAAU;QACnC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAC5C,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvD,KAAK,CAAC,yBAAyB;KAChC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,yEAAyE;QACzE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,kCAAkC,CAAC;gBAChD,GAAG,UAAU;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjD,+DAA+D;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBACV,gBAAgB,CACd,QAAQ,EACR,GAAG,EACH,sDAAsD,CACvD,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkAccessEventBody,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  BlobAttachmentSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  deriveDocumentTargetFromProjection,\n  unwrapContainerKekPath,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertEqualBytes,\n  targetKey,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentLinkSetMutationApi,\n  ProjectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { readCanonicalJson } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { createAttachmentProofReader } from \"../blobs/attachmentDecryptor\";\nimport { createAttachmentKeyAuthenticator } from \"../blobs/attachmentKeyAuthenticator\";\nimport { verifyRetainedAttachment } from \"../blobs/retainedAttachmentVerification\";\n\ninterface BlobRewrap {\n  blobId: string;\n  contentKeyEpoch: number;\n  targets: DocumentLinkAccessEventBody[\"blobRewraps\"][number][\"targets\"][number][];\n}\n\n/** Authenticate the existing bytes before propagating their DEK to a new scope. */\nexport async function prepareDocumentLinkBlobRewraps(\n  input: {\n    apiClient: DocumentLinkSetMutationApi;\n    execSql: ExecSql;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    targets: readonly DocumentContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentLinkAccessEventBody[\"blobRewraps\"]> {\n  const documentId = input.writerProjection.documentId;\n  const bindings = await input.apiClient.listDocumentAttachments(documentId);\n  // The API refuses the link unless every active binding is rewrapped, so an\n  // unavailable listing (offline, or a 409 while a bind is mid-flight) is a\n  // retryable availability failure of this mutation, not integrity evidence.\n  if (!bindings)\n    throw new ProjectionDependencyUnavailableError(\n      \"Document attachments are unavailable for relinking\",\n    );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (bindings.length === 0) return [];\n  const keks = await collectRelinkKeks(input);\n  const authenticateKey = createAttachmentKeyAuthenticator(\n    input.apiClient,\n    documentId,\n  );\n  const verifyRetained = createAttachmentProofReader(\n    input.apiClient,\n    documentId,\n    verifyRetainedAttachment,\n  );\n  const rewrapByBlob = new Map<string, BlobRewrap>();\n  for (const binding of bindings) {\n    const verification = {\n      binding,\n      expectedDocumentId: documentId,\n      expectedSlotId: binding.slotId,\n      execSql: input.execSql,\n      resolveProjectionUserKey: requireProjectionUserKeyResolver(\n        input.resolveProjectionUserKey,\n        \"Attachment relink\",\n      ),\n      targetSecretKey: input.targetSecretKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      writerProjection: input.writerProjection,\n    };\n    const needsKey = input.targets.some(\n      (target) => !retainedTarget(binding, target, documentId),\n    );\n    const contentKey = needsKey ? await authenticateKey(verification) : null;\n    if (!needsKey) await verifyRetained(verification);\n    const targets = await Promise.all(\n      input.targets.map(async (target) => {\n        const previous = retainedTarget(binding, target, documentId);\n        if (previous)\n          return {\n            ...previous,\n            ...target,\n            wrappingMetadata: readCanonicalJson(\n              previous.wrappingMetadata,\n              \"Attachment wrap metadata\",\n            ),\n          };\n        const kek = keks.get(targetKey(target));\n        if (!kek)\n          throw new Error(\n            \"Attachment destination is not a verified current container head\",\n          );\n        if (!contentKey)\n          throw new Error(\"Attachment content key is unavailable\");\n        return wrapBlobKeyForTarget({\n          binding,\n          contentKey,\n          documentId,\n          kek,\n          target,\n        });\n      }),\n    );\n    const rewrap = rewrapByBlob.get(binding.blobId) ?? {\n      blobId: binding.blobId,\n      contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n      targets: [],\n    };\n    if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)\n      throw new Error(\"Attachment content epoch changed during relinking\");\n    rewrap.targets.push(...targets);\n    rewrapByBlob.set(binding.blobId, rewrap);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  }\n  return [...rewrapByBlob.values()].sort(compareBlobIds);\n}\n\nasync function wrapBlobKeyForTarget(input: {\n  binding: BlobAttachmentSummary;\n  contentKey: Uint8Array;\n  documentId: string;\n  kek: Uint8Array;\n  target: DocumentContentKeyTarget;\n}) {\n  const { binding, target } = input;\n  const wrapped = await wrapContentKey(input.contentKey, input.kek, {\n    kind: \"Blob\",\n    objectId: binding.blobId,\n    contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n  return {\n    ...target,\n    bindingId: binding.bindingId,\n    documentId: input.documentId,\n    wrappedKey: bytesToBase64(wrapped.ciphertext),\n    wrappingMetadata: {\n      suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n      iv: bytesToBase64(wrapped.iv),\n    },\n  };\n}\n\nfunction retainedTarget(\n  binding: BlobAttachmentSummary,\n  target: DocumentContentKeyTarget,\n  documentId: string,\n) {\n  return binding.contentKeyBundle.targets.find(\n    (candidate) =>\n      candidate.bindingId === binding.bindingId &&\n      candidate.documentId === documentId &&\n      candidate.containerId === target.containerId &&\n      candidate.containerKeyEpochId === target.containerKeyEpochId,\n  );\n}\n\nasync function collectRelinkKeks(\n  input: Parameters<typeof prepareDocumentLinkBlobRewraps>[0],\n): Promise<Map<string, Uint8Array>> {\n  const keks = new Map<string, Uint8Array>();\n  for (const projection of [\n    ...documentContainerProjections(input.writerProjection),\n    input.targetContainerProjection,\n  ]) {\n    const keys = await unwrapContainerKekPath({\n      projection,\n      secretKey: input.targetSecretKey,\n      execSql: input.execSql,\n      ...projectionVerificationOptions(input),\n    });\n    // Every node of this verified path has a current signed head. Historical\n    // keyring entries may open source bytes, but never enter the destination map.\n    for (const [index, head] of projection.containerKeks.entries()) {\n      const target = deriveDocumentTargetFromProjection({\n        ...projection,\n        containerId: head.containerId,\n        path: projection.path.slice(0, index + 1),\n        containerKeks: projection.containerKeks.slice(0, index + 1),\n      });\n      const key = keys.get(target.containerKeyEpochId);\n      // A direct child grantee need not possess any ancestor secret.\n      if (!key) continue;\n      const id = targetKey(target);\n      const previous = keks.get(id);\n      if (previous)\n        assertEqualBytes(\n          previous,\n          key,\n          \"Attachment link projections contain conflicting KEKs\",\n        );\n      keks.set(id, key);\n    }\n  }\n  return keks;\n}\n\nfunction compareBlobIds(a: { blobId: string }, b: { blobId: string }): number {\n  return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;\n}\n"]}

package/workflows/documents/linkSetProjectionSeed.js

@@ -1,119 +0,0 @@
-import { assertDocumentWriterProjectionConsistent } from "../../data/documents/shared/projection.js";
-import { mergeProjectionPolicyEvidence } from "../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js";
-function uniqueManifestBundles(bundles) {
-    const byHash = new Map();
-    for (const bundle of bundles) {
-        if (!byHash.has(bundle.manifestHash)) {
-            byHash.set(bundle.manifestHash, bundle);
-        }
-    }
-    return [...byHash.values()];
-}
-function uniqueManifestPaths(paths) {
-    const byLeafHash = new Map();
-    for (const path of paths) {
-        const leafHash = path.at(-1)?.manifestHash;
-        if (!leafHash || byLeafHash.has(leafHash)) {
-            continue;
-        }
-        byLeafHash.set(leafHash, [...path]);
-    }
-    return [...byLeafHash.values()];
-}
-function containerProjectionManifestHistory(projection) {
-    return projection.containerKeks.flatMap((kek) => kek.containerManifestHistory);
-}
-function documentProjectionContainerPaths(projection) {
-    return uniqueManifestPaths([
-        ...projection.documentManifestContainerPaths,
-        ...projection.authorizingContainerPaths.map((path) => path.path),
-    ]);
-}
-function documentProjectionContainerHistory(input) {
-    const priorContainerPaths = documentProjectionContainerPaths(input.priorProjection);
-    const priorAuthorizingContainerProjections = input.priorProjection.authorizingContainerPaths;
-    return uniqueManifestBundles([
-        ...input.priorProjection.documentContainerManifestHistory,
-        ...priorContainerPaths.flat(),
-        ...priorAuthorizingContainerProjections.flatMap((projection) => [
-            ...projection.path,
-            ...containerProjectionManifestHistory(projection),
-        ]),
-        ...input.targetContainerProjection.path,
-        ...containerProjectionManifestHistory(input.targetContainerProjection),
-    ]);
-}
-/**
- * Reconstruct the post-mutation writer projection from a link/unlink response.
- * The response carries the fresh manifest, content-key bundle, and KEK targets;
- * the authorizing container paths change by exactly one entry — link appends
- * the target container's projection, unlink drops it (keyed by containerId).
- * Link does not rotate the content key (only unlink does), but either way the
- * bundle/targets the next write needs come straight from the response. The
- * caller verifies this projection for internal consistency before seeding it,
- * so a wrong reconstruction is discarded rather than cached.
- */
-function linkSetWriterProjectionFromResponse(input) {
-    // The target container's authorizing path is replaced wholesale: link adds
-    // the fresh target projection back, unlink leaves it dropped.
-    const retainedPaths = input.priorProjection.authorizingContainerPaths.filter((path) => path.containerId !== input.targetContainerId);
-    const authorizingContainerPaths = input.operation === "link"
-        ? [...retainedPaths, input.targetContainerProjection]
-        : retainedPaths;
-    const documentManifestContainerPaths = uniqueManifestPaths([
-        ...documentProjectionContainerPaths(input.priorProjection),
-        input.targetContainerProjection.path,
-    ]);
-    return {
-        policyEvidence: mergeProjectionPolicyEvidence([
-            input.priorProjection.policyEvidence,
-            input.targetContainerProjection.policyEvidence,
-        ]),
-        authorizingContainerPaths,
-        contentKeyBundle: input.response.contentKeyBundle,
-        documentId: input.response.id,
-        documentContainerManifestHistory: documentProjectionContainerHistory({
-            priorProjection: input.priorProjection,
-            targetContainerProjection: input.targetContainerProjection,
-        }),
-        documentKekTargets: input.response.documentKekTargets,
-        documentManifest: input.response.accessManifest,
-        documentManifestContainerPaths,
-        documentManifestHistory: [
-            input.priorProjection.documentManifest,
-            ...input.priorProjection.documentManifestHistory,
-        ],
-    };
-}
-/**
- * Reconstruct and seed the post-mutation writer projection so the first read
- * after a link/unlink resolves locally instead of a cold GET. Gates the seed on
- * the projection's internal consistency (manifest hash ↔ content-key bundle ↔
- * KEK targets ↔ linked containers); on any mismatch the seed is skipped and the
- * next read falls back to a fetch — the seed is an optimization, never a
- * correctness dependency. The expensive per-path signature re-verification is
- * deliberately not run here: the server already verified the mutation, and the
- * next read re-verifies the projection before any write.
- */
-export async function seedLinkSetWriterProjection(input) {
-    const projection = linkSetWriterProjectionFromResponse({
-        operation: input.operation,
-        priorProjection: input.priorProjection,
-        response: input.response,
-        targetContainerId: input.targetContainerId,
-        targetContainerProjection: input.targetContainerProjection,
-    });
-    try {
-        await assertDocumentWriterProjectionConsistent(projection, {
-            execSql: input.execSql,
-            trustedLocalProjection: true,
-        });
-    }
-    catch {
-        return;
-    }
-    if (input.stillCurrent?.() === false)
-        return;
-    input.apiClient.primeDocumentWriterProjection(input.response.id, projection);
-}
-//# sourceMappingURL=linkSetProjectionSeed.js.map

package/workflows/documents/linkSetProjectionSeed.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linkSetProjectionSeed.js","sourceRoot":"","sources":["linkSetProjectionSeed.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAElG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uEAAuE,CAAC;AAUtH,SAAS,qBAAqB,CAC5B,OAAoD;IAEpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA+D;IAE/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,kCAAkC,CACzC,UAAuC;IAEvC,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,wBAAwB,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,UAA4C;IAE5C,OAAO,mBAAmB,CAAC;QACzB,GAAG,UAAU,CAAC,8BAA8B;QAC5C,GAAG,UAAU,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kCAAkC,CAAC,KAG3C;IACC,MAAM,mBAAmB,GAAG,gCAAgC,CAC1D,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,oCAAoC,GACxC,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;IAElD,OAAO,qBAAqB,CAAC;QAC3B,GAAG,KAAK,CAAC,eAAe,CAAC,gCAAgC;QACzD,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC7B,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9D,GAAG,UAAU,CAAC,IAAI;YAClB,GAAG,kCAAkC,CAAC,UAAU,CAAC;SAClD,CAAC;QACF,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI;QACvC,GAAG,kCAAkC,CAAC,KAAK,CAAC,yBAAyB,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mCAAmC,CAAC,KAM5C;IACC,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC,MAAM,CAC1E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,iBAAiB,CACvD,CAAC;IACF,MAAM,yBAAyB,GAC7B,KAAK,CAAC,SAAS,KAAK,MAAM;QACxB,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,KAAK,CAAC,yBAAyB,CAAC;QACrD,CAAC,CAAC,aAAa,CAAC;IACpB,MAAM,8BAA8B,GAAG,mBAAmB,CAAC;QACzD,GAAG,gCAAgC,CAAC,KAAK,CAAC,eAAe,CAAC;QAC1D,KAAK,CAAC,yBAAyB,CAAC,IAAI;KACrC,CAAC,CAAC;IACH,OAAO;QACL,cAAc,EAAE,6BAA6B,CAAC;YAC5C,KAAK,CAAC,eAAe,CAAC,cAAc;YACpC,KAAK,CAAC,yBAAyB,CAAC,cAAc;SAC/C,CAAC;QACF,yBAAyB;QACzB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC7B,gCAAgC,EAAE,kCAAkC,CAAC;YACnE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;SAC3D,CAAC;QACF,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;QACrD,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC/C,8BAA8B;QAC9B,uBAAuB,EAAE;YACvB,KAAK,CAAC,eAAe,CAAC,gBAAgB;YACtC,GAAG,KAAK,CAAC,eAAe,CAAC,uBAAuB;SACjD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KASjD;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,wCAAwC,CAAC,UAAU,EAAE;YACzD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AAC/E,CAAC","sourcesContent":["import type {\n  AccessManifestBundleWireResponse,\n  ContainerKeyingPathResponse,\n  ContainerWriterProjectionResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport type { DocumentLinkSetMutationOperation } from \"../../data/documents/shared/types\";\nimport { mergeProjectionPolicyEvidence } from \"../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\ninterface DocumentLinkSetProjectionSeedApi {\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nfunction uniqueManifestBundles(\n  bundles: readonly AccessManifestBundleWireResponse[],\n): AccessManifestBundleWireResponse[] {\n  const byHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const bundle of bundles) {\n    if (!byHash.has(bundle.manifestHash)) {\n      byHash.set(bundle.manifestHash, bundle);\n    }\n  }\n\n  return [...byHash.values()];\n}\n\nfunction uniqueManifestPaths(\n  paths: readonly (readonly AccessManifestBundleWireResponse[])[],\n): AccessManifestBundleWireResponse[][] {\n  const byLeafHash = new Map<string, AccessManifestBundleWireResponse[]>();\n  for (const path of paths) {\n    const leafHash = path.at(-1)?.manifestHash;\n    if (!leafHash || byLeafHash.has(leafHash)) {\n      continue;\n    }\n\n    byLeafHash.set(leafHash, [...path]);\n  }\n\n  return [...byLeafHash.values()];\n}\n\nfunction containerProjectionManifestHistory(\n  projection: ContainerKeyingPathResponse,\n): AccessManifestBundleWireResponse[] {\n  return projection.containerKeks.flatMap(\n    (kek) => kek.containerManifestHistory,\n  );\n}\n\nfunction documentProjectionContainerPaths(\n  projection: DocumentWriterProjectionResponse,\n): AccessManifestBundleWireResponse[][] {\n  return uniqueManifestPaths([\n    ...projection.documentManifestContainerPaths,\n    ...projection.authorizingContainerPaths.map((path) => path.path),\n  ]);\n}\n\nfunction documentProjectionContainerHistory(input: {\n  priorProjection: DocumentWriterProjectionResponse;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n}): AccessManifestBundleWireResponse[] {\n  const priorContainerPaths = documentProjectionContainerPaths(\n    input.priorProjection,\n  );\n  const priorAuthorizingContainerProjections =\n    input.priorProjection.authorizingContainerPaths;\n\n  return uniqueManifestBundles([\n    ...input.priorProjection.documentContainerManifestHistory,\n    ...priorContainerPaths.flat(),\n    ...priorAuthorizingContainerProjections.flatMap((projection) => [\n      ...projection.path,\n      ...containerProjectionManifestHistory(projection),\n    ]),\n    ...input.targetContainerProjection.path,\n    ...containerProjectionManifestHistory(input.targetContainerProjection),\n  ]);\n}\n\n/**\n * Reconstruct the post-mutation writer projection from a link/unlink response.\n * The response carries the fresh manifest, content-key bundle, and KEK targets;\n * the authorizing container paths change by exactly one entry — link appends\n * the target container's projection, unlink drops it (keyed by containerId).\n * Link does not rotate the content key (only unlink does), but either way the\n * bundle/targets the next write needs come straight from the response. The\n * caller verifies this projection for internal consistency before seeding it,\n * so a wrong reconstruction is discarded rather than cached.\n */\nfunction linkSetWriterProjectionFromResponse(input: {\n  operation: DocumentLinkSetMutationOperation;\n  priorProjection: DocumentWriterProjectionResponse;\n  response: DocumentLinkSetMutationResponse;\n  targetContainerId: string;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n}): DocumentWriterProjectionResponse {\n  // The target container's authorizing path is replaced wholesale: link adds\n  // the fresh target projection back, unlink leaves it dropped.\n  const retainedPaths = input.priorProjection.authorizingContainerPaths.filter(\n    (path) => path.containerId !== input.targetContainerId,\n  );\n  const authorizingContainerPaths =\n    input.operation === \"link\"\n      ? [...retainedPaths, input.targetContainerProjection]\n      : retainedPaths;\n  const documentManifestContainerPaths = uniqueManifestPaths([\n    ...documentProjectionContainerPaths(input.priorProjection),\n    input.targetContainerProjection.path,\n  ]);\n  return {\n    policyEvidence: mergeProjectionPolicyEvidence([\n      input.priorProjection.policyEvidence,\n      input.targetContainerProjection.policyEvidence,\n    ]),\n    authorizingContainerPaths,\n    contentKeyBundle: input.response.contentKeyBundle,\n    documentId: input.response.id,\n    documentContainerManifestHistory: documentProjectionContainerHistory({\n      priorProjection: input.priorProjection,\n      targetContainerProjection: input.targetContainerProjection,\n    }),\n    documentKekTargets: input.response.documentKekTargets,\n    documentManifest: input.response.accessManifest,\n    documentManifestContainerPaths,\n    documentManifestHistory: [\n      input.priorProjection.documentManifest,\n      ...input.priorProjection.documentManifestHistory,\n    ],\n  };\n}\n\n/**\n * Reconstruct and seed the post-mutation writer projection so the first read\n * after a link/unlink resolves locally instead of a cold GET. Gates the seed on\n * the projection's internal consistency (manifest hash ↔ content-key bundle ↔\n * KEK targets ↔ linked containers); on any mismatch the seed is skipped and the\n * next read falls back to a fetch — the seed is an optimization, never a\n * correctness dependency. The expensive per-path signature re-verification is\n * deliberately not run here: the server already verified the mutation, and the\n * next read re-verifies the projection before any write.\n */\nexport async function seedLinkSetWriterProjection(input: {\n  apiClient: DocumentLinkSetProjectionSeedApi;\n  execSql?: ExecSql | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  priorProjection: DocumentWriterProjectionResponse;\n  response: DocumentLinkSetMutationResponse;\n  targetContainerId: string;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  const projection = linkSetWriterProjectionFromResponse({\n    operation: input.operation,\n    priorProjection: input.priorProjection,\n    response: input.response,\n    targetContainerId: input.targetContainerId,\n    targetContainerProjection: input.targetContainerProjection,\n  });\n  try {\n    await assertDocumentWriterProjectionConsistent(projection, {\n      execSql: input.execSql,\n      trustedLocalProjection: true,\n    });\n  } catch {\n    return;\n  }\n  if (input.stillCurrent?.() === false) return;\n  input.apiClient.primeDocumentWriterProjection(input.response.id, projection);\n}\n"]}

package/workflows/documents/linkSetRemote.d.ts

@@ -1,23 +0,0 @@
-import type { DocumentCreateAuthor, DocumentLinkSetFailureHandler, DocumentLinkSetMutationApi, DocumentLinkSetMutationOperation, RelinkRemoteDocumentResult } from "../../data/documents/shared/types.js";
-import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { SubtreePurgeRoot } from "./subtreePurgeScope.js";
-export declare function relinkRemoteDocument(input: {
-    beforeSubmit?: (() => Promise<boolean>) | undefined;
-    apiClient: DocumentLinkSetMutationApi;
-    author: DocumentCreateAuthor;
-    contentKey?: Uint8Array | undefined;
-    documentId: string;
-    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    onFailure?: DocumentLinkSetFailureHandler | undefined;
-    operation: DocumentLinkSetMutationOperation;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    rotationSnapshot?: Uint8Array | undefined;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetContainerId: string;
-    targetSecretKey: Uint8Array;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<RelinkRemoteDocumentResult | null>;

package/workflows/documents/linkSetRemote.js

@@ -1,187 +0,0 @@
-import { acknowledgeDocumentMutation } from "../../data/documents/shared/mutationAcknowledgement.js";
-import { persistedDocumentLinkSetMutationStateFromResponse } from "../../data/documents/shared/responses.js";
-import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../data/keyingProjectionVerification/index.js";
-import { recordDocumentAuthorAccessFailure } from "./authorAccessFailure.js";
-import { buildMaterializedDocumentLinkSetMutationPlan } from "./linkSet.js";
-import { prepareDocumentLinkBlobRewraps } from "./linkSetBlobRewraps.js";
-import { seedLinkSetWriterProjection } from "./linkSetProjectionSeed.js";
-import { completeLinkSetMutationRequest } from "./rotationBaseline.js";
-async function submitLinkSetMutation(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    const { apiClient } = input;
-    // Preserve the HTTP failure for the durable move-intent queue.
-    const resultFn = input.operation === "link"
-        ? apiClient.linkDocumentResult.bind(apiClient)
-        : apiClient.unlinkDocumentResult.bind(apiClient);
-    const result = await resultFn(input.documentId, input.request, {
-        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
-    });
-    if (result.ok) {
-        return result.data;
-    }
-    input.onFailure?.({
-        code: result.code,
-        message: result.message,
-        status: result.status,
-    });
-    return null;
-}
-// Cold-cache projection fetches must keep their HTTP status: collapsing a
-// 403 to null would leave an access-denied link/unlink routinely retriable
-// instead of parking its move for the access-restored signal (row 7).
-async function fetchLinkSetProjection(input) {
-    const result = await input.fetchProjectionResult();
-    if (result.ok) {
-        return { failure: null, projection: result.data };
-    }
-    result.report();
-    return {
-        failure: {
-            code: result.code,
-            message: result.message,
-            status: result.status,
-        },
-        projection: null,
-    };
-}
-function fetchLinkSetDocumentProjection(apiClient, documentId) {
-    return fetchLinkSetProjection({
-        fetchProjectionResult: apiClient.getDocumentWriterProjectionResult.bind(apiClient, documentId, { reportErrors: false }),
-    });
-}
-function fetchLinkSetContainerProjection(apiClient, containerId) {
-    return fetchLinkSetProjection({
-        fetchProjectionResult: apiClient.getContainerWriterProjectionResult.bind(apiClient, containerId, { reportErrors: false }),
-    });
-}
-async function completeRemoteDocumentLinkSet(input) {
-    const persistedState = persistedDocumentLinkSetMutationStateFromResponse(input.completedPlan, input.response);
-    await acknowledgeDocumentMutation({
-        execSql: input.execSql,
-        plan: input.completedPlan,
-        stillCurrent: input.stillCurrent,
-    });
-    await seedLinkSetWriterProjection({
-        apiClient: input.apiClient,
-        execSql: input.execSql,
-        operation: input.operation,
-        priorProjection: input.writerProjection,
-        response: input.response,
-        targetContainerId: input.targetContainerId,
-        targetContainerProjection: input.targetContainerProjection,
-        stillCurrent: input.stillCurrent,
-    });
-    if (input.stillCurrent?.() === false)
-        return null;
-    return {
-        contentKey: input.materializedPlan.contentKey,
-        contentKeyRotated: input.materializedPlan.contentKeyRotated,
-        documentId: input.response.id,
-        linkedContainerIds: [
-            ...input.materializedPlan.plan.state.linkedContainerIds,
-        ],
-        persistedState,
-        plan: input.completedPlan,
-        response: input.response,
-    };
-}
-export async function relinkRemoteDocument(input) {
-    if (input.operation === "unlink" && !input.rotationSnapshot) {
-        throw new Error("Document unlink requires a proven full-history rotation snapshot");
-    }
-    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote document link-set mutation");
-    const [writerFetch, targetContainerFetch] = await Promise.all([
-        fetchLinkSetDocumentProjection(input.apiClient, input.documentId),
-        fetchLinkSetContainerProjection(input.apiClient, input.targetContainerId),
-    ]);
-    if (!writerFetch.projection || !targetContainerFetch.projection) {
-        for (const failure of orderedProjectionFailures([
-            writerFetch.failure,
-            targetContainerFetch.failure,
-        ])) {
-            input.onFailure?.(failure);
-        }
-        return null;
-    }
-    const writerProjection = writerFetch.projection;
-    const targetContainerProjection = targetContainerFetch.projection;
-    if (input.stillCurrent?.() === false)
-        return null;
-    const signedAt = input.signedAt ?? new Date().toISOString();
-    const materializedPlan = await prepareRemoteLinkSetMutation({ ...input, resolveProjectionUserKey, signedAt }, writerProjection, targetContainerProjection);
-    if (!materializedPlan)
-        return null;
-    const request = await completeLinkSetMutationRequest({
-        author: input.author,
-        materializedPlan,
-        operation: input.operation,
-        rotationSnapshot: input.rotationSnapshot,
-        signedAt,
-    });
-    const completedPlan = { ...materializedPlan.plan, request };
-    if (input.beforeSubmit && !(await input.beforeSubmit()))
-        return null;
-    const response = await submitLinkSetMutation({
-        apiClient: input.apiClient,
-        documentId: completedPlan.documentId,
-        expectedOrganizationId: completedPlan.state.organizationId,
-        onFailure: input.onFailure,
-        operation: input.operation,
-        request: completedPlan.request,
-        stillCurrent: input.stillCurrent,
-    });
-    if (!response) {
-        return null;
-    }
-    if (input.stillCurrent?.() === false)
-        return null;
-    return completeRemoteDocumentLinkSet({
-        apiClient: input.apiClient,
-        completedPlan,
-        execSql: input.execSql,
-        materializedPlan,
-        operation: input.operation,
-        response,
-        stillCurrent: input.stillCurrent,
-        targetContainerId: input.targetContainerId,
-        targetContainerProjection,
-        writerProjection,
-    });
-}
-// Every projection failure reaches the handler: the queued-move accumulator
-// classifies a vanished container from ANY coded container 404, so a document
-// fetch failure must not hide a container one (or vice versa). A 403 is
-// delivered last, so a single-slot consumer keeps the denial that parks the
-// move (row 7) while the accumulator still sees both.
-function orderedProjectionFailures(failures) {
-    const present = failures.filter((failure) => failure !== null);
-    return [
-        ...present.filter((failure) => failure.status !== 403),
-        ...present.filter((failure) => failure.status === 403),
-    ];
-}
-function prepareRemoteLinkSetMutation(input, writerProjection, targetContainerProjection) {
-    return recordDocumentAuthorAccessFailure(() => nullOnProjectionVerificationCancellation(() => buildMaterializedDocumentLinkSetMutationPlan({
-        author: input.author,
-        expectedSubtreeRoot: input.expectedSubtreeRoot,
-        prepareBlobRewraps: (targets) => prepareDocumentLinkBlobRewraps({
-            ...input,
-            targets,
-            targetContainerProjection,
-            writerProjection,
-        }),
-        contentKey: input.contentKey,
-        eventId: input.eventId,
-        execSql: input.execSql,
-        operation: input.operation,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        signedAt: input.signedAt,
-        stillCurrent: input.stillCurrent,
-        targetContainerProjection,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        writerProjection,
-    })), input.onFailure);
-}
-//# sourceMappingURL=linkSetRemote.js.map

package/workflows/documents/linkSetRemote.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linkSetRemote.js","sourceRoot":"","sources":["linkSetRemote.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAClG,OAAO,EAAE,iDAAiD,EAAE,MAAM,uCAAuC,CAAC;AAU1G,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAGpE,KAAK,UAAU,qBAAqB,CAAC,KAQpC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,MAAM;QACxB,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE;QAC7D,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,KAAK,UAAU,sBAAsB,CAAc,KAKlD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;QACD,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,SAAqC,EACrC,UAAkB;IAElB,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,SAAS,CAAC,iCAAiC,CAAC,IAAI,CACrE,SAAS,EACT,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CACtC,SAAqC,EACrC,WAAmB;IAEnB,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,SAAS,CAAC,kCAAkC,CAAC,IAAI,CACtE,SAAS,EACT,WAAW,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAe5C;IACC,MAAM,cAAc,GAAG,iDAAiD,CACtE,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,gBAAgB;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,iBAAiB;QAC3D,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC7B,kBAAkB,EAAE;YAClB,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB;SACxD;QACD,cAAc;QACd,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAkB1C;IACC,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,mCAAmC,CACpC,CAAC;IACF,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;QACjE,+BAA+B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC;QAChE,KAAK,MAAM,OAAO,IAAI,yBAAyB,CAAC;YAC9C,WAAW,CAAC,OAAO;YACnB,oBAAoB,CAAC,OAAO;SAC7B,CAAC,EAAE,CAAC;YACH,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,UAAU,CAAC;IAChD,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,UAAU,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CACzD,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAChD,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,sDAAsD;AACtD,SAAS,yBAAyB,CAChC,QAA4D;IAE5D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,OAAO,EAA6C,EAAE,CAAC,OAAO,KAAK,IAAI,CACzE,CAAC;IACF,OAAO;QACL,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QACtD,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,KAGC,EACD,gBAAkD,EAClD,yBAA4D;IAE5D,OAAO,iCAAiC,CACtC,GAAG,EAAE,CACH,wCAAwC,CAAC,GAAG,EAAE,CAC5C,4CAA4C,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,OAAO;YACP,yBAAyB;YACzB,gBAAgB;SACjB,CAAC;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,yBAAyB;QACzB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;QACvC,gBAAgB;KACjB,CAAC,CACH,EACH,KAAK,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentLinkSetMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { acknowledgeDocumentMutation } from \"../../data/documents/shared/mutationAcknowledgement\";\nimport { persistedDocumentLinkSetMutationStateFromResponse } from \"../../data/documents/shared/responses\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationApi,\n  DocumentLinkSetMutationFailure,\n  DocumentLinkSetMutationOperation,\n  DocumentSyncSubmitFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { recordDocumentAuthorAccessFailure } from \"./authorAccessFailure\";\nimport { buildMaterializedDocumentLinkSetMutationPlan } from \"./linkSet\";\nimport { prepareDocumentLinkBlobRewraps } from \"./linkSetBlobRewraps\";\nimport { seedLinkSetWriterProjection } from \"./linkSetProjectionSeed\";\nimport { completeLinkSetMutationRequest } from \"./rotationBaseline\";\nimport type { SubtreePurgeRoot } from \"./subtreePurgeScope\";\n\nasync function submitLinkSetMutation(input: {\n  apiClient: DocumentLinkSetMutationApi;\n  documentId: string;\n  expectedOrganizationId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<DocumentLinkSetMutationResponse | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const { apiClient } = input;\n  // Preserve the HTTP failure for the durable move-intent queue.\n  const resultFn =\n    input.operation === \"link\"\n      ? apiClient.linkDocumentResult.bind(apiClient)\n      : apiClient.unlinkDocumentResult.bind(apiClient);\n  const result = await resultFn(input.documentId, input.request, {\n    expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n  });\n  if (result.ok) {\n    return result.data;\n  }\n  input.onFailure?.({\n    code: result.code,\n    message: result.message,\n    status: result.status,\n  });\n  return null;\n}\n\ninterface LinkSetProjectionFetch<TProjection> {\n  failure: DocumentLinkSetMutationFailure | null;\n  projection: TProjection | null;\n}\n\n// Cold-cache projection fetches must keep their HTTP status: collapsing a\n// 403 to null would leave an access-denied link/unlink routinely retriable\n// instead of parking its move for the access-restored signal (row 7).\nasync function fetchLinkSetProjection<TProjection>(input: {\n  fetchProjectionResult: () => Promise<\n    | { readonly data: TProjection; readonly ok: true }\n    | DocumentSyncSubmitFailure\n  >;\n}): Promise<LinkSetProjectionFetch<TProjection>> {\n  const result = await input.fetchProjectionResult();\n  if (result.ok) {\n    return { failure: null, projection: result.data };\n  }\n  result.report();\n  return {\n    failure: {\n      code: result.code,\n      message: result.message,\n      status: result.status,\n    },\n    projection: null,\n  };\n}\n\nfunction fetchLinkSetDocumentProjection(\n  apiClient: DocumentLinkSetMutationApi,\n  documentId: string,\n): Promise<LinkSetProjectionFetch<DocumentWriterProjectionResponse>> {\n  return fetchLinkSetProjection({\n    fetchProjectionResult: apiClient.getDocumentWriterProjectionResult.bind(\n      apiClient,\n      documentId,\n      { reportErrors: false },\n    ),\n  });\n}\n\nfunction fetchLinkSetContainerProjection(\n  apiClient: DocumentLinkSetMutationApi,\n  containerId: string,\n): Promise<LinkSetProjectionFetch<ContainerWriterProjectionResponse>> {\n  return fetchLinkSetProjection({\n    fetchProjectionResult: apiClient.getContainerWriterProjectionResult.bind(\n      apiClient,\n      containerId,\n      { reportErrors: false },\n    ),\n  });\n}\n\nasync function completeRemoteDocumentLinkSet(input: {\n  completedPlan: Parameters<\n    typeof persistedDocumentLinkSetMutationStateFromResponse\n  >[0];\n  execSql: ExecSql;\n  materializedPlan: Awaited<\n    ReturnType<typeof buildMaterializedDocumentLinkSetMutationPlan>\n  >;\n  operation: DocumentLinkSetMutationOperation;\n  response: DocumentLinkSetMutationResponse;\n  stillCurrent?: (() => boolean) | undefined;\n  targetContainerId: string;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n  apiClient: DocumentLinkSetMutationApi;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  const persistedState = persistedDocumentLinkSetMutationStateFromResponse(\n    input.completedPlan,\n    input.response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: input.completedPlan,\n    stillCurrent: input.stillCurrent,\n  });\n  await seedLinkSetWriterProjection({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    operation: input.operation,\n    priorProjection: input.writerProjection,\n    response: input.response,\n    targetContainerId: input.targetContainerId,\n    targetContainerProjection: input.targetContainerProjection,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  return {\n    contentKey: input.materializedPlan.contentKey,\n    contentKeyRotated: input.materializedPlan.contentKeyRotated,\n    documentId: input.response.id,\n    linkedContainerIds: [\n      ...input.materializedPlan.plan.state.linkedContainerIds,\n    ],\n    persistedState,\n    plan: input.completedPlan,\n    response: input.response,\n  };\n}\n\nexport async function relinkRemoteDocument(input: {\n  beforeSubmit?: (() => Promise<boolean>) | undefined;\n  apiClient: DocumentLinkSetMutationApi;\n  author: DocumentCreateAuthor;\n  contentKey?: Uint8Array | undefined;\n  documentId: string;\n  expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot?: Uint8Array | undefined;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetContainerId: string;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  if (input.operation === \"unlink\" && !input.rotationSnapshot) {\n    throw new Error(\n      \"Document unlink requires a proven full-history rotation snapshot\",\n    );\n  }\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote document link-set mutation\",\n  );\n  const [writerFetch, targetContainerFetch] = await Promise.all([\n    fetchLinkSetDocumentProjection(input.apiClient, input.documentId),\n    fetchLinkSetContainerProjection(input.apiClient, input.targetContainerId),\n  ]);\n  if (!writerFetch.projection || !targetContainerFetch.projection) {\n    for (const failure of orderedProjectionFailures([\n      writerFetch.failure,\n      targetContainerFetch.failure,\n    ])) {\n      input.onFailure?.(failure);\n    }\n    return null;\n  }\n  const writerProjection = writerFetch.projection;\n  const targetContainerProjection = targetContainerFetch.projection;\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedAt = input.signedAt ?? new Date().toISOString();\n  const materializedPlan = await prepareRemoteLinkSetMutation(\n    { ...input, resolveProjectionUserKey, signedAt },\n    writerProjection,\n    targetContainerProjection,\n  );\n  if (!materializedPlan) return null;\n  const request = await completeLinkSetMutationRequest({\n    author: input.author,\n    materializedPlan,\n    operation: input.operation,\n    rotationSnapshot: input.rotationSnapshot,\n    signedAt,\n  });\n  const completedPlan = { ...materializedPlan.plan, request };\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  const response = await submitLinkSetMutation({\n    apiClient: input.apiClient,\n    documentId: completedPlan.documentId,\n    expectedOrganizationId: completedPlan.state.organizationId,\n    onFailure: input.onFailure,\n    operation: input.operation,\n    request: completedPlan.request,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!response) {\n    return null;\n  }\n  if (input.stillCurrent?.() === false) return null;\n  return completeRemoteDocumentLinkSet({\n    apiClient: input.apiClient,\n    completedPlan,\n    execSql: input.execSql,\n    materializedPlan,\n    operation: input.operation,\n    response,\n    stillCurrent: input.stillCurrent,\n    targetContainerId: input.targetContainerId,\n    targetContainerProjection,\n    writerProjection,\n  });\n}\n\n// Every projection failure reaches the handler: the queued-move accumulator\n// classifies a vanished container from ANY coded container 404, so a document\n// fetch failure must not hide a container one (or vice versa). A 403 is\n// delivered last, so a single-slot consumer keeps the denial that parks the\n// move (row 7) while the accumulator still sees both.\nfunction orderedProjectionFailures(\n  failures: readonly (DocumentLinkSetMutationFailure | null)[],\n): DocumentLinkSetMutationFailure[] {\n  const present = failures.filter(\n    (failure): failure is DocumentLinkSetMutationFailure => failure !== null,\n  );\n  return [\n    ...present.filter((failure) => failure.status !== 403),\n    ...present.filter((failure) => failure.status === 403),\n  ];\n}\n\nfunction prepareRemoteLinkSetMutation(\n  input: Parameters<typeof relinkRemoteDocument>[0] & {\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    signedAt: string;\n  },\n  writerProjection: DocumentWriterProjectionResponse,\n  targetContainerProjection: ContainerWriterProjectionResponse,\n) {\n  return recordDocumentAuthorAccessFailure(\n    () =>\n      nullOnProjectionVerificationCancellation(() =>\n        buildMaterializedDocumentLinkSetMutationPlan({\n          author: input.author,\n          expectedSubtreeRoot: input.expectedSubtreeRoot,\n          prepareBlobRewraps: (targets) =>\n            prepareDocumentLinkBlobRewraps({\n              ...input,\n              targets,\n              targetContainerProjection,\n              writerProjection,\n            }),\n          contentKey: input.contentKey,\n          eventId: input.eventId,\n          execSql: input.execSql,\n          operation: input.operation,\n          resolveProjectionUserKey: input.resolveProjectionUserKey,\n          signedAt: input.signedAt,\n          stillCurrent: input.stillCurrent,\n          targetContainerProjection,\n          targetSecretKey: input.targetSecretKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n          writerProjection,\n        }),\n      ),\n    input.onFailure,\n  );\n}\n"]}

package/workflows/documents/orphanBlobReclaimState.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"orphanBlobReclaimState.js","sourceRoot":"","sources":["orphanBlobReclaimState.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,GAAG,IAAI,OAAO,EAGvB,CAAC;AAEJ,MAAM,UAAU,sBAAsB,CACpC,WAA0C,EAC1C,OAAgB;IAEhB,IAAI,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,mBAAmB,EAAE,IAAI,GAAG,EAAE;YAC9B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,EAAE;SAC1D,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { DocumentOrphanBlobPersistence } from \"../../data/persistence/documents/orphanBlobPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport interface OrphanBlobReclaimState {\n  deferredStorageKeys: Map<string, number>;\n  rerun: boolean;\n  running: Promise<void> | undefined;\n  sweepKey: string;\n}\n\nconst states = new WeakMap<\n  DocumentOrphanBlobPersistence,\n  WeakMap<ExecSql, OrphanBlobReclaimState>\n>();\n\nexport function orphanBlobReclaimState(\n  persistence: DocumentOrphanBlobPersistence,\n  execSql: ExecSql,\n): OrphanBlobReclaimState {\n  let connections = states.get(persistence);\n  if (!connections) {\n    connections = new WeakMap();\n    states.set(persistence, connections);\n  }\n  let state = connections.get(execSql);\n  if (!state) {\n    state = {\n      deferredStorageKeys: new Map(),\n      rerun: false,\n      running: undefined,\n      sweepKey: `sweep:document-orphans:${crypto.randomUUID()}`,\n    };\n    connections.set(execSql, state);\n  }\n  return state;\n}\n"]}

package/workflows/documents/orphanBlobReclaims.d.ts

@@ -1,6 +0,0 @@
-import type { DocumentsPersistence } from "../../data/persistence/documents/types.js";
-import type { DocumentsWorkflowRuntimeGroups } from "./runtime.js";
-type DocumentOrphanBlobReclaimRuntime = Pick<DocumentsWorkflowRuntimeGroups, "infra" | "util">;
-/** Await all requested batches; maintenance failures never fail committed writes. */
-export declare function reclaimDocumentOrphanBlobs(runtime: DocumentOrphanBlobReclaimRuntime, persistence?: DocumentsPersistence): Promise<void>;
-export {};