@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/syncFailures/syncPolicyRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPolicyRepair.js","sourceRoot":"","sources":["syncPolicyRepair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAO3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAI7E,SAAS,oBAAoB,CAC3B,aAAmC,EACnC,WAAmB;IAEnB,OAAO,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CACzC,IAAsB;IAEtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACvD,IACE,CAAC,aAAa,KAAK,OAAO,IAAI,aAAa,KAAK,cAAc,CAAC;gBAC/D,OAAO,WAAW,KAAK,QAAQ;gBAC/B,WAAW,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4CAA4C,CAAC,KAGrD;IACC,MAAM,SAAS,GAAG,kCAAkC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAKrD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IACE,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/C,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACvD,CAAC,KAAK;QACN,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,OAAO;QACR,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAChC,CAAC;QACD,OAAO;IACT,CAAC;IAED,4CAA4C,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,4BAA4B,CAAC;QACjC,KAAK;QACL,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;QACzC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { ReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { isRetryableDocumentSyncConflict } from \"../../../data/documents/shared/responses\";\nimport type {\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n} from \"../../../data/documents/shared/types\";\nimport type { ReferencedPrincipalPolicyWarmer } from \"../../../data/keyingProjectionVerification\";\n\nimport { recoverPrincipalPolicyRepair } from \"../../principals/policyRepair\";\n\ntype ManagedPrincipalType = \"group\" | \"organization\";\n\nfunction principalIdentityKey(\n  principalType: ManagedPrincipalType,\n  principalId: string,\n): string {\n  return `${principalType}:${principalId}`;\n}\n\nfunction requestedRepairPrincipalIdentities(\n  plan: DocumentSyncPlan,\n): Set<string> {\n  const identities = new Set<string>();\n  for (const rekey of plan.request.containerRekeys ?? []) {\n    for (const policy of rekey.principalPolicies) {\n      const principalType = Reflect.get(policy, \"principalType\");\n      const principalId = Reflect.get(policy, \"principalId\");\n      if (\n        (principalType === \"group\" || principalType === \"organization\") &&\n        typeof principalId === \"string\" &&\n        principalId.length > 0\n      ) {\n        identities.add(principalIdentityKey(principalType, principalId));\n      }\n    }\n  }\n  return identities;\n}\n\nfunction assertDocumentSyncPolicyRepairHeadsRequested(input: {\n  readonly heads: readonly ReferencedPrincipalStateResponse[];\n  readonly plan: DocumentSyncPlan;\n}): void {\n  const requested = requestedRepairPrincipalIdentities(input.plan);\n  for (const head of input.heads) {\n    const { principalId, principalType } = head;\n    if (!requested.has(principalIdentityKey(principalType, principalId))) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Document sync policy repair head principal was not requested\",\n      );\n    }\n  }\n}\n\nexport async function recoverDocumentSyncPolicyRepair(input: {\n  failure: DocumentSyncSubmitFailure;\n  plan: DocumentSyncPlan;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<void> {\n  const heads = input.failure.stalePrincipalHeads;\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (\n    !isRetryableDocumentSyncConflict(input.failure) ||\n    (input.plan.request.containerRekeys?.length ?? 0) === 0 ||\n    !heads ||\n    heads.length === 0 ||\n    !resolve ||\n    input.stillCurrent?.() === false\n  ) {\n    return;\n  }\n\n  assertDocumentSyncPolicyRepairHeadsRequested({ heads, plan: input.plan });\n  await recoverPrincipalPolicyRepair({\n    heads,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    organizationId: input.plan.organizationId,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/workflows/documents/syncFailures/syncRepairAbandon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncRepairAbandon.js","sourceRoot":"","sources":["syncRepairAbandon.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IACxC;IAArB,YAAqB,MAAmC;QACtD,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;QADpC,WAAM,GAAN,MAAM,CAA6B;QAEtD,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D;QACE,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF","sourcesContent":["import type { AncestorRepairAbandonReason } from \"../sync/syncTrace\";\n\n/**\n * A repair that cannot proceed for a routine reason: the organization's writes\n * are gated, the server refused the rekey, a peer rotated an ancestor mid-pass,\n * the refreshed projection was unavailable, or the pass exhausted its repair\n * budget. None is a defect, so the sync lane abandons the attempt rather than\n * reporting a failed run; the next trigger re-plans from a fresh projection.\n *\n * Lives apart from both the planner and the preparation loop: each throws it,\n * and preparation already imports the planner, so declaring it in either would\n * close a dependency cycle.\n */\nexport class DocumentAncestorRepairAbandonedError extends Error {\n  constructor(readonly reason: AncestorRepairAbandonReason) {\n    super(`Document ancestor repair abandoned: ${reason}`);\n    this.name = \"DocumentAncestorRepairAbandonedError\";\n  }\n}\n\n/** A refreshed projection needs durable preparation before another pure plan. */\nexport class DocumentSyncPreparationRequiredError extends Error {\n  constructor() {\n    super(\"Document sync requires a new ancestor preparation step\");\n    this.name = \"DocumentSyncPreparationRequiredError\";\n  }\n}\n"]}

package/workflows/documents/syncFailures/syncRepairAccess.js

@@ -0,0 +1,42 @@
+import { resolveContainerPathUserAccessLevel } from "../../../internal/crypto/index.js";
+import { requireProjectionUserKeyResolver, verifyDocumentWriterProjectionAuthorization, } from "../../../data/keyingProjectionVerification/index.js";
+/** A repair refusal on one link does not revoke write access through another. */
+export async function hasOtherLinkedWriteAccess(sync, projection, inaccessibleContainerId) {
+    if (projection.authorizingContainerPaths.length < 2)
+        return false;
+    const verified = await verifyDocumentWriterProjectionAuthorization({
+        execSql: sync.execSql,
+        persistVerificationCheckpoints: false,
+        projection,
+        resolveUserKey: requireProjectionUserKeyResolver(sync.resolveProjectionUserKey, "Document linked repair access"),
+        stillCurrent: sync.stillCurrent,
+        warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,
+    });
+    const document = verified.documentManifestByHash.get(projection.documentManifest.manifestHash);
+    if (!document ||
+        document.state.documentId !== sync.documentId ||
+        document.state.organizationId !== sync.author.organizationId)
+        return false;
+    // The map also contains historical paths. Only the verified current paths
+    // named by this projection may establish present write authority.
+    return projection.authorizingContainerPaths.some((candidate) => {
+        const headHash = candidate.path.at(-1)?.manifestHash;
+        const path = headHash
+            ? verified.containerPathByManifestHash.get(headHash)
+            : undefined;
+        const leaf = path?.at(-1);
+        if (!path ||
+            !leaf ||
+            leaf.state.containerId === inaccessibleContainerId ||
+            leaf.state.organizationId !== document.state.organizationId ||
+            !document.state.linkedContainerIds.includes(leaf.state.containerId))
+            return false;
+        const access = resolveContainerPathUserAccessLevel({
+            path,
+            principalPolicies: verified.principalPolicies,
+            userId: sync.author.signerUserId,
+        });
+        return access === "write" || access === "admin";
+    });
+}
+//# sourceMappingURL=syncRepairAccess.js.map

package/workflows/documents/syncFailures/syncRepairAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncRepairAccess.js","sourceRoot":"","sources":["syncRepairAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EACL,gCAAgC,EAChC,2CAA2C,GAC5C,MAAM,4CAA4C,CAAC;AAGpD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA6B,EAC7B,UAA4C,EAC5C,uBAA+B;IAE/B,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,2CAA2C,CAAC;QACjE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,8BAA8B,EAAE,KAAK;QACrC,UAAU;QACV,cAAc,EAAE,gCAAgC,CAC9C,IAAI,CAAC,wBAAwB,EAC7B,+BAA+B,CAChC;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;KACtE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAClD,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzC,CAAC;IACF,IACE,CAAC,QAAQ;QACT,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QAC7C,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc;QAE5D,OAAO,KAAK,CAAC;IACf,0EAA0E;IAC1E,kEAAkE;IAClE,OAAO,UAAU,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QACrD,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IACE,CAAC,IAAI;YACL,CAAC,IAAI;YACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,uBAAuB;YAClD,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,KAAK,CAAC,cAAc;YAC3D,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAEnE,OAAO,KAAK,CAAC;QACf,MAAM,MAAM,GAAG,mCAAmC,CAAC;YACjD,IAAI;YACJ,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { resolveContainerPathUserAccessLevel } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  requireProjectionUserKeyResolver,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SyncRemoteDocumentInput } from \"../sync/readOnlySync\";\n\n/** A repair refusal on one link does not revoke write access through another. */\nexport async function hasOtherLinkedWriteAccess(\n  sync: SyncRemoteDocumentInput,\n  projection: DocumentWriterProjectionResponse,\n  inaccessibleContainerId: string,\n): Promise<boolean> {\n  if (projection.authorizingContainerPaths.length < 2) return false;\n  const verified = await verifyDocumentWriterProjectionAuthorization({\n    execSql: sync.execSql,\n    persistVerificationCheckpoints: false,\n    projection,\n    resolveUserKey: requireProjectionUserKeyResolver(\n      sync.resolveProjectionUserKey,\n      \"Document linked repair access\",\n    ),\n    stillCurrent: sync.stillCurrent,\n    warmReferencedPrincipalPolicies: sync.warmReferencedPrincipalPolicies,\n  });\n  const document = verified.documentManifestByHash.get(\n    projection.documentManifest.manifestHash,\n  );\n  if (\n    !document ||\n    document.state.documentId !== sync.documentId ||\n    document.state.organizationId !== sync.author.organizationId\n  )\n    return false;\n  // The map also contains historical paths. Only the verified current paths\n  // named by this projection may establish present write authority.\n  return projection.authorizingContainerPaths.some((candidate) => {\n    const headHash = candidate.path.at(-1)?.manifestHash;\n    const path = headHash\n      ? verified.containerPathByManifestHash.get(headHash)\n      : undefined;\n    const leaf = path?.at(-1);\n    if (\n      !path ||\n      !leaf ||\n      leaf.state.containerId === inaccessibleContainerId ||\n      leaf.state.organizationId !== document.state.organizationId ||\n      !document.state.linkedContainerIds.includes(leaf.state.containerId)\n    )\n      return false;\n    const access = resolveContainerPathUserAccessLevel({\n      path,\n      principalPolicies: verified.principalPolicies,\n      userId: sync.author.signerUserId,\n    });\n    return access === \"write\" || access === \"admin\";\n  });\n}\n"]}

package/workflows/documents/syncPlan/syncContentKeys.d.ts

@@ -0,0 +1,39 @@
+import type { DocumentSyncResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentSyncPreparedUpdate, ProjectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import type { PendingUpdateRecord } from "../../../data/sqlite/documentPersistence.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+type SyncResponseUpdate = DocumentSyncResponse["updates"][number];
+type RawHistoryUnavailableValidator = (input: {
+    contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;
+    updates: readonly SyncResponseUpdate[];
+}) => void | Promise<void>;
+/** A raw recovery cannot reconstruct history without this retained epoch. */
+export declare class DocumentRawHistoryUnavailableError extends Error {
+    readonly contentKeyEpoch: number;
+    readonly code = "document_raw_history_epoch_unavailable";
+    constructor(contentKeyEpoch: number, cause: unknown);
+}
+export declare function prepareDocumentOutgoingUpdates(input: {
+    contentKey: Uint8Array;
+    contentKeyEpoch: number;
+    documentId: string;
+    organizationId: string;
+    pendingUpdates: readonly PendingUpdateRecord[];
+}): Promise<DocumentSyncPreparedUpdate[]>;
+/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */
+export declare function throwDocumentSyncContentKeyFailure(input: {
+    cause: unknown;
+    updates: readonly SyncResponseUpdate[];
+}): never;
+export declare function unwrapDocumentSyncResponseContentKeys(input: {
+    currentContentKey: Uint8Array;
+    currentContentKeyEpoch: number;
+    execSql?: ExecSql | undefined;
+    historyMode?: "raw" | undefined;
+    /** @internal Validate every decryptable sibling before raw availability wins. */
+    onRawHistoryUnavailable?: RawHistoryUnavailableValidator | undefined;
+    response: DocumentSyncResponse;
+    targetSecretKey: Uint8Array;
+    writerProjection: DocumentWriterProjectionResponse;
+} & ProjectionVerificationOptions): Promise<ReadonlyMap<number, Uint8Array>>;
+export {};

package/workflows/documents/syncPlan/syncContentKeys.js

@@ -0,0 +1,254 @@
+import { importContentKeyMaterial } from "../../../data/documents/shared/contentRecordKeys.js";
+import { encryptDocumentPendingUpdate } from "../../../data/documents/shared/crypto.js";
+import { assertDocumentSyncUpdateEncryptedRecord } from "../../../data/documents/shared/documentSyncUpdateDecryption.js";
+import { isDocumentSyncUpdateIsolationError, isolateDocumentSyncBatchError, isolateDocumentSyncUpdateError, } from "../../../data/documents/shared/documentSyncUpdateIsolation.js";
+import { ContainerKekHistoryUnavailableError, collectContainerKeksForDocumentSync, DocumentContentKeyUnavailableError, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, } from "../../../data/documents/shared/projection.js";
+import { readWriteHeader } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { isKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
+function isRawHistoryUnavailableCause(error) {
+    return (error instanceof DocumentContentKeyUnavailableError ||
+        (error instanceof DocumentHistoryUnavailableError &&
+            error.historyCause instanceof ContainerKekHistoryUnavailableError));
+}
+/** A raw recovery cannot reconstruct history without this retained epoch. */
+export class DocumentRawHistoryUnavailableError extends Error {
+    contentKeyEpoch;
+    code = "document_raw_history_epoch_unavailable";
+    constructor(contentKeyEpoch, cause) {
+        super(`Document raw-history recovery cannot decrypt content-key epoch ${contentKeyEpoch}`, { cause });
+        this.contentKeyEpoch = contentKeyEpoch;
+        this.name = "DocumentRawHistoryUnavailableError";
+    }
+}
+async function assertResponseEncryptedRecords(updates) {
+    const inspections = await Promise.allSettled(updates.map(assertDocumentSyncUpdateEncryptedRecord));
+    const failures = inspections.flatMap((inspection, index) => inspection.status === "rejected"
+        ? [{ index, reason: inspection.reason }]
+        : []);
+    const firstFailure = failures[0];
+    if (failures.length === 1 && firstFailure) {
+        throw firstFailure.reason;
+    }
+    if (failures.length > 1 && firstFailure) {
+        const stage = isDocumentSyncUpdateIsolationError(firstFailure.reason) &&
+            failures.every(({ reason }) => isDocumentSyncUpdateIsolationError(reason) &&
+                reason.stage === firstFailure.reason.stage)
+            ? firstFailure.reason.stage
+            : "encrypted_record";
+        throw isolateDocumentSyncBatchError({
+            cause: new Error("Multiple document encrypted records are invalid"),
+            stage,
+            updateIds: failures.map(({ index }) => updates[index]?.id ?? "unknown"),
+        });
+    }
+}
+async function throwRawHistoryUnavailable(input) {
+    await assertResponseEncryptedRecords(input.response.updates);
+    await input.validate?.({
+        contentKeysByEpoch: input.contentKeysByEpoch,
+        updates: input.response.updates.filter((update) => input.contentKeysByEpoch.has(readWriteHeader(update.writeHeader, "Document sync response write header").contentKeyEpoch)),
+    });
+    throw new DocumentRawHistoryUnavailableError(input.unavailable.contentKeyEpoch, input.unavailable.cause);
+}
+export async function prepareDocumentOutgoingUpdates(input) {
+    if (input.pendingUpdates.length === 0) {
+        return [];
+    }
+    const contentKeyMaterial = await importContentKeyMaterial(input.contentKey);
+    return Promise.all(input.pendingUpdates.map(async (update) => {
+        const encrypted = await encryptDocumentPendingUpdate({
+            contentKeyMaterial,
+            contentKeyEpoch: input.contentKeyEpoch,
+            documentId: input.documentId,
+            organizationId: input.organizationId,
+            update,
+        });
+        return {
+            contentRecordId: encrypted.contentRecordId,
+            encryptedData: encrypted.encryptedData,
+            id: update.id,
+            partialStartVersionVector: update.partialStartVersionVector,
+            partialEndVersionVector: update.partialEndVersionVector,
+            metadataHash: encrypted.metadataHash,
+            ciphertextHash: encrypted.ciphertextHash,
+            plaintextHash: encrypted.plaintextHash,
+            ...(update.sourceVersionVector
+                ? {
+                    checkpointKind: "rotate_baseline",
+                    checkpointPayloadKind: "full_history_snapshot",
+                    sourceVersionVector: update.sourceVersionVector,
+                }
+                : {}),
+        };
+    }));
+}
+function syncResponseContentKeyBundlesByEpoch(response) {
+    const byEpoch = new Map();
+    for (const bundle of [
+        response.contentKeyBundle,
+        ...response.contentKeyBundles,
+    ]) {
+        if (byEpoch.has(bundle.contentKeyEpoch)) {
+            throw new Error("Document sync response repeats a content-key epoch");
+        }
+        byEpoch.set(bundle.contentKeyEpoch, bundle);
+    }
+    return byEpoch;
+}
+function syncResponseUpdatesByContentKeyEpoch(response) {
+    const updatesByEpoch = new Map();
+    for (const update of response.updates) {
+        let contentKeyEpoch;
+        try {
+            contentKeyEpoch = readWriteHeader(update.writeHeader, "Document sync response write header").contentKeyEpoch;
+        }
+        catch (error) {
+            throw isolateDocumentSyncUpdateError({
+                cause: error,
+                responseUpdate: update,
+                stage: "write_header",
+                updateId: update.id,
+            });
+        }
+        const epochUpdates = updatesByEpoch.get(contentKeyEpoch);
+        if (epochUpdates)
+            epochUpdates.push(update);
+        else
+            updatesByEpoch.set(contentKeyEpoch, [update]);
+    }
+    return updatesByEpoch;
+}
+function assertBundleMatchesUpdateHeaders(input) {
+    for (const update of input.updates) {
+        const header = readWriteHeader(update.writeHeader, "Document sync response write header");
+        if (header.objectId !== input.bundle.documentId ||
+            header.contentKeyEpoch !== input.bundle.contentKeyEpoch ||
+            (input.requireOriginalTargets &&
+                (header.accessManifestHash !== input.bundle.linkSetManifestHash ||
+                    header.targetHash !== input.bundle.targetHash))) {
+            throw new Error(input.requireOriginalTargets
+                ? "Document sync response content key is unavailable and its bundle differs from the original update headers"
+                : "Document sync response content-key bundle does not match its update headers");
+        }
+    }
+}
+/**
+ * Linking can rewrap a retained key at the same content epoch. Its latest bundle
+ * then has newer targets than older signed updates. A usable key is validated
+ * by the caller's authenticated record decryption; the update's own historical
+ * manifest, targets and signature are verified independently before this step.
+ *
+ * If the key cannot be recovered, require the original target commitments before
+ * calling that an availability failure. Substituted unavailable targets must
+ * still be quarantined, never disguised as legitimate missing history.
+ */
+async function unwrapHistoricalContentKey(input) {
+    assertBundleMatchesUpdateHeaders({ ...input, requireOriginalTargets: false });
+    try {
+        return await unwrapDocumentContentKeyFromBundle(input.bundle, input.documentId, input.collectedKeks.keksByEpochId, input.collectedKeks.predecessorFailuresByEpochId, input.collectedKeks.unattributedPredecessorFailuresByContainerId);
+    }
+    catch (error) {
+        if (isRawHistoryUnavailableCause(error)) {
+            assertBundleMatchesUpdateHeaders({
+                ...input,
+                requireOriginalTargets: true,
+            });
+        }
+        throw error;
+    }
+}
+/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */
+export function throwDocumentSyncContentKeyFailure(input) {
+    if (isKeyingVerificationError(input.cause)) {
+        throw input.cause;
+    }
+    if (input.cause instanceof DocumentHistoryUnavailableError &&
+        isKeyingVerificationError(input.cause.historyCause)) {
+        throw input.cause.historyCause;
+    }
+    throw isolateDocumentSyncBatchError({
+        cause: input.cause,
+        stage: "content_key",
+        updateIds: input.updates.map((update) => update.id),
+    });
+}
+export async function unwrapDocumentSyncResponseContentKeys(input) {
+    // A stale read-only pass can carry an empty placeholder when none of its
+    // authorizing paths reaches the bundle target. Do not mark that epoch as
+    // resolved: every served update must instead unwrap its bundle through the
+    // verified predecessor KEK chain or fail with an honest error.
+    const contentKeysByEpoch = new Map(input.currentContentKey.byteLength > 0
+        ? [[input.currentContentKeyEpoch, input.currentContentKey]]
+        : []);
+    const updatesByContentKeyEpoch = syncResponseUpdatesByContentKeyEpoch(input.response);
+    const missingContentKeyEpochs = [...updatesByContentKeyEpoch.keys()].filter((contentKeyEpoch) => !contentKeysByEpoch.has(contentKeyEpoch));
+    missingContentKeyEpochs.sort((left, right) => left - right);
+    if (missingContentKeyEpochs.length === 0) {
+        return contentKeysByEpoch;
+    }
+    const missingUpdates = missingContentKeyEpochs.flatMap((contentKeyEpoch) => updatesByContentKeyEpoch.get(contentKeyEpoch) ?? []);
+    let bundlesByEpoch;
+    try {
+        bundlesByEpoch = syncResponseContentKeyBundlesByEpoch(input.response);
+    }
+    catch (error) {
+        throwDocumentSyncContentKeyFailure({
+            cause: error,
+            updates: missingUpdates,
+        });
+    }
+    const absentBundleEpoch = missingContentKeyEpochs.find((contentKeyEpoch) => !bundlesByEpoch.has(contentKeyEpoch));
+    if (absentBundleEpoch !== undefined) {
+        throwDocumentSyncContentKeyFailure({
+            cause: new Error("Document sync response content-key bundle missing"),
+            updates: updatesByContentKeyEpoch.get(absentBundleEpoch) ?? missingUpdates,
+        });
+    }
+    const collectedKeks = await collectContainerKeksForDocumentSync({
+        execSql: input.execSql,
+        secretKey: input.targetSecretKey,
+        writerProjection: input.writerProjection,
+        ...projectionVerificationOptions(input),
+    });
+    let unavailableRawHistory;
+    for (const contentKeyEpoch of missingContentKeyEpochs) {
+        const bundle = bundlesByEpoch.get(contentKeyEpoch);
+        const responseUpdates = updatesByContentKeyEpoch.get(contentKeyEpoch) ?? missingUpdates;
+        if (!bundle) {
+            const error = new Error("Document sync response content-key bundle missing");
+            throwDocumentSyncContentKeyFailure({
+                cause: error,
+                updates: responseUpdates,
+            });
+        }
+        try {
+            contentKeysByEpoch.set(bundle.contentKeyEpoch, await unwrapHistoricalContentKey({
+                bundle,
+                collectedKeks,
+                documentId: input.writerProjection.documentId,
+                updates: responseUpdates,
+            }));
+        }
+        catch (error) {
+            if (input.historyMode === "raw" && isRawHistoryUnavailableCause(error)) {
+                unavailableRawHistory ??= { cause: error, contentKeyEpoch };
+                continue;
+            }
+            throwDocumentSyncContentKeyFailure({
+                cause: error,
+                updates: responseUpdates,
+            });
+        }
+    }
+    if (unavailableRawHistory) {
+        await throwRawHistoryUnavailable({
+            contentKeysByEpoch,
+            response: input.response,
+            unavailable: unavailableRawHistory,
+            validate: input.onRawHistoryUnavailable,
+        });
+    }
+    return contentKeysByEpoch;
+}
+//# sourceMappingURL=syncContentKeys.js.map

package/workflows/documents/syncPlan/syncContentKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncContentKeys.js","sourceRoot":"","sources":["syncContentKeys.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,6DAA6D,CAAC;AACtH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAKzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAS7F,SAAS,4BAA4B,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,kCAAkC;QACnD,CAAC,KAAK,YAAY,+BAA+B;YAC/C,KAAK,CAAC,YAAY,YAAY,mCAAmC,CAAC,CACrE,CAAC;AACJ,CAAC;AAOD,6EAA6E;AAC7E,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIhD;IAHF,IAAI,GAAG,wCAAwC,CAAC;IAEzD,YACW,eAAuB,EAChC,KAAc;QAEd,KAAK,CACH,kEAAkE,eAAe,EAAE,EACnF,EAAE,KAAK,EAAE,CACV,CAAC;QANO,oBAAe,GAAf,eAAe,CAAQ;QAOhC,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAsC;IAEtC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CACrD,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CACzD,UAAU,CAAC,MAAM,KAAK,UAAU;QAC9B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,KAAK,GACT,kCAAkC,CAAC,YAAY,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,KAAK,CACZ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACb,kCAAkC,CAAC,MAAM,CAAC;gBAC1C,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,KAAK,CAC7C;YACC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK;YAC3B,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CAAC,iDAAiD,CAAC;YACnE,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAC1B,eAAe,CACb,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC,eAAe,CAClB,CACF;KACF,CAAC,CAAC;IACH,MAAM,IAAI,kCAAkC,CAC1C,KAAK,CAAC,WAAW,CAAC,eAAe,EACjC,KAAK,CAAC,WAAW,CAAC,KAAK,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE5E,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;YACnD,kBAAkB;YAClB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM;SACP,CAAC,CAAC;QAEH,OAAO;YACL,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACvD,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,GAAG,CAAC,MAAM,CAAC,mBAAmB;gBAC5B,CAAC,CAAC;oBACE,cAAc,EAAE,iBAA0B;oBAC1C,qBAAqB,EAAE,uBAAgC;oBACvD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;iBAChD;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,QAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAE5E,KAAK,MAAM,MAAM,IAAI;QACnB,QAAQ,CAAC,gBAAgB;QACzB,GAAG,QAAQ,CAAC,iBAAiB;KAC9B,EAAE,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oCAAoC,CAC3C,QAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,eAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,eAAe,GAAG,eAAe,CAC/B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC,eAAe,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,8BAA8B,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,MAAM;gBACtB,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACvC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IACE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU;YAC3C,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,eAAe;YACvD,CAAC,KAAK,CAAC,sBAAsB;gBAC3B,CAAC,MAAM,CAAC,kBAAkB,KAAK,KAAK,CAAC,MAAM,CAAC,mBAAmB;oBAC7D,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,sBAAsB;gBAC1B,CAAC,CAAC,2GAA2G;gBAC7G,CAAC,CAAC,6EAA6E,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,0BAA0B,CAAC,KAOzC;IACC,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,MAAM,kCAAkC,CAC7C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,aAAa,CAAC,aAAa,EACjC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAChD,KAAK,CAAC,aAAa,CAAC,4CAA4C,CACjE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,gCAAgC,CAAC;gBAC/B,GAAG,KAAK;gBACR,sBAAsB,EAAE,IAAI;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,IACE,KAAK,CAAC,KAAK,YAAY,+BAA+B;QACtD,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EACnD,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAUiC;IAEjC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,iBAAiB,CAAC,UAAU,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,MAAM,uBAAuB,GAAG,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACzE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC9D,CAAC;IACF,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CACpD,CAAC,eAAe,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CACzE,CAAC;IACF,IAAI,cAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,cAAc,GAAG,oCAAoC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kCAAkC,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CACpD,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1D,CAAC;IACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,kCAAkC,CAAC;YACjC,KAAK,EAAE,IAAI,KAAK,CAAC,mDAAmD,CAAC;YACrE,OAAO,EACL,wBAAwB,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,cAAc;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,qBAES,CAAC;IAEd,KAAK,MAAM,eAAe,IAAI,uBAAuB,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,eAAe,GACnB,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mDAAmD,CACpD,CAAC;YACF,kCAAkC,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CACpB,MAAM,CAAC,eAAe,EACtB,MAAM,0BAA0B,CAAC;gBAC/B,MAAM;gBACN,aAAa;gBACb,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,OAAO,EAAE,eAAe;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,qBAAqB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,kCAAkC,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,0BAA0B,CAAC;YAC/B,kBAAkB;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,KAAK,CAAC,uBAAuB;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type {\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { importContentKeyMaterial } from \"../../../data/documents/shared/contentRecordKeys\";\nimport { encryptDocumentPendingUpdate } from \"../../../data/documents/shared/crypto\";\nimport { assertDocumentSyncUpdateEncryptedRecord } from \"../../../data/documents/shared/documentSyncUpdateDecryption\";\nimport {\n  isDocumentSyncUpdateIsolationError,\n  isolateDocumentSyncBatchError,\n  isolateDocumentSyncUpdateError,\n} from \"../../../data/documents/shared/documentSyncUpdateIsolation\";\nimport {\n  ContainerKekHistoryUnavailableError,\n  collectContainerKeksForDocumentSync,\n  DocumentContentKeyUnavailableError,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n} from \"../../../data/documents/shared/projection\";\nimport { readWriteHeader } from \"../../../data/documents/shared/readers\";\nimport type {\n  DocumentSyncPreparedUpdate,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { isKeyingVerificationError } from \"../../../data/keyingProjectionVerification/error\";\nimport type { PendingUpdateRecord } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype RawHistoryUnavailableCause =\n  | DocumentContentKeyUnavailableError\n  | DocumentHistoryUnavailableError;\n\nfunction isRawHistoryUnavailableCause(\n  error: unknown,\n): error is RawHistoryUnavailableCause {\n  return (\n    error instanceof DocumentContentKeyUnavailableError ||\n    (error instanceof DocumentHistoryUnavailableError &&\n      error.historyCause instanceof ContainerKekHistoryUnavailableError)\n  );\n}\n\ntype RawHistoryUnavailableValidator = (input: {\n  contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;\n  updates: readonly SyncResponseUpdate[];\n}) => void | Promise<void>;\n\n/** A raw recovery cannot reconstruct history without this retained epoch. */\nexport class DocumentRawHistoryUnavailableError extends Error {\n  readonly code = \"document_raw_history_epoch_unavailable\";\n\n  constructor(\n    readonly contentKeyEpoch: number,\n    cause: unknown,\n  ) {\n    super(\n      `Document raw-history recovery cannot decrypt content-key epoch ${contentKeyEpoch}`,\n      { cause },\n    );\n    this.name = \"DocumentRawHistoryUnavailableError\";\n  }\n}\n\nasync function assertResponseEncryptedRecords(\n  updates: readonly SyncResponseUpdate[],\n): Promise<void> {\n  const inspections = await Promise.allSettled(\n    updates.map(assertDocumentSyncUpdateEncryptedRecord),\n  );\n  const failures = inspections.flatMap((inspection, index) =>\n    inspection.status === \"rejected\"\n      ? [{ index, reason: inspection.reason }]\n      : [],\n  );\n  const firstFailure = failures[0];\n  if (failures.length === 1 && firstFailure) {\n    throw firstFailure.reason;\n  }\n  if (failures.length > 1 && firstFailure) {\n    const stage =\n      isDocumentSyncUpdateIsolationError(firstFailure.reason) &&\n      failures.every(\n        ({ reason }) =>\n          isDocumentSyncUpdateIsolationError(reason) &&\n          reason.stage === firstFailure.reason.stage,\n      )\n        ? firstFailure.reason.stage\n        : \"encrypted_record\";\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\"Multiple document encrypted records are invalid\"),\n      stage,\n      updateIds: failures.map(({ index }) => updates[index]?.id ?? \"unknown\"),\n    });\n  }\n}\n\nasync function throwRawHistoryUnavailable(input: {\n  contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;\n  response: DocumentSyncResponse;\n  unavailable: { cause: RawHistoryUnavailableCause; contentKeyEpoch: number };\n  validate?: RawHistoryUnavailableValidator | undefined;\n}): Promise<never> {\n  await assertResponseEncryptedRecords(input.response.updates);\n  await input.validate?.({\n    contentKeysByEpoch: input.contentKeysByEpoch,\n    updates: input.response.updates.filter((update) =>\n      input.contentKeysByEpoch.has(\n        readWriteHeader(\n          update.writeHeader,\n          \"Document sync response write header\",\n        ).contentKeyEpoch,\n      ),\n    ),\n  });\n  throw new DocumentRawHistoryUnavailableError(\n    input.unavailable.contentKeyEpoch,\n    input.unavailable.cause,\n  );\n}\n\nexport async function prepareDocumentOutgoingUpdates(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  pendingUpdates: readonly PendingUpdateRecord[];\n}): Promise<DocumentSyncPreparedUpdate[]> {\n  if (input.pendingUpdates.length === 0) {\n    return [];\n  }\n  const contentKeyMaterial = await importContentKeyMaterial(input.contentKey);\n\n  return Promise.all(\n    input.pendingUpdates.map(async (update) => {\n      const encrypted = await encryptDocumentPendingUpdate({\n        contentKeyMaterial,\n        contentKeyEpoch: input.contentKeyEpoch,\n        documentId: input.documentId,\n        organizationId: input.organizationId,\n        update,\n      });\n\n      return {\n        contentRecordId: encrypted.contentRecordId,\n        encryptedData: encrypted.encryptedData,\n        id: update.id,\n        partialStartVersionVector: update.partialStartVersionVector,\n        partialEndVersionVector: update.partialEndVersionVector,\n        metadataHash: encrypted.metadataHash,\n        ciphertextHash: encrypted.ciphertextHash,\n        plaintextHash: encrypted.plaintextHash,\n        ...(update.sourceVersionVector\n          ? {\n              checkpointKind: \"rotate_baseline\" as const,\n              checkpointPayloadKind: \"full_history_snapshot\" as const,\n              sourceVersionVector: update.sourceVersionVector,\n            }\n          : {}),\n      };\n    }),\n  );\n}\n\nfunction syncResponseContentKeyBundlesByEpoch(\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  const byEpoch = new Map<number, DocumentSyncResponse[\"contentKeyBundle\"]>();\n\n  for (const bundle of [\n    response.contentKeyBundle,\n    ...response.contentKeyBundles,\n  ]) {\n    if (byEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    byEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return byEpoch;\n}\n\nfunction syncResponseUpdatesByContentKeyEpoch(\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, readonly SyncResponseUpdate[]> {\n  const updatesByEpoch = new Map<number, SyncResponseUpdate[]>();\n  for (const update of response.updates) {\n    let contentKeyEpoch: number;\n    try {\n      contentKeyEpoch = readWriteHeader(\n        update.writeHeader,\n        \"Document sync response write header\",\n      ).contentKeyEpoch;\n    } catch (error) {\n      throw isolateDocumentSyncUpdateError({\n        cause: error,\n        responseUpdate: update,\n        stage: \"write_header\",\n        updateId: update.id,\n      });\n    }\n    const epochUpdates = updatesByEpoch.get(contentKeyEpoch);\n    if (epochUpdates) epochUpdates.push(update);\n    else updatesByEpoch.set(contentKeyEpoch, [update]);\n  }\n  return updatesByEpoch;\n}\n\nfunction assertBundleMatchesUpdateHeaders(input: {\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  requireOriginalTargets: boolean;\n  updates: readonly SyncResponseUpdate[];\n}): void {\n  for (const update of input.updates) {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (\n      header.objectId !== input.bundle.documentId ||\n      header.contentKeyEpoch !== input.bundle.contentKeyEpoch ||\n      (input.requireOriginalTargets &&\n        (header.accessManifestHash !== input.bundle.linkSetManifestHash ||\n          header.targetHash !== input.bundle.targetHash))\n    ) {\n      throw new Error(\n        input.requireOriginalTargets\n          ? \"Document sync response content key is unavailable and its bundle differs from the original update headers\"\n          : \"Document sync response content-key bundle does not match its update headers\",\n      );\n    }\n  }\n}\n\n/**\n * Linking can rewrap a retained key at the same content epoch. Its latest bundle\n * then has newer targets than older signed updates. A usable key is validated\n * by the caller's authenticated record decryption; the update's own historical\n * manifest, targets and signature are verified independently before this step.\n *\n * If the key cannot be recovered, require the original target commitments before\n * calling that an availability failure. Substituted unavailable targets must\n * still be quarantined, never disguised as legitimate missing history.\n */\nasync function unwrapHistoricalContentKey(input: {\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  documentId: string;\n  collectedKeks: Awaited<\n    ReturnType<typeof collectContainerKeksForDocumentSync>\n  >;\n  updates: readonly SyncResponseUpdate[];\n}): Promise<Uint8Array> {\n  assertBundleMatchesUpdateHeaders({ ...input, requireOriginalTargets: false });\n  try {\n    return await unwrapDocumentContentKeyFromBundle(\n      input.bundle,\n      input.documentId,\n      input.collectedKeks.keksByEpochId,\n      input.collectedKeks.predecessorFailuresByEpochId,\n      input.collectedKeks.unattributedPredecessorFailuresByContainerId,\n    );\n  } catch (error) {\n    if (isRawHistoryUnavailableCause(error)) {\n      assertBundleMatchesUpdateHeaders({\n        ...input,\n        requireOriginalTargets: true,\n      });\n    }\n    throw error;\n  }\n}\n\n/** @internal Keeps epoch-wide failures anonymous and integrity failures typed. */\nexport function throwDocumentSyncContentKeyFailure(input: {\n  cause: unknown;\n  updates: readonly SyncResponseUpdate[];\n}): never {\n  if (isKeyingVerificationError(input.cause)) {\n    throw input.cause;\n  }\n  if (\n    input.cause instanceof DocumentHistoryUnavailableError &&\n    isKeyingVerificationError(input.cause.historyCause)\n  ) {\n    throw input.cause.historyCause;\n  }\n  throw isolateDocumentSyncBatchError({\n    cause: input.cause,\n    stage: \"content_key\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nexport async function unwrapDocumentSyncResponseContentKeys(\n  input: {\n    currentContentKey: Uint8Array;\n    currentContentKeyEpoch: number;\n    execSql?: ExecSql | undefined;\n    historyMode?: \"raw\" | undefined;\n    /** @internal Validate every decryptable sibling before raw availability wins. */\n    onRawHistoryUnavailable?: RawHistoryUnavailableValidator | undefined;\n    response: DocumentSyncResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<ReadonlyMap<number, Uint8Array>> {\n  // A stale read-only pass can carry an empty placeholder when none of its\n  // authorizing paths reaches the bundle target. Do not mark that epoch as\n  // resolved: every served update must instead unwrap its bundle through the\n  // verified predecessor KEK chain or fail with an honest error.\n  const contentKeysByEpoch = new Map<number, Uint8Array>(\n    input.currentContentKey.byteLength > 0\n      ? [[input.currentContentKeyEpoch, input.currentContentKey]]\n      : [],\n  );\n  const updatesByContentKeyEpoch = syncResponseUpdatesByContentKeyEpoch(\n    input.response,\n  );\n  const missingContentKeyEpochs = [...updatesByContentKeyEpoch.keys()].filter(\n    (contentKeyEpoch) => !contentKeysByEpoch.has(contentKeyEpoch),\n  );\n  missingContentKeyEpochs.sort((left, right) => left - right);\n  if (missingContentKeyEpochs.length === 0) {\n    return contentKeysByEpoch;\n  }\n  const missingUpdates = missingContentKeyEpochs.flatMap(\n    (contentKeyEpoch) => updatesByContentKeyEpoch.get(contentKeyEpoch) ?? [],\n  );\n  let bundlesByEpoch: ReturnType<typeof syncResponseContentKeyBundlesByEpoch>;\n  try {\n    bundlesByEpoch = syncResponseContentKeyBundlesByEpoch(input.response);\n  } catch (error) {\n    throwDocumentSyncContentKeyFailure({\n      cause: error,\n      updates: missingUpdates,\n    });\n  }\n  const absentBundleEpoch = missingContentKeyEpochs.find(\n    (contentKeyEpoch) => !bundlesByEpoch.has(contentKeyEpoch),\n  );\n  if (absentBundleEpoch !== undefined) {\n    throwDocumentSyncContentKeyFailure({\n      cause: new Error(\"Document sync response content-key bundle missing\"),\n      updates:\n        updatesByContentKeyEpoch.get(absentBundleEpoch) ?? missingUpdates,\n    });\n  }\n  const collectedKeks = await collectContainerKeksForDocumentSync({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  let unavailableRawHistory:\n    | { cause: RawHistoryUnavailableCause; contentKeyEpoch: number }\n    | undefined;\n\n  for (const contentKeyEpoch of missingContentKeyEpochs) {\n    const bundle = bundlesByEpoch.get(contentKeyEpoch);\n    const responseUpdates =\n      updatesByContentKeyEpoch.get(contentKeyEpoch) ?? missingUpdates;\n    if (!bundle) {\n      const error = new Error(\n        \"Document sync response content-key bundle missing\",\n      );\n      throwDocumentSyncContentKeyFailure({\n        cause: error,\n        updates: responseUpdates,\n      });\n    }\n    try {\n      contentKeysByEpoch.set(\n        bundle.contentKeyEpoch,\n        await unwrapHistoricalContentKey({\n          bundle,\n          collectedKeks,\n          documentId: input.writerProjection.documentId,\n          updates: responseUpdates,\n        }),\n      );\n    } catch (error) {\n      if (input.historyMode === \"raw\" && isRawHistoryUnavailableCause(error)) {\n        unavailableRawHistory ??= { cause: error, contentKeyEpoch };\n        continue;\n      }\n      throwDocumentSyncContentKeyFailure({\n        cause: error,\n        updates: responseUpdates,\n      });\n    }\n  }\n\n  if (unavailableRawHistory) {\n    await throwRawHistoryUnavailable({\n      contentKeysByEpoch,\n      response: input.response,\n      unavailable: unavailableRawHistory,\n      validate: input.onRawHistoryUnavailable,\n    });\n  }\n\n  return contentKeysByEpoch;\n}\n"]}

package/workflows/documents/syncPlan/syncPlanIdentity.js

@@ -0,0 +1,203 @@
+import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, signWriteHeader, } from "../../../internal/crypto/index.js";
+import { assertDocumentManifestBundleConsistent, normalizeDocumentKekTargetResponse, serializeCanonical, sortDocumentTargets, targetEnvelopeReference, } from "../../../data/documents/shared/readers.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+function contentKeyBundleForSyncRequest(input) {
+    const { documentId: _omit, ...bundle } = input;
+    return bundle;
+}
+async function resolveDocumentSyncIdentity(input) {
+    const manifestIdentity = await assertDocumentManifestBundleConsistent({
+        bundle: input.documentManifest,
+        label: "Document sync manifest",
+    });
+    const documentId = input.documentId ?? input.contentKeyBundle.documentId;
+    if (documentId.length === 0) {
+        throw new Error("Document sync document id is empty");
+    }
+    if (input.contentKeyBundle.documentId !== documentId ||
+        input.documentKekTargets.documentId !== documentId ||
+        manifestIdentity.documentId !== documentId) {
+        throw new Error("Document sync state document id mismatch");
+    }
+    if (manifestIdentity.organizationId !== input.author.organizationId) {
+        throw new Error("Document sync author organization mismatch");
+    }
+    if (input.documentManifest.manifestHash !==
+        input.contentKeyBundle.linkSetManifestHash ||
+        input.documentKekTargets.linkSetManifestHash !==
+            input.contentKeyBundle.linkSetManifestHash) {
+        throw new Error("Document sync link manifest mismatch");
+    }
+    if (input.documentKekTargets.documentKeyTargetHash !==
+        input.contentKeyBundle.targetHash) {
+        throw new Error("Document sync target hash mismatch");
+    }
+    const kekTargets = normalizeDocumentKekTargetResponse(input.documentKekTargets);
+    const contentKeyTargets = sortDocumentTargets(input.contentKeyBundle.targets.map(targetEnvelopeReference));
+    if (serializeCanonical(kekTargets, "KEK targets") !==
+        serializeCanonical(contentKeyTargets, "content-key targets")) {
+        throw new Error("Document sync content-key targets mismatch");
+    }
+    const targetHash = await computeDocumentContentKeyTargetHash(kekTargets);
+    if (targetHash !== input.contentKeyBundle.targetHash) {
+        throw new Error("Document sync target hash is not canonical");
+    }
+    return {
+        documentId,
+        expectedLinkSetManifestHash: input.contentKeyBundle.linkSetManifestHash,
+        expectedTargetHash: input.contentKeyBundle.targetHash,
+        organizationId: manifestIdentity.organizationId,
+    };
+}
+function normalizeAuthorizingContainerPathRefs(refs) {
+    if (!refs || refs.length === 0) {
+        throw new Error("Document sync write authorization path refs are missing");
+    }
+    return refs.map((path, pathIndex) => {
+        if (path.length === 0) {
+            throw new Error(`Document sync write authorization path[${pathIndex}] is empty`);
+        }
+        return [...path];
+    });
+}
+export async function signDocumentOutgoingUpdate(input) {
+    const contentRecordId = input.update.contentRecordId ?? input.update.id;
+    const nonceDomain = {
+        version: 1,
+        organizationId: input.organizationId,
+        objectKind: "document",
+        objectId: input.documentId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId,
+    };
+    const unsignedHeader = {
+        ...nonceDomain,
+        dependencyManifestHashes: [
+            ...new Set(input.authorizingContainerPathRefs.flatMap((path) => path.map((ref) => ref.manifestHash))),
+        ].sort(),
+        accessManifestHash: input.expectedLinkSetManifestHash,
+        targetHash: input.expectedTargetHash,
+        nonceDomainHash: await computeContentRecordNonceDomainHash(nonceDomain),
+        metadataHash: input.update.metadataHash,
+        ciphertextHash: input.update.ciphertextHash,
+        writerUserId: input.author.signerUserId,
+        writerDeviceId: input.author.signerDeviceId,
+        writerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.update.signedAt ?? input.signedAt,
+    };
+    const writeHeader = await signWriteHeader(unsignedHeader, input.author.signerPrivateKey);
+    return {
+        ...(input.update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: input.update.checkpointKind }),
+        ...(input.update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: input.update.checkpointPayloadKind }),
+        id: input.update.id,
+        encryptedData: input.update.encryptedData,
+        partialStartVersionVector: input.update.partialStartVersionVector,
+        partialEndVersionVector: input.update.partialEndVersionVector,
+        plaintextHash: input.update.plaintextHash,
+        ...(input.update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: input.update.sourceVersionVector }),
+        writeHeader: readCanonicalRecord(writeHeader, "Document outgoing write header"),
+    };
+}
+function assertUniqueDocumentOutgoingUpdates(updates) {
+    const updateIds = new Set();
+    const contentRecordIds = new Set();
+    for (const update of updates) {
+        if (updateIds.has(update.id)) {
+            throw new Error("Document sync update id is duplicated");
+        }
+        updateIds.add(update.id);
+        const contentRecordId = (update.contentRecordId ?? update.id).toLowerCase();
+        if (contentRecordIds.has(contentRecordId)) {
+            throw new Error("Document sync content record id is duplicated");
+        }
+        contentRecordIds.add(contentRecordId);
+    }
+}
+function assertDocumentSyncRequestMode(input, hasContainerRekeys, hasOutgoingUpdates) {
+    if (input.historyMode === "raw" && input.localVersionVector !== null) {
+        throw new Error("Document raw-history sync must start from a null version vector");
+    }
+    const hasWrites = hasOutgoingUpdates || hasContainerRekeys;
+    if (input.historyMode === "raw" && hasWrites) {
+        throw new Error("Document raw-history sync must be read-only");
+    }
+    if (input.pullCursor !== undefined && hasWrites) {
+        throw new Error("Document sync continuation must be read-only");
+    }
+    if (hasContainerRekeys && !hasOutgoingUpdates) {
+        throw new Error("Document sync container rekeys require an outgoing update");
+    }
+    if (hasContainerRekeys !== (input.inlineRekeyCommitId !== undefined)) {
+        throw new Error("Document sync inline rekey commit id must accompany container rekeys");
+    }
+}
+export async function buildDocumentSyncPlan(input) {
+    const { documentId, expectedLinkSetManifestHash, expectedTargetHash, organizationId, } = await resolveDocumentSyncIdentity(input);
+    const containerRekeys = [...(input.containerRekeys ?? [])];
+    const outgoingUpdateInputs = [...(input.outgoingUpdates ?? [])];
+    assertDocumentSyncRequestMode(input, containerRekeys.length > 0, outgoingUpdateInputs.length > 0);
+    const signedAt = input.signedAt ?? new Date().toISOString();
+    assertUniqueDocumentOutgoingUpdates(outgoingUpdateInputs);
+    const outgoingUpdates = await Promise.all(outgoingUpdateInputs.map((update) => signDocumentOutgoingUpdate({
+        authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(input.authorizingContainerPathRefs),
+        author: input.author,
+        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
+        documentId,
+        expectedLinkSetManifestHash,
+        expectedTargetHash,
+        organizationId,
+        signedAt,
+        update,
+    })));
+    // Writes always carry the verified current content-key bundle so the server
+    // can validate and materialize the current wrapping material in the same
+    // request. Read-only syncs omit it because they do not update server state.
+    const shouldIncludeContentKeyBundle = outgoingUpdates.length > 0;
+    const request = {
+        ...(shouldIncludeContentKeyBundle
+            ? {
+                contentKeyBundle: contentKeyBundleForSyncRequest(input.contentKeyBundle),
+            }
+            : {}),
+        ...(containerRekeys.length === 0 ? {} : { containerRekeys }),
+        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
+        ...(outgoingUpdates.length === 0
+            ? {}
+            : {
+                authorizingContainerPathRefs: normalizeAuthorizingContainerPathRefs(input.authorizingContainerPathRefs),
+            }),
+        expectedLinkSetManifestHash,
+        expectedTargetHash,
+        ...(input.historyMode === undefined
+            ? {}
+            : { historyMode: input.historyMode }),
+        ...(input.inlineRekeyCommitId === undefined
+            ? {}
+            : { inlineRekeyCommitId: input.inlineRekeyCommitId }),
+        localVersionVector: input.localVersionVector,
+        ...(input.minLsn === undefined ? {} : { minLsn: input.minLsn }),
+        outgoingUpdates,
+        ...(input.pullCursor === undefined ? {} : { pullCursor: input.pullCursor }),
+        supportsPullPagination: true,
+    };
+    return {
+        contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,
+        documentId,
+        documentKekTargets: input.documentKekTargets,
+        documentManifest: input.documentManifest,
+        expectedLinkSetManifestHash,
+        expectedTargetHash,
+        minLsn: input.minLsn,
+        organizationId,
+        request,
+        sourceContentKeyBundle: input.contentKeyBundle,
+    };
+}
+//# sourceMappingURL=syncPlanIdentity.js.map