@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,EAEL,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,0CAA0C,GAC3C,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,kBAAkB,EAGlB,2BAA2B,EAE3B,+BAA+B,EAK/B,oBAAoB,EAEpB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uCAAuC,EAGvC,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,8BAA8B,GAM/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAElC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uCAAuC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAEL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export {\n  type DocumentSyncUpdateIsolationError,\n  type IncomingDocumentSyncUpdateValidator,\n  isDocumentSyncUpdateIsolationError,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nexport {\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n} from \"../../data/documents/shared/projection\";\nexport { persistedDocumentCreateStateFromResponse } from \"../../data/documents/shared/responses\";\nexport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n  readPullContinuation,\n} from \"../../data/documents/shared/syncPagination\";\nexport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nexport {\n  DOCUMENT_HISTORY_COMPACTION_MAX_BYTES,\n  DOCUMENT_HISTORY_COMPACTION_MAX_ROWS,\n} from \"../../data/sqlite/documentHistoryPersistence\";\nexport {\n  clearDocumentSyncFailure,\n  invalidateDocumentSyncPullContinuation,\n  recordDocumentSyncFailure,\n} from \"../../data/sqlite/documentPersistence\";\nexport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nexport { selectDocumentSyncOutgoingBatch } from \"../../data/sync/documentSyncOutgoingBatch\";\nexport { settleOutgoingPassAndDecideReArm } from \"../../data/sync/outgoingUpdateSettlement\";\nexport {\n  didRegainSyncPrerequisites,\n  isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  deleteLocalDocumentAttachment,\n  deletePendingDocumentAttachment,\n  markLocalDocumentAttachmentDetached,\n  saveLocalDocumentAttachments,\n  savePendingDocumentAttachment,\n} from \"./attachmentPersistence\";\nexport { resolveDocumentCreateAuthor } from \"./author\";\nexport { runSerializedDocumentBlobMutation } from \"./blobMutationLock\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createRemoteDocument,\n  documentWriterProjectionFromCreateResponse,\n} from \"./create\";\nexport {\n  importDocumentHistoryTailUpdates,\n  loadPersistedDocumentContent,\n  mergePersistedDocumentHistory,\n} from \"./historyContent\";\nexport { buildMaterializedDocumentLinkSetMutationPlan } from \"./linkSet\";\nexport { relinkRemoteDocument } from \"./linkSetRemote\";\nexport { reclaimDocumentOrphanBlobs } from \"./orphanBlobReclaims\";\nexport {\n  enqueuePendingDocumentUpdate,\n  listPendingDocumentUpdates,\n} from \"./pendingUpdatePersistence\";\nexport {\n  type DiscardedDocumentShellResult,\n  deletePersistedDocument,\n  discardPersistedDocumentToShell,\n} from \"./persistedDocumentRemoval\";\nexport {\n  type AttachmentRemovalRows,\n  type AttachmentStagingRows,\n  DOCUMENTS_APP_KIND,\n  type DocumentRecord,\n  type DocumentsPersistence,\n  defaultDocumentsPersistence,\n  type LocalAttachmentRecord,\n  loadPersistedDocumentStoreState,\n  type PendingAttachmentRecord,\n  type PendingAttachmentUploadIdentity,\n  type PendingUpdateInsert,\n  type PendingUpdateRecord,\n  persistDocumentState,\n  type RelinkPersistedDocumentInput,\n  runSerializedSqlMutation,\n} from \"./persistence\";\nexport {\n  createDocumentProjectionUserKeyResolver,\n  type DocumentProjectionKeyRuntime,\n  type DocumentProjectionUserKeyResolver,\n  didDocumentProjectionKeyRuntimeChange,\n} from \"./projectionKeys\";\nexport {\n  buildDocumentPurgeRequest,\n  purgeRemoteDocument,\n} from \"./purge\";\nexport type { SyncRemoteDocumentInput } from \"./readOnlySync\";\nexport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntimeGroups,\n  type DocumentsWorkflowRuntimeInfra,\n  type DocumentsWorkflowRuntimeInput,\n  type DocumentsWorkflowRuntimeInputGroups,\n} from \"./runtime\";\nexport {\n  hasDocumentUpdateEvent,\n  syncRemoteDocument,\n} from \"./sync\";\nexport type { DocumentSyncContainerRekeyBuilder } from \"./syncAttemptState\";\nexport { DocumentRawHistoryUnavailableError } from \"./syncContentKeys\";\nexport {\n  describeDocumentRevalidationFailure,\n  describeDocumentSyncSubmitFailure,\n  type TerminalSubmitFailureHandler,\n} from \"./syncFailureClassification\";\nexport { shouldClearDocumentSyncFailureAfterPass } from \"./syncFailureClearance\";\nexport {\n  type DocumentSyncLane,\n  registerDocumentSyncLane,\n  requestDocumentSyncLaneAndWait,\n} from \"./syncLane\";\nexport type { RekeyPendingUpdate } from \"./syncRecoveryRekey\";\nexport {\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n} from \"./syncTrace\";\nexport { createDocumentWriterPublicKeyResolver } from \"./writerKeys\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,EAEL,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,0CAA0C,GAC3C,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,kBAAkB,EAGlB,2BAA2B,EAE3B,+BAA+B,EAK/B,oBAAoB,EAEpB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uCAAuC,EAGvC,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,GAM/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAEL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAEhF,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export {\n  type DocumentSyncUpdateIsolationError,\n  type IncomingDocumentSyncUpdateValidator,\n  isDocumentSyncUpdateIsolationError,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nexport {\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n} from \"../../data/documents/shared/projection\";\nexport { persistedDocumentCreateStateFromResponse } from \"../../data/documents/shared/responses\";\nexport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n  readPullContinuation,\n} from \"../../data/documents/shared/syncPagination\";\nexport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nexport {\n  DOCUMENT_HISTORY_COMPACTION_MAX_BYTES,\n  DOCUMENT_HISTORY_COMPACTION_MAX_ROWS,\n} from \"../../data/sqlite/documentHistoryPersistence\";\nexport {\n  clearDocumentSyncFailure,\n  invalidateDocumentSyncPullContinuation,\n  recordDocumentSyncFailure,\n} from \"../../data/sqlite/documentPersistence\";\nexport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nexport { selectDocumentSyncOutgoingBatch } from \"../../data/sync/documentSyncOutgoingBatch\";\nexport { settleOutgoingPassAndDecideReArm } from \"../../data/sync/outgoingUpdateSettlement\";\nexport {\n  didRegainSyncPrerequisites,\n  isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  deleteLocalDocumentAttachment,\n  deletePendingDocumentAttachment,\n  markLocalDocumentAttachmentDetached,\n  saveLocalDocumentAttachments,\n  savePendingDocumentAttachment,\n} from \"./attachments/attachmentPersistence\";\nexport { runSerializedDocumentBlobMutation } from \"./attachments/blobMutationLock\";\nexport { reclaimDocumentOrphanBlobs } from \"./attachments/orphanBlobReclaims\";\nexport { resolveDocumentCreateAuthor } from \"./author\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createRemoteDocument,\n  documentWriterProjectionFromCreateResponse,\n} from \"./create\";\nexport {\n  importDocumentHistoryTailUpdates,\n  loadPersistedDocumentContent,\n  mergePersistedDocumentHistory,\n} from \"./historyContent\";\nexport { buildMaterializedDocumentLinkSetMutationPlan } from \"./linkSet\";\nexport { relinkRemoteDocument } from \"./linkSet/linkSetRemote\";\nexport {\n  enqueuePendingDocumentUpdate,\n  listPendingDocumentUpdates,\n} from \"./pendingUpdatePersistence\";\nexport {\n  type AttachmentRemovalRows,\n  type AttachmentStagingRows,\n  DOCUMENTS_APP_KIND,\n  type DocumentRecord,\n  type DocumentsPersistence,\n  defaultDocumentsPersistence,\n  type LocalAttachmentRecord,\n  loadPersistedDocumentStoreState,\n  type PendingAttachmentRecord,\n  type PendingAttachmentUploadIdentity,\n  type PendingUpdateInsert,\n  type PendingUpdateRecord,\n  persistDocumentState,\n  type RelinkPersistedDocumentInput,\n  runSerializedSqlMutation,\n} from \"./persistence\";\nexport {\n  createDocumentProjectionUserKeyResolver,\n  type DocumentProjectionKeyRuntime,\n  type DocumentProjectionUserKeyResolver,\n  didDocumentProjectionKeyRuntimeChange,\n} from \"./projectionKeys\";\nexport {\n  buildDocumentPurgeRequest,\n  purgeRemoteDocument,\n} from \"./purge\";\nexport {\n  type DiscardedDocumentShellResult,\n  deletePersistedDocument,\n  discardPersistedDocumentToShell,\n} from \"./purge/persistedDocumentRemoval\";\nexport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntimeGroups,\n  type DocumentsWorkflowRuntimeInfra,\n  type DocumentsWorkflowRuntimeInput,\n  type DocumentsWorkflowRuntimeInputGroups,\n} from \"./runtime\";\nexport {\n  hasDocumentUpdateEvent,\n  syncRemoteDocument,\n} from \"./sync\";\nexport type { SyncRemoteDocumentInput } from \"./sync/readOnlySync\";\nexport type { DocumentSyncContainerRekeyBuilder } from \"./sync/syncAttemptState\";\nexport {\n  type DocumentSyncLane,\n  registerDocumentSyncLane,\n  requestDocumentSyncLaneAndWait,\n} from \"./sync/syncLane\";\nexport {\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n} from \"./sync/syncTrace\";\nexport {\n  describeDocumentRevalidationFailure,\n  describeDocumentSyncSubmitFailure,\n  type TerminalSubmitFailureHandler,\n} from \"./syncFailures/syncFailureClassification\";\nexport { shouldClearDocumentSyncFailureAfterPass } from \"./syncFailures/syncFailureClearance\";\nexport { DocumentRawHistoryUnavailableError } from \"./syncPlan/syncContentKeys\";\nexport type { RekeyPendingUpdate } from \"./syncRekeys/syncRecoveryRekey\";\nexport { createDocumentWriterPublicKeyResolver } from \"./writerKeys\";\n"]}

package/workflows/documents/linkSet/index.d.ts

@@ -0,0 +1,20 @@
+import { type DocumentContentKeyTarget } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import { type BuildDocumentLinkSetMutationPlanInput, type DocumentCreateAuthor, type DocumentLinkSetMutationOperation, type MaterializedDocumentLinkSetMutationPlan, type ProjectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type SubtreePurgeRoot } from "../purge/subtreePurgeScope.js";
+export declare function assertDocumentLinkTargetCapacity(currentTargetCount: number): void;
+export declare function assertDocumentLinkAuthorizationPathCapacity(currentPathLengths: readonly number[], targetPathLength: number): void;
+export declare function buildMaterializedDocumentLinkSetMutationPlan(input: {
+    author: DocumentCreateAuthor;
+    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
+    prepareBlobRewraps: (targets: readonly DocumentContentKeyTarget[]) => Promise<BuildDocumentLinkSetMutationPlanInput["blobRewraps"]>;
+    contentKey?: Uint8Array | undefined;
+    eventId?: string | undefined;
+    execSql?: ExecSql | undefined;
+    operation: DocumentLinkSetMutationOperation;
+    signedAt?: string | undefined;
+    targetContainerProjection: ContainerWriterProjectionResponse;
+    targetSecretKey: Uint8Array;
+    writerProjection: DocumentWriterProjectionResponse;
+} & ProjectionVerificationOptions): Promise<MaterializedDocumentLinkSetMutationPlan>;

package/workflows/documents/linkSet/index.js

@@ -0,0 +1,290 @@
+import { computeAccessManifestHash, computeDocumentContentKeyTargetHash, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveDocumentLinkSetManifest, wrapContentKey, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
+import { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, } from "../../../internal/validators/util/index.js";
+import { assertContainerKekPathCurrent, assertDocumentKekPathsCurrent, } from "../../../data/documents/shared/containerKekCurrency.js";
+import { buildDocumentLinkSetEventPlan } from "../../../data/documents/shared/events.js";
+import { assertDocumentWriterProjectionConsistent, collectContainerKeksForDocumentSync, containerPathRefs, currentDocumentTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, unwrapContainerKekPath, unwrapDocumentContentKeyFromWriterProjection, verifiedDocumentWrapTargets, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent, describeDocumentTargetKek, sortDocumentTargets, targetKey, uniqueSortedStrings, } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { assertSubtreePurgePath, } from "../purge/subtreePurgeScope.js";
+import { assertDocumentLinkAuthorAccess, verifyDocumentLinkSetCurrentPolicies, } from "./linkSetAuthority.js";
+function deriveDocumentLinkSetTargetState(input) {
+    const currentTargets = currentDocumentTargets(input.writerProjection);
+    const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
+    const target = deriveDocumentTargetFromProjection(input.targetContainerProjection);
+    const currentTarget = currentTargets.find((candidate) => candidate.containerId === target.containerId);
+    if (input.operation === "link") {
+        if (currentTarget) {
+            throw new Error("Document link target is already linked");
+        }
+        assertDocumentLinkTargetCapacity(currentTargets.length);
+        assertDocumentLinkAuthorizationPathCapacity(input.writerProjection.authorizingContainerPaths.map((projection) => projection.path.length), input.targetContainerProjection.path.length);
+        return {
+            currentTargets,
+            linkedContainerIds: uniqueSortedStrings([
+                ...currentLinkedContainerIds,
+                target.containerId,
+            ]),
+            target,
+            targets: sortDocumentTargets([...currentTargets, target]),
+        };
+    }
+    if (!currentTarget) {
+        throw new Error("Document unlink target is not linked");
+    }
+    if (targetKey(currentTarget) !== targetKey(target)) {
+        throw new Error("Document unlink target projection is stale");
+    }
+    const linkedContainerIds = currentLinkedContainerIds.filter((containerId) => containerId !== target.containerId);
+    if (linkedContainerIds.length === 0) {
+        throw new Error("Document unlink must leave a linked container");
+    }
+    return {
+        currentTargets,
+        linkedContainerIds,
+        target,
+        targets: currentTargets.filter((candidate) => candidate.containerId !== target.containerId),
+    };
+}
+export function assertDocumentLinkTargetCapacity(currentTargetCount) {
+    if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {
+        throw new RangeError(`A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`);
+    }
+}
+export function assertDocumentLinkAuthorizationPathCapacity(currentPathLengths, targetPathLength) {
+    const totalReferences = currentPathLengths.reduce((total, length) => total + length, targetPathLength);
+    if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {
+        throw new RangeError(`Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`);
+    }
+}
+async function wrapDocumentContentKeyForTargets(input) {
+    return Promise.all(sortDocumentTargets(input.targets).map(async (target) => {
+        const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);
+        if (!targetKek) {
+            throw new Error(`Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`);
+        }
+        const wrapped = await wrapContentKey(input.contentKey, targetKek, {
+            kind: "Document",
+            objectId: input.documentId,
+            contentKeyEpoch: input.contentKeyEpoch,
+            containerId: target.containerId,
+            containerKeyEpochId: target.containerKeyEpochId,
+        });
+        return {
+            ...target,
+            wrappedKey: bytesToBase64(wrapped.ciphertext),
+            wrappingMetadata: {
+                suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,
+                iv: bytesToBase64(wrapped.iv),
+            },
+        };
+    }));
+}
+// Resolve the organization a link/unlink mutation belongs to: the document's
+// own org (from its manifest), which must equal the target container's org —
+// both are owned by the same organization. The acting member's personal org is
+// intentionally not part of this check; a member may link documents within any
+// org they belong to. Returns the document org so the plan stamps it onto the
+// signed event and manifest rather than the author's org.
+async function resolveDocumentLinkSetMutationOrganization(input) {
+    const manifestIdentity = await assertDocumentManifestBundleConsistent({
+        bundle: input.writerProjection.documentManifest,
+        label: "Document link-set manifest",
+    });
+    if (manifestIdentity.organizationId !==
+        input.targetContainerProjection.organizationId) {
+        throw new Error("Document target container organization mismatch");
+    }
+    return manifestIdentity.organizationId;
+}
+function readDocumentLinkSetPreviousEpoch(writerProjection) {
+    const previousState = writerProjection.documentManifest.state;
+    const previousEpoch = isPlainRecord(previousState)
+        ? Reflect.get(previousState, "epoch")
+        : undefined;
+    if (typeof previousEpoch !== "number" ||
+        !Number.isInteger(previousEpoch) ||
+        previousEpoch <= 0) {
+        throw new Error("Document link-set previous epoch is invalid");
+    }
+    return previousEpoch;
+}
+async function buildDocumentLinkSetMutationPlan({ author, blobRewraps, contentKeyEpoch, eventId = crypto.randomUUID(), operation, signedAt = new Date().toISOString(), targetContainerProjection, targetEnvelopes, writerProjection, }) {
+    const organizationId = await resolveDocumentLinkSetMutationOrganization({
+        targetContainerProjection,
+        writerProjection,
+    });
+    const targetState = deriveDocumentLinkSetTargetState({
+        operation,
+        targetContainerProjection,
+        writerProjection,
+    });
+    const targetEnvelopesForRequest = mergeTargetEnvelopes(targetState.targets, targetEnvelopes);
+    const targetContainerPathRefs = containerPathRefs(targetContainerProjection.path);
+    const eventPlan = await buildDocumentLinkSetEventPlan({
+        author,
+        blobRewraps,
+        eventId,
+        operation,
+        organizationId,
+        signedAt,
+        targetContainerPathRefs,
+        targetState,
+        writerProjection,
+    });
+    const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);
+    const state = {
+        version: 1,
+        documentId: writerProjection.documentId,
+        organizationId,
+        epoch: previousEpoch + 1,
+        previousManifestHash: writerProjection.documentManifest.manifestHash,
+        eventHash: eventPlan.eventHash,
+        linkedContainerIds: [...targetState.linkedContainerIds],
+    };
+    const manifest = await deriveDocumentLinkSetManifest(state);
+    const manifestHash = await computeAccessManifestHash(manifest);
+    const targetHash = await computeDocumentContentKeyTargetHash(targetState.targets);
+    return {
+        body: eventPlan.body,
+        contentKeyEpoch,
+        documentId: writerProjection.documentId,
+        event: eventPlan.event,
+        eventHash: eventPlan.eventHash,
+        manifest,
+        manifestHash,
+        operation,
+        request: {
+            event: readCanonicalRecord(eventPlan.event, "Document link-set event"),
+            body: readCanonicalRecord(eventPlan.body, "Document link-set body"),
+            expectedManifestHash: manifestHash,
+            manifest: readCanonicalRecord(manifest, "Document link-set manifest"),
+            targetContainerPathRefs,
+            authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,
+            contentKeyBundle: {
+                contentKeyEpoch,
+                linkSetManifestHash: manifestHash,
+                targetHash,
+                targets: targetEnvelopesForRequest,
+            },
+        },
+        state,
+        targetHash,
+        targets: sortDocumentTargets(targetState.targets),
+    };
+}
+export async function buildMaterializedDocumentLinkSetMutationPlan(input) {
+    const verificationOptions = projectionVerificationOptions(input);
+    const principalPolicyCache = new Map();
+    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
+        execSql: input.execSql,
+        principalPolicyCache,
+        ...verificationOptions,
+    });
+    await verifyDocumentLinkSetCurrentPolicies({
+        execSql: input.execSql,
+        principalPolicyCache,
+        targetContainerProjection: input.targetContainerProjection,
+        writerProjection: input.writerProjection,
+        ...verificationOptions,
+    });
+    assertSubtreePurgePath(input.targetContainerProjection.path, input.expectedSubtreeRoot);
+    if (input.resolveProjectionUserKey)
+        assertDocumentLinkAuthorAccess({
+            ...input,
+            principalPolicies: [...principalPolicyCache.values()],
+        });
+    const targetState = deriveDocumentLinkSetTargetState({
+        operation: input.operation,
+        targetContainerProjection: input.targetContainerProjection,
+        writerProjection: input.writerProjection,
+    });
+    assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);
+    const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({
+        execSql: input.execSql,
+        secretKey: input.targetSecretKey,
+        writerProjection: input.writerProjection,
+        ...verificationOptions,
+    });
+    const contentKeyRotated = input.operation === "unlink";
+    const contentKey = contentKeyRotated
+        ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))
+        : currentContentKey;
+    if (contentKey.byteLength !== 32) {
+        throw new Error("Document content key must be 32 bytes");
+    }
+    // A link carries the existing envelopes forward at the same epoch; an
+    // unlink rotates to a fresh key at the next one.
+    const contentKeyEpoch = input.writerProjection.contentKeyBundle.contentKeyEpoch +
+        (contentKeyRotated ? 1 : 0);
+    const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {
+        contentKey,
+        contentKeyEpoch,
+        targetState,
+    });
+    const plan = await buildDocumentLinkSetMutationPlan({
+        author: input.author,
+        blobRewraps: await input.prepareBlobRewraps(targetState.targets),
+        contentKeyEpoch,
+        eventId: input.eventId,
+        operation: input.operation,
+        signedAt: input.signedAt,
+        targetContainerProjection: input.targetContainerProjection,
+        targetEnvelopes,
+        writerProjection: input.writerProjection,
+    });
+    return {
+        contentKey,
+        contentKeyRotated,
+        plan,
+    };
+}
+async function buildLinkSetTargetEnvelopes(input, wrap) {
+    const verificationOptions = projectionVerificationOptions(input);
+    const sealing = {
+        contentKey: wrap.contentKey,
+        contentKeyEpoch: wrap.contentKeyEpoch,
+        documentId: input.writerProjection.documentId,
+    };
+    if (input.operation === "link") {
+        return [
+            ...input.writerProjection.contentKeyBundle.targets,
+            ...(await wrapDocumentContentKeyForTargets({
+                ...sealing,
+                keksByEpochId: await unwrapContainerKekPath({
+                    execSql: input.execSql,
+                    projection: input.targetContainerProjection,
+                    secretKey: input.targetSecretKey,
+                    ...verificationOptions,
+                }),
+                targets: [wrap.targetState.target],
+            })),
+        ];
+    }
+    return wrapDocumentContentKeyForTargets({
+        ...sealing,
+        keksByEpochId: (await collectContainerKeksForDocumentSync({
+            execSql: input.execSql,
+            secretKey: input.targetSecretKey,
+            writerProjection: input.writerProjection,
+            ...verificationOptions,
+        })).keksByEpochId,
+        // The rotated key is wrapped only to verified current heads of the
+        // remaining linked containers, never to a server-listed epoch.
+        targets: verifiedDocumentWrapTargets({
+            linkedContainerIds: wrap.targetState.linkedContainerIds,
+            serverTargets: wrap.targetState.targets,
+            writerProjection: input.writerProjection,
+        }),
+    });
+}
+function assertLinkSetWriteKeksCurrent(input, linkedContainerIds) {
+    // Unlink can escape a stale branch; only recipients of the successor key must be current.
+    assertDocumentKekPathsCurrent(input.writerProjection, new Set(linkedContainerIds));
+    if (input.operation === "link") {
+        assertContainerKekPathCurrent(input.targetContainerProjection.containerKeks);
+    }
+}
+//# sourceMappingURL=index.js.map

package/workflows/documents/linkSet/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAG/B,6BAA6B,EAC7B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,sBAAsB,EACtB,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,mBAAmB,EACnB,SAAS,EACT,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAQL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAE5B,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,yBAAyB,GAAG,0CAA0C,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxD,2CAA2C,CACzC,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAClD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CACvC,EACD,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAC5C,CAAC;QAEF,OAAO;YACL,cAAc;YACd,kBAAkB,EAAE,mBAAmB,CAAC;gBACtC,GAAG,yBAAyB;gBAC5B,MAAM,CAAC,WAAW;aACnB,CAAC;YACF,MAAM;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CACpD,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,kBAA0B;IAE1B,IAAI,kBAAkB,IAAI,qCAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,4CAA4C,qCAAqC,aAAa,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,kBAAqC,EACrC,gBAAwB;IAExB,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,EACjC,gBAAgB,CACjB,CAAC;IACF,IAAI,eAAe,GAAG,yCAAyC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,2CAA2C,yCAAyC,2BAA2B,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAM/C;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kDAAkD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;YAChE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,KAAK,UAAU,0CAA0C,CAAC,KAGzD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IACE,gBAAgB,CAAC,cAAc;QAC/B,KAAK,CAAC,yBAAyB,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,gBAAgB,CAAC,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,gCAAgC,CACvC,gBAAkD;IAElD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,EAC9C,MAAM,EACN,WAAW,EACX,eAAe,EACf,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,yBAAyB,EACzB,eAAe,EACf,gBAAgB,GACsB;IACtC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS;QACT,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,oBAAoB,CACpD,WAAW,CAAC,OAAO,EACnB,eAAe,CAChB,CAAC;IACF,MAAM,uBAAuB,GAAG,iBAAiB,CAC/C,yBAAyB,CAAC,IAAI,CAC/B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,MAAM;QACN,WAAW;QACX,OAAO;QACP,SAAS;QACT,cAAc;QACd,QAAQ;QACR,uBAAuB;QACvB,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAiC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,cAAc;QACd,KAAK,EAAE,aAAa,GAAG,CAAC;QACxB,oBAAoB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QACpE,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,kBAAkB,EAAE,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,WAAW,CAAC,OAAO,CACpB,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,OAAO,EAAE;YACP,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC;YACtE,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC;YACnE,oBAAoB,EAAE,YAAY;YAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;YACrE,uBAAuB;YACvB,4BAA4B,EAAE,SAAS,CAAC,4BAA4B;YACpE,gBAAgB,EAAE;gBAChB,eAAe;gBACf,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,OAAO,EAAE,yBAAyB;aACnC;SACF;QACD,KAAK;QACL,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAciC;IAEjC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC7D,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,sBAAsB,CACpB,KAAK,CAAC,yBAAyB,CAAC,IAAI,EACpC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB;QAChC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,MAAM,4CAA4C,CAAC;QAC3E,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QACvD,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE;QAC/D,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC;QAChE,eAAe;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyE,EACzE,IAIC;IAED,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;KAC9C,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO;YAClD,GAAG,CAAC,MAAM,gCAAgC,CAAC;gBACzC,GAAG,OAAO;gBACV,aAAa,EAAE,MAAM,sBAAsB,CAAC;oBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,yBAAyB;oBAC3C,SAAS,EAAE,KAAK,CAAC,eAAe;oBAChC,GAAG,mBAAmB;iBACvB,CAAC;gBACF,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,CAAC;QACtC,GAAG,OAAO;QACV,aAAa,EAAE,CACb,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,mBAAmB;SACvB,CAAC,CACH,CAAC,aAAa;QACf,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,2BAA2B,CAAC;YACnC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;YACvD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACvC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,KAGC,EACD,kBAAqC;IAErC,0FAA0F;IAC1F,6BAA6B,CAC3B,KAAK,CAAC,gBAAgB,EACtB,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,6BAA6B,CAC3B,KAAK,CAAC,yBAAyB,CAAC,aAAa,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkSetManifestState,\n  deriveDocumentLinkSetManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n} from \"@tearleads/validators/util\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"../../../data/documents/shared/containerKekCurrency\";\nimport { buildDocumentLinkSetEventPlan } from \"../../../data/documents/shared/events\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  collectContainerKeksForDocumentSync,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyFromWriterProjection,\n  verifiedDocumentWrapTargets,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  describeDocumentTargetKek,\n  sortDocumentTargets,\n  targetKey,\n  uniqueSortedStrings,\n} from \"../../../data/documents/shared/readers\";\nimport {\n  type BuildDocumentLinkSetMutationPlanInput,\n  type DocumentCreateAuthor,\n  type DocumentLinkSetMutationOperation,\n  type DocumentLinkSetMutationPlan,\n  type DocumentLinkSetTargetState,\n  type MaterializedDocumentLinkSetMutationPlan,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"../purge/subtreePurgeScope\";\nimport {\n  assertDocumentLinkAuthorAccess,\n  verifyDocumentLinkSetCurrentPolicies,\n} from \"./linkSetAuthority\";\n\nfunction deriveDocumentLinkSetTargetState(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentLinkSetTargetState {\n  const currentTargets = currentDocumentTargets(input.writerProjection);\n  const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  const target = deriveDocumentTargetFromProjection(\n    input.targetContainerProjection,\n  );\n  const currentTarget = currentTargets.find(\n    (candidate) => candidate.containerId === target.containerId,\n  );\n\n  if (input.operation === \"link\") {\n    if (currentTarget) {\n      throw new Error(\"Document link target is already linked\");\n    }\n    assertDocumentLinkTargetCapacity(currentTargets.length);\n    assertDocumentLinkAuthorizationPathCapacity(\n      input.writerProjection.authorizingContainerPaths.map(\n        (projection) => projection.path.length,\n      ),\n      input.targetContainerProjection.path.length,\n    );\n\n    return {\n      currentTargets,\n      linkedContainerIds: uniqueSortedStrings([\n        ...currentLinkedContainerIds,\n        target.containerId,\n      ]),\n      target,\n      targets: sortDocumentTargets([...currentTargets, target]),\n    };\n  }\n\n  if (!currentTarget) {\n    throw new Error(\"Document unlink target is not linked\");\n  }\n  if (targetKey(currentTarget) !== targetKey(target)) {\n    throw new Error(\"Document unlink target projection is stale\");\n  }\n\n  const linkedContainerIds = currentLinkedContainerIds.filter(\n    (containerId) => containerId !== target.containerId,\n  );\n  if (linkedContainerIds.length === 0) {\n    throw new Error(\"Document unlink must leave a linked container\");\n  }\n\n  return {\n    currentTargets,\n    linkedContainerIds,\n    target,\n    targets: currentTargets.filter(\n      (candidate) => candidate.containerId !== target.containerId,\n    ),\n  };\n}\n\nexport function assertDocumentLinkTargetCapacity(\n  currentTargetCount: number,\n): void {\n  if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {\n    throw new RangeError(\n      `A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`,\n    );\n  }\n}\n\nexport function assertDocumentLinkAuthorizationPathCapacity(\n  currentPathLengths: readonly number[],\n  targetPathLength: number,\n): void {\n  const totalReferences = currentPathLengths.reduce(\n    (total, length) => total + length,\n    targetPathLength,\n  );\n  if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {\n    throw new RangeError(\n      `Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`,\n    );\n  }\n}\n\nasync function wrapDocumentContentKeyForTargets(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  targets: readonly DocumentContentKeyTarget[];\n}): Promise<DocumentContentKeyTargetEnvelope[]> {\n  return Promise.all(\n    sortDocumentTargets(input.targets).map(async (target) => {\n      const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);\n      if (!targetKek) {\n        throw new Error(\n          `Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n\n      const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n        kind: \"Document\",\n        objectId: input.documentId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: target.containerId,\n        containerKeyEpochId: target.containerKeyEpochId,\n      });\n      return {\n        ...target,\n        wrappedKey: bytesToBase64(wrapped.ciphertext),\n        wrappingMetadata: {\n          suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n          iv: bytesToBase64(wrapped.iv),\n        },\n      };\n    }),\n  );\n}\n\n// Resolve the organization a link/unlink mutation belongs to: the document's\n// own org (from its manifest), which must equal the target container's org —\n// both are owned by the same organization. The acting member's personal org is\n// intentionally not part of this check; a member may link documents within any\n// org they belong to. Returns the document org so the plan stamps it onto the\n// signed event and manifest rather than the author's org.\nasync function resolveDocumentLinkSetMutationOrganization(input: {\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<string> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document link-set manifest\",\n  });\n  if (\n    manifestIdentity.organizationId !==\n    input.targetContainerProjection.organizationId\n  ) {\n    throw new Error(\"Document target container organization mismatch\");\n  }\n\n  return manifestIdentity.organizationId;\n}\n\nfunction readDocumentLinkSetPreviousEpoch(\n  writerProjection: DocumentWriterProjectionResponse,\n): number {\n  const previousState = writerProjection.documentManifest.state;\n  const previousEpoch = isPlainRecord(previousState)\n    ? Reflect.get(previousState, \"epoch\")\n    : undefined;\n  if (\n    typeof previousEpoch !== \"number\" ||\n    !Number.isInteger(previousEpoch) ||\n    previousEpoch <= 0\n  ) {\n    throw new Error(\"Document link-set previous epoch is invalid\");\n  }\n\n  return previousEpoch;\n}\n\nasync function buildDocumentLinkSetMutationPlan({\n  author,\n  blobRewraps,\n  contentKeyEpoch,\n  eventId = crypto.randomUUID(),\n  operation,\n  signedAt = new Date().toISOString(),\n  targetContainerProjection,\n  targetEnvelopes,\n  writerProjection,\n}: BuildDocumentLinkSetMutationPlanInput): Promise<DocumentLinkSetMutationPlan> {\n  const organizationId = await resolveDocumentLinkSetMutationOrganization({\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation,\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetEnvelopesForRequest = mergeTargetEnvelopes(\n    targetState.targets,\n    targetEnvelopes,\n  );\n  const targetContainerPathRefs = containerPathRefs(\n    targetContainerProjection.path,\n  );\n  const eventPlan = await buildDocumentLinkSetEventPlan({\n    author,\n    blobRewraps,\n    eventId,\n    operation,\n    organizationId,\n    signedAt,\n    targetContainerPathRefs,\n    targetState,\n    writerProjection,\n  });\n  const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);\n\n  const state: DocumentLinkSetManifestState = {\n    version: 1,\n    documentId: writerProjection.documentId,\n    organizationId,\n    epoch: previousEpoch + 1,\n    previousManifestHash: writerProjection.documentManifest.manifestHash,\n    eventHash: eventPlan.eventHash,\n    linkedContainerIds: [...targetState.linkedContainerIds],\n  };\n  const manifest = await deriveDocumentLinkSetManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const targetHash = await computeDocumentContentKeyTargetHash(\n    targetState.targets,\n  );\n\n  return {\n    body: eventPlan.body,\n    contentKeyEpoch,\n    documentId: writerProjection.documentId,\n    event: eventPlan.event,\n    eventHash: eventPlan.eventHash,\n    manifest,\n    manifestHash,\n    operation,\n    request: {\n      event: readCanonicalRecord(eventPlan.event, \"Document link-set event\"),\n      body: readCanonicalRecord(eventPlan.body, \"Document link-set body\"),\n      expectedManifestHash: manifestHash,\n      manifest: readCanonicalRecord(manifest, \"Document link-set manifest\"),\n      targetContainerPathRefs,\n      authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,\n      contentKeyBundle: {\n        contentKeyEpoch,\n        linkSetManifestHash: manifestHash,\n        targetHash,\n        targets: targetEnvelopesForRequest,\n      },\n    },\n    state,\n    targetHash,\n    targets: sortDocumentTargets(targetState.targets),\n  };\n}\n\nexport async function buildMaterializedDocumentLinkSetMutationPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n    prepareBlobRewraps: (\n      targets: readonly DocumentContentKeyTarget[],\n    ) => Promise<BuildDocumentLinkSetMutationPlanInput[\"blobRewraps\"]>;\n    contentKey?: Uint8Array | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    operation: DocumentLinkSetMutationOperation;\n    signedAt?: string | undefined;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentLinkSetMutationPlan> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const principalPolicyCache: PrincipalPolicyCache = new Map();\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    execSql: input.execSql,\n    principalPolicyCache,\n    ...verificationOptions,\n  });\n  await verifyDocumentLinkSetCurrentPolicies({\n    execSql: input.execSql,\n    principalPolicyCache,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  assertSubtreePurgePath(\n    input.targetContainerProjection.path,\n    input.expectedSubtreeRoot,\n  );\n  if (input.resolveProjectionUserKey)\n    assertDocumentLinkAuthorAccess({\n      ...input,\n      principalPolicies: [...principalPolicyCache.values()],\n    });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation: input.operation,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n  });\n  assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);\n  const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  const contentKeyRotated = input.operation === \"unlink\";\n  const contentKey = contentKeyRotated\n    ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))\n    : currentContentKey;\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n  // A link carries the existing envelopes forward at the same epoch; an\n  // unlink rotates to a fresh key at the next one.\n  const contentKeyEpoch =\n    input.writerProjection.contentKeyBundle.contentKeyEpoch +\n    (contentKeyRotated ? 1 : 0);\n  const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {\n    contentKey,\n    contentKeyEpoch,\n    targetState,\n  });\n\n  const plan = await buildDocumentLinkSetMutationPlan({\n    author: input.author,\n    blobRewraps: await input.prepareBlobRewraps(targetState.targets),\n    contentKeyEpoch,\n    eventId: input.eventId,\n    operation: input.operation,\n    signedAt: input.signedAt,\n    targetContainerProjection: input.targetContainerProjection,\n    targetEnvelopes,\n    writerProjection: input.writerProjection,\n  });\n\n  return {\n    contentKey,\n    contentKeyRotated,\n    plan,\n  };\n}\n\nasync function buildLinkSetTargetEnvelopes(\n  input: Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n  wrap: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    targetState: ReturnType<typeof deriveDocumentLinkSetTargetState>;\n  },\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const sealing = {\n    contentKey: wrap.contentKey,\n    contentKeyEpoch: wrap.contentKeyEpoch,\n    documentId: input.writerProjection.documentId,\n  };\n  if (input.operation === \"link\") {\n    return [\n      ...input.writerProjection.contentKeyBundle.targets,\n      ...(await wrapDocumentContentKeyForTargets({\n        ...sealing,\n        keksByEpochId: await unwrapContainerKekPath({\n          execSql: input.execSql,\n          projection: input.targetContainerProjection,\n          secretKey: input.targetSecretKey,\n          ...verificationOptions,\n        }),\n        targets: [wrap.targetState.target],\n      })),\n    ];\n  }\n  return wrapDocumentContentKeyForTargets({\n    ...sealing,\n    keksByEpochId: (\n      await collectContainerKeksForDocumentSync({\n        execSql: input.execSql,\n        secretKey: input.targetSecretKey,\n        writerProjection: input.writerProjection,\n        ...verificationOptions,\n      })\n    ).keksByEpochId,\n    // The rotated key is wrapped only to verified current heads of the\n    // remaining linked containers, never to a server-listed epoch.\n    targets: verifiedDocumentWrapTargets({\n      linkedContainerIds: wrap.targetState.linkedContainerIds,\n      serverTargets: wrap.targetState.targets,\n      writerProjection: input.writerProjection,\n    }),\n  });\n}\n\nfunction assertLinkSetWriteKeksCurrent(\n  input: Pick<\n    Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n    \"writerProjection\" | \"targetContainerProjection\" | \"operation\"\n  >,\n  linkedContainerIds: readonly string[],\n): void {\n  // Unlink can escape a stale branch; only recipients of the successor key must be current.\n  assertDocumentKekPathsCurrent(\n    input.writerProjection,\n    new Set(linkedContainerIds),\n  );\n  if (input.operation === \"link\") {\n    assertContainerKekPathCurrent(\n      input.targetContainerProjection.containerKeks,\n    );\n  }\n}\n"]}

package/workflows/documents/linkSet/linkSetAuthority.js

@@ -0,0 +1,61 @@
+import { assertContainerAuthorAccess, ContainerAuthorAccessError, } from "../../../data/containers/shared/authorAccess.js";
+import { readLinkedContainerIdsFromDocumentManifest } from "../../../data/documents/shared/projection.js";
+import { resolveProjectionVerifier, } from "../../../data/documents/shared/types.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+/** Both paths have been verified; a readable proof does not authorize a link. */
+export function assertDocumentLinkAuthorAccess(input) {
+    const author = {
+        ...input.author,
+        organizationId: input.targetContainerProjection.organizationId,
+    };
+    const permission = {
+        author,
+        minimumAccess: "write",
+        principalPolicies: input.principalPolicies,
+    };
+    assertContainerAuthorAccess({
+        ...permission,
+        projection: input.targetContainerProjection,
+    });
+    const linked = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
+    for (const projection of documentContainerProjections(input.writerProjection)) {
+        if (!linked.includes(projection.containerId))
+            continue;
+        try {
+            assertContainerAuthorAccess({ ...permission, projection });
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof ContainerAuthorAccessError))
+                throw error;
+        }
+    }
+    throw new ContainerAuthorAccessError("Document signer lacks write access through a linked container");
+}
+/** Current write authorization needs full policies for the readable paths. */
+export async function verifyDocumentLinkSetCurrentPolicies(input) {
+    resolveProjectionVerifier(input, "Document link-set current policies");
+    if (input.trustedLocalProjection === true)
+        return;
+    try {
+        for (const projection of [
+            input.targetContainerProjection,
+            ...documentContainerProjections(input.writerProjection),
+        ]) {
+            await collectContainerWriterProjectionPrincipalPolicies({
+                execSql: input.execSql,
+                principalPolicyCache: input.principalPolicyCache,
+                projection,
+                resolveUserKey: input.resolveProjectionUserKey,
+                stillCurrent: input.stillCurrent,
+                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            });
+        }
+    }
+    catch (error) {
+        throwKeyingVerificationErrorWithContext(error, "Document link-set current policy verification failed");
+    }
+}
+//# sourceMappingURL=linkSetAuthority.js.map

package/workflows/documents/linkSet/linkSetAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iDAAiD,GAElD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kFAAkF,CAAC;AAChI,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAI3G,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/document/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}

package/workflows/documents/linkSet/linkSetBlobRewraps.js

@@ -0,0 +1,143 @@
+import { BLOB_CONTENT_KEY_WRAP_SUITE, wrapContentKey, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { deriveDocumentTargetFromProjection, unwrapContainerKekPath, } from "../../../data/documents/shared/projection.js";
+import { assertEqualBytes, targetKey, } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { readCanonicalJson } from "../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { createAttachmentProofReader } from "../../blobs/verification/attachmentDecryptor.js";
+import { createAttachmentKeyAuthenticator } from "../../blobs/verification/attachmentKeyAuthenticator.js";
+import { verifyRetainedAttachment } from "../../blobs/verification/retainedAttachmentVerification.js";
+/** Authenticate the existing bytes before propagating their DEK to a new scope. */
+export async function prepareDocumentLinkBlobRewraps(input) {
+    const documentId = input.writerProjection.documentId;
+    const bindings = await input.apiClient.listDocumentAttachments(documentId);
+    // The API refuses the link unless every active binding is rewrapped, so an
+    // unavailable listing (offline, or a 409 while a bind is mid-flight) is a
+    // retryable availability failure of this mutation, not integrity evidence.
+    if (!bindings)
+        throw new ProjectionDependencyUnavailableError("Document attachments are unavailable for relinking");
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (bindings.length === 0)
+        return [];
+    const keks = await collectRelinkKeks(input);
+    const authenticateKey = createAttachmentKeyAuthenticator(input.apiClient, documentId);
+    const verifyRetained = createAttachmentProofReader(input.apiClient, documentId, verifyRetainedAttachment);
+    const rewrapByBlob = new Map();
+    for (const binding of bindings) {
+        const verification = {
+            binding,
+            expectedDocumentId: documentId,
+            expectedSlotId: binding.slotId,
+            execSql: input.execSql,
+            resolveProjectionUserKey: requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Attachment relink"),
+            targetSecretKey: input.targetSecretKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            writerProjection: input.writerProjection,
+        };
+        const needsKey = input.targets.some((target) => !retainedTarget(binding, target, documentId));
+        const contentKey = needsKey ? await authenticateKey(verification) : null;
+        if (!needsKey)
+            await verifyRetained(verification);
+        const targets = await Promise.all(input.targets.map(async (target) => {
+            const previous = retainedTarget(binding, target, documentId);
+            if (previous)
+                return {
+                    ...previous,
+                    ...target,
+                    wrappingMetadata: readCanonicalJson(previous.wrappingMetadata, "Attachment wrap metadata"),
+                };
+            const kek = keks.get(targetKey(target));
+            if (!kek)
+                throw new Error("Attachment destination is not a verified current container head");
+            if (!contentKey)
+                throw new Error("Attachment content key is unavailable");
+            return wrapBlobKeyForTarget({
+                binding,
+                contentKey,
+                documentId,
+                kek,
+                target,
+            });
+        }));
+        const rewrap = rewrapByBlob.get(binding.blobId) ?? {
+            blobId: binding.blobId,
+            contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,
+            targets: [],
+        };
+        if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)
+            throw new Error("Attachment content epoch changed during relinking");
+        rewrap.targets.push(...targets);
+        rewrapByBlob.set(binding.blobId, rewrap);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+    }
+    return [...rewrapByBlob.values()].sort(compareBlobIds);
+}
+async function wrapBlobKeyForTarget(input) {
+    const { binding, target } = input;
+    const wrapped = await wrapContentKey(input.contentKey, input.kek, {
+        kind: "Blob",
+        objectId: binding.blobId,
+        contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,
+        containerId: target.containerId,
+        containerKeyEpochId: target.containerKeyEpochId,
+    });
+    return {
+        ...target,
+        bindingId: binding.bindingId,
+        documentId: input.documentId,
+        wrappedKey: bytesToBase64(wrapped.ciphertext),
+        wrappingMetadata: {
+            suite: BLOB_CONTENT_KEY_WRAP_SUITE,
+            iv: bytesToBase64(wrapped.iv),
+        },
+    };
+}
+function retainedTarget(binding, target, documentId) {
+    return binding.contentKeyBundle.targets.find((candidate) => candidate.bindingId === binding.bindingId &&
+        candidate.documentId === documentId &&
+        candidate.containerId === target.containerId &&
+        candidate.containerKeyEpochId === target.containerKeyEpochId);
+}
+async function collectRelinkKeks(input) {
+    const keks = new Map();
+    for (const projection of [
+        ...documentContainerProjections(input.writerProjection),
+        input.targetContainerProjection,
+    ]) {
+        const keys = await unwrapContainerKekPath({
+            projection,
+            secretKey: input.targetSecretKey,
+            execSql: input.execSql,
+            ...projectionVerificationOptions(input),
+        });
+        // Every node of this verified path has a current signed head. Historical
+        // keyring entries may open source bytes, but never enter the destination map.
+        for (const [index, head] of projection.containerKeks.entries()) {
+            const target = deriveDocumentTargetFromProjection({
+                ...projection,
+                containerId: head.containerId,
+                path: projection.path.slice(0, index + 1),
+                containerKeks: projection.containerKeks.slice(0, index + 1),
+            });
+            const key = keys.get(target.containerKeyEpochId);
+            // A direct child grantee need not possess any ancestor secret.
+            if (!key)
+                continue;
+            const id = targetKey(target);
+            const previous = keks.get(id);
+            if (previous)
+                assertEqualBytes(previous, key, "Attachment link projections contain conflicting KEKs");
+            keks.set(id, key);
+        }
+    }
+    return keks;
+}
+function compareBlobIds(a, b) {
+    return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;
+}
+//# sourceMappingURL=linkSetBlobRewraps.js.map