@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/projection/projectionTargets.d.ts

@@ -0,0 +1,38 @@
+import { type DocumentContentKeyTarget } from "../../../../internal/crypto/index.js";
+import type { ContainerManifestRef, DocumentContentKeyTargetEnvelope } from "../../../../internal/validators/request/index.js";
+import type { ContainerKeyingPathResponse, DocumentWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { DocumentLinkSetMutationOperation } from "../types.js";
+export declare function deriveDocumentCreateTargets(projection: ContainerKeyingPathResponse): DocumentContentKeyTarget[];
+export declare function mergeTargetEnvelopes(targets: readonly DocumentContentKeyTarget[], envelopes: readonly DocumentContentKeyTargetEnvelope[]): DocumentContentKeyTargetEnvelope[];
+export declare function describeProjectionTargetKek(projection: ContainerKeyingPathResponse): string;
+export declare function deriveDocumentTargetFromProjection(projection: ContainerKeyingPathResponse): DocumentContentKeyTarget;
+export declare function readLinkedContainerIdsFromDocumentManifest(writerProjection: DocumentWriterProjectionResponse): string[];
+/**
+ * The targets a content-key (re)wrap may address. The server's KEK target list
+ * only says which linked containers the bundle must cover; the epoch each
+ * envelope lands on comes from that container's verified authorizing-path
+ * leaf, never from the server row. A listed epoch that is not the linked
+ * container's verified current head — a predecessor a revoked member still
+ * holds, or another container's epoch — therefore fails before any wrap, as
+ * does a container listed twice. A linked container with no authorizing path
+ * is an availability gap, not tampering: its KEK is simply unavailable here.
+ */
+export declare function verifiedDocumentWrapTargets(input: {
+    linkedContainerIds: readonly string[];
+    serverTargets: readonly DocumentContentKeyTarget[];
+    writerProjection: DocumentWriterProjectionResponse;
+}): DocumentContentKeyTarget[];
+export declare function currentDocumentTargets(writerProjection: DocumentWriterProjectionResponse): DocumentContentKeyTarget[];
+/**
+ * Reduce a single container path (root→leaf chain) to {containerId,
+ * manifestHash} references. The server already stores each manifest and resolves
+ * it from its own store, so a write echoes only the hashes instead of
+ * re-embedding the full signed bundles it received in the writer projection.
+ */
+export declare function containerPathRefs(path: ContainerKeyingPathResponse["path"]): ContainerManifestRef[];
+export declare function authorizingContainerPathRefs(writerProjection: DocumentWriterProjectionResponse): ContainerManifestRef[][];
+export declare function authorizingContainerPathRefsForLinkSet(input: {
+    operation: DocumentLinkSetMutationOperation;
+    targetContainerId: string;
+    writerProjection: DocumentWriterProjectionResponse;
+}): ContainerManifestRef[][];

package/data/documents/shared/projection/projectionTargets.js

@@ -0,0 +1,164 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { isPlainObject as isPlainRecord } from "../../../../internal/validators/isPlainObject.js";
+import { describeDocumentTargetKek, normalizeDocumentKekTargetResponse, readManifestContainerId, serializeCanonical, sortDocumentTargets, targetEnvelopeReference, targetKey, uniqueSortedStrings, } from "../readers.js";
+export function deriveDocumentCreateTargets(projection) {
+    const targetIndex = projection.path.length - 1;
+    const targetManifest = projection.path[targetIndex];
+    if (!targetManifest) {
+        throw new Error("Container writer projection path is empty");
+    }
+    if (readManifestContainerId(targetManifest) !== projection.containerId) {
+        throw new Error("Container writer projection target path is inconsistent");
+    }
+    const targetKek = projection.containerKeks[targetIndex];
+    if (!targetKek) {
+        throw new Error("Container writer projection target KEK is unavailable");
+    }
+    if (targetKek.containerId !== projection.containerId) {
+        throw new Error("Container writer projection target KEK is inconsistent");
+    }
+    if (targetKek.accessManifestHash !== targetManifest.manifestHash) {
+        throw new Error("Container writer projection target KEK is stale");
+    }
+    return [
+        {
+            containerId: targetKek.containerId,
+            containerManifestHash: targetKek.accessManifestHash,
+            containerKeyEpochId: targetKek.containerKeyEpochId,
+            containerKeyEpoch: targetKek.containerKeyEpoch,
+        },
+    ];
+}
+export function mergeTargetEnvelopes(targets, envelopes) {
+    const expectedByKey = new Map(targets.map((target) => [targetKey(target), target]));
+    const envelopeByKey = new Map();
+    for (const envelope of envelopes) {
+        const key = targetKey(envelope);
+        if (!expectedByKey.has(key)) {
+            throw new Error("Document content-key target envelope is unexpected");
+        }
+        if (envelopeByKey.has(key)) {
+            throw new Error("Document content-key target envelope is duplicated");
+        }
+        if (envelope.wrappedKey.length === 0) {
+            throw new Error("Document content-key target envelope is empty");
+        }
+        if (!isPlainRecord(envelope.wrappingMetadata)) {
+            throw new Error("Document content-key target wrapping metadata must be an object");
+        }
+        envelopeByKey.set(key, envelope);
+    }
+    return sortDocumentTargets(targets).map((target) => {
+        const envelope = envelopeByKey.get(targetKey(target));
+        if (!envelope) {
+            throw new Error("Document content-key target envelope is missing");
+        }
+        return envelope;
+    });
+}
+function projectionLeafContainerId(projection) {
+    const leafBundle = projection.path.at(-1);
+    return leafBundle ? readManifestContainerId(leafBundle) : null;
+}
+export function describeProjectionTargetKek(projection) {
+    const targetKek = projection.containerKeks.at(-1);
+    const containerId = projectionLeafContainerId(projection) ??
+        targetKek?.containerId ??
+        projection.containerId;
+    return targetKek
+        ? `container ${containerId} epoch ${targetKek.containerKeyEpochId}`
+        : `container ${containerId}`;
+}
+export function deriveDocumentTargetFromProjection(projection) {
+    const target = deriveDocumentCreateTargets(projection)[0];
+    if (!target) {
+        throw new Error("Document target projection is unavailable");
+    }
+    return target;
+}
+export function readLinkedContainerIdsFromDocumentManifest(writerProjection) {
+    const state = writerProjection.documentManifest.state;
+    const linkedContainerIds = isPlainRecord(state)
+        ? Reflect.get(state, "linkedContainerIds")
+        : undefined;
+    if (!Array.isArray(linkedContainerIds) ||
+        linkedContainerIds.some((containerId) => typeof containerId !== "string" || containerId.length === 0)) {
+        throw new Error("Document link-set state is invalid");
+    }
+    return uniqueSortedStrings(linkedContainerIds);
+}
+/**
+ * The targets a content-key (re)wrap may address. The server's KEK target list
+ * only says which linked containers the bundle must cover; the epoch each
+ * envelope lands on comes from that container's verified authorizing-path
+ * leaf, never from the server row. A listed epoch that is not the linked
+ * container's verified current head — a predecessor a revoked member still
+ * holds, or another container's epoch — therefore fails before any wrap, as
+ * does a container listed twice. A linked container with no authorizing path
+ * is an availability gap, not tampering: its KEK is simply unavailable here.
+ */
+export function verifiedDocumentWrapTargets(input) {
+    const verifiedByKey = new Map();
+    const verifiedContainerIds = new Set();
+    for (const projection of input.writerProjection.authorizingContainerPaths) {
+        const target = deriveDocumentTargetFromProjection(projection);
+        verifiedByKey.set(targetKey(target), target);
+        verifiedContainerIds.add(target.containerId);
+    }
+    const containerIds = input.serverTargets.map((target) => target.containerId);
+    if (new Set(containerIds).size !== containerIds.length) {
+        throw new KeyingVerificationError("duplicate_entry", "Document content-key targets name a linked container more than once");
+    }
+    const linkedContainerIds = uniqueSortedStrings(input.linkedContainerIds);
+    const sortedContainerIds = uniqueSortedStrings(containerIds);
+    if (sortedContainerIds.length !== linkedContainerIds.length ||
+        sortedContainerIds.some((id, index) => id !== linkedContainerIds[index])) {
+        throw new KeyingVerificationError("object_mismatch", "Document content-key targets do not match the linked containers");
+    }
+    return sortDocumentTargets(input.serverTargets.map((target) => {
+        const verified = verifiedByKey.get(targetKey(target));
+        if (verified) {
+            return verified;
+        }
+        if (!verifiedContainerIds.has(target.containerId)) {
+            throw new Error(`Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`);
+        }
+        throw new KeyingVerificationError("object_mismatch", `Document content-key target is not the verified head of ${describeDocumentTargetKek(target)}`);
+    }));
+}
+export function currentDocumentTargets(writerProjection) {
+    const targets = normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets);
+    const bundleTargets = sortDocumentTargets(writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference));
+    if (serializeCanonical(targets, "KEK targets") !==
+        serializeCanonical(bundleTargets, "content-key targets")) {
+        throw new Error("Document link-set content-key targets mismatch");
+    }
+    return targets;
+}
+/**
+ * Reduce a single container path (root→leaf chain) to {containerId,
+ * manifestHash} references. The server already stores each manifest and resolves
+ * it from its own store, so a write echoes only the hashes instead of
+ * re-embedding the full signed bundles it received in the writer projection.
+ */
+export function containerPathRefs(path) {
+    return path.map((bundle) => {
+        const containerId = readManifestContainerId(bundle);
+        if (!containerId) {
+            throw new Error("Container path manifest is missing a container id");
+        }
+        return { containerId, manifestHash: bundle.manifestHash };
+    });
+}
+export function authorizingContainerPathRefs(writerProjection) {
+    return writerProjection.authorizingContainerPaths.map((projection) => containerPathRefs(projection.path));
+}
+export function authorizingContainerPathRefsForLinkSet(input) {
+    const paths = input.writerProjection.authorizingContainerPaths.filter((projection) => input.operation === "link" ||
+        projectionLeafContainerId(projection) !== input.targetContainerId);
+    if (paths.length === 0) {
+        throw new Error("Document link-set authorizing paths are missing");
+    }
+    return paths.map((projection) => containerPathRefs(projection.path));
+}
+//# sourceMappingURL=projectionTargets.js.map

package/data/documents/shared/projection/projectionTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionTargets.js","sourceRoot":"","sources":["projectionTargets.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AASrF,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,MAAM,UAAU,2BAA2B,CACzC,UAAuC;IAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,uBAAuB,CAAC,cAAc,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,SAAS,CAAC,kBAAkB,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL;YACE,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,qBAAqB,EAAE,SAAS,CAAC,kBAAkB;YACnD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA4C,EAC5C,SAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACrD,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAuC;IAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,UAAuC;IAEvC,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GACf,yBAAyB,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,WAAW;QACtB,UAAU,CAAC,WAAW,CAAC;IACzB,OAAO,SAAS;QACd,CAAC,CAAC,aAAa,WAAW,UAAU,SAAS,CAAC,mBAAmB,EAAE;QACnE,CAAC,CAAC,aAAa,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAuC;IAEvC,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,gBAAkD;IAElD,MAAM,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACtD,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAClC,kBAAkB,CAAC,IAAI,CACrB,CAAC,WAAW,EAAE,EAAE,CACd,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QAC9D,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC7D,IACE,kBAAkB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACvD,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CACxB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,uDAAuD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,gBAAkD;IAElD,MAAM,OAAO,GAAG,kCAAkC,CAChD,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACvC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CACvE,CAAC;IAEF,IACE,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC;QAC1C,kBAAkB,CAAC,aAAa,EAAE,qBAAqB,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAyC;IAEzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,gBAAkD;IAElD,OAAO,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACnE,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CACnE,CAAC,UAAU,EAAE,EAAE,CACb,KAAK,CAAC,SAAS,KAAK,MAAM;QAC1B,yBAAyB,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB,CACpE,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import {\n  type DocumentContentKeyTarget,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKeyingPathResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  describeDocumentTargetKek,\n  normalizeDocumentKekTargetResponse,\n  readManifestContainerId,\n  serializeCanonical,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n  targetKey,\n  uniqueSortedStrings,\n} from \"../readers\";\nimport type { DocumentLinkSetMutationOperation } from \"../types\";\n\nexport function deriveDocumentCreateTargets(\n  projection: ContainerKeyingPathResponse,\n): DocumentContentKeyTarget[] {\n  const targetIndex = projection.path.length - 1;\n  const targetManifest = projection.path[targetIndex];\n  if (!targetManifest) {\n    throw new Error(\"Container writer projection path is empty\");\n  }\n\n  if (readManifestContainerId(targetManifest) !== projection.containerId) {\n    throw new Error(\"Container writer projection target path is inconsistent\");\n  }\n\n  const targetKek = projection.containerKeks[targetIndex];\n  if (!targetKek) {\n    throw new Error(\"Container writer projection target KEK is unavailable\");\n  }\n  if (targetKek.containerId !== projection.containerId) {\n    throw new Error(\"Container writer projection target KEK is inconsistent\");\n  }\n  if (targetKek.accessManifestHash !== targetManifest.manifestHash) {\n    throw new Error(\"Container writer projection target KEK is stale\");\n  }\n\n  return [\n    {\n      containerId: targetKek.containerId,\n      containerManifestHash: targetKek.accessManifestHash,\n      containerKeyEpochId: targetKek.containerKeyEpochId,\n      containerKeyEpoch: targetKek.containerKeyEpoch,\n    },\n  ];\n}\n\nexport function mergeTargetEnvelopes(\n  targets: readonly DocumentContentKeyTarget[],\n  envelopes: readonly DocumentContentKeyTargetEnvelope[],\n): DocumentContentKeyTargetEnvelope[] {\n  const expectedByKey = new Map(\n    targets.map((target) => [targetKey(target), target]),\n  );\n  const envelopeByKey = new Map<string, DocumentContentKeyTargetEnvelope>();\n\n  for (const envelope of envelopes) {\n    const key = targetKey(envelope);\n    if (!expectedByKey.has(key)) {\n      throw new Error(\"Document content-key target envelope is unexpected\");\n    }\n    if (envelopeByKey.has(key)) {\n      throw new Error(\"Document content-key target envelope is duplicated\");\n    }\n    if (envelope.wrappedKey.length === 0) {\n      throw new Error(\"Document content-key target envelope is empty\");\n    }\n    if (!isPlainRecord(envelope.wrappingMetadata)) {\n      throw new Error(\n        \"Document content-key target wrapping metadata must be an object\",\n      );\n    }\n    envelopeByKey.set(key, envelope);\n  }\n\n  return sortDocumentTargets(targets).map((target) => {\n    const envelope = envelopeByKey.get(targetKey(target));\n    if (!envelope) {\n      throw new Error(\"Document content-key target envelope is missing\");\n    }\n    return envelope;\n  });\n}\n\nfunction projectionLeafContainerId(\n  projection: ContainerKeyingPathResponse,\n): string | null {\n  const leafBundle = projection.path.at(-1);\n  return leafBundle ? readManifestContainerId(leafBundle) : null;\n}\n\nexport function describeProjectionTargetKek(\n  projection: ContainerKeyingPathResponse,\n): string {\n  const targetKek = projection.containerKeks.at(-1);\n  const containerId =\n    projectionLeafContainerId(projection) ??\n    targetKek?.containerId ??\n    projection.containerId;\n  return targetKek\n    ? `container ${containerId} epoch ${targetKek.containerKeyEpochId}`\n    : `container ${containerId}`;\n}\n\nexport function deriveDocumentTargetFromProjection(\n  projection: ContainerKeyingPathResponse,\n): DocumentContentKeyTarget {\n  const target = deriveDocumentCreateTargets(projection)[0];\n  if (!target) {\n    throw new Error(\"Document target projection is unavailable\");\n  }\n  return target;\n}\n\nexport function readLinkedContainerIdsFromDocumentManifest(\n  writerProjection: DocumentWriterProjectionResponse,\n): string[] {\n  const state = writerProjection.documentManifest.state;\n  const linkedContainerIds = isPlainRecord(state)\n    ? Reflect.get(state, \"linkedContainerIds\")\n    : undefined;\n  if (\n    !Array.isArray(linkedContainerIds) ||\n    linkedContainerIds.some(\n      (containerId) =>\n        typeof containerId !== \"string\" || containerId.length === 0,\n    )\n  ) {\n    throw new Error(\"Document link-set state is invalid\");\n  }\n\n  return uniqueSortedStrings(linkedContainerIds);\n}\n\n/**\n * The targets a content-key (re)wrap may address. The server's KEK target list\n * only says which linked containers the bundle must cover; the epoch each\n * envelope lands on comes from that container's verified authorizing-path\n * leaf, never from the server row. A listed epoch that is not the linked\n * container's verified current head — a predecessor a revoked member still\n * holds, or another container's epoch — therefore fails before any wrap, as\n * does a container listed twice. A linked container with no authorizing path\n * is an availability gap, not tampering: its KEK is simply unavailable here.\n */\nexport function verifiedDocumentWrapTargets(input: {\n  linkedContainerIds: readonly string[];\n  serverTargets: readonly DocumentContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentContentKeyTarget[] {\n  const verifiedByKey = new Map<string, DocumentContentKeyTarget>();\n  const verifiedContainerIds = new Set<string>();\n  for (const projection of input.writerProjection.authorizingContainerPaths) {\n    const target = deriveDocumentTargetFromProjection(projection);\n    verifiedByKey.set(targetKey(target), target);\n    verifiedContainerIds.add(target.containerId);\n  }\n\n  const containerIds = input.serverTargets.map((target) => target.containerId);\n  if (new Set(containerIds).size !== containerIds.length) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      \"Document content-key targets name a linked container more than once\",\n    );\n  }\n  const linkedContainerIds = uniqueSortedStrings(input.linkedContainerIds);\n  const sortedContainerIds = uniqueSortedStrings(containerIds);\n  if (\n    sortedContainerIds.length !== linkedContainerIds.length ||\n    sortedContainerIds.some((id, index) => id !== linkedContainerIds[index])\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document content-key targets do not match the linked containers\",\n    );\n  }\n\n  return sortDocumentTargets(\n    input.serverTargets.map((target) => {\n      const verified = verifiedByKey.get(targetKey(target));\n      if (verified) {\n        return verified;\n      }\n      if (!verifiedContainerIds.has(target.containerId)) {\n        throw new Error(\n          `Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `Document content-key target is not the verified head of ${describeDocumentTargetKek(target)}`,\n      );\n    }),\n  );\n}\n\nexport function currentDocumentTargets(\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentContentKeyTarget[] {\n  const targets = normalizeDocumentKekTargetResponse(\n    writerProjection.documentKekTargets,\n  );\n  const bundleTargets = sortDocumentTargets(\n    writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference),\n  );\n\n  if (\n    serializeCanonical(targets, \"KEK targets\") !==\n    serializeCanonical(bundleTargets, \"content-key targets\")\n  ) {\n    throw new Error(\"Document link-set content-key targets mismatch\");\n  }\n\n  return targets;\n}\n\n/**\n * Reduce a single container path (root→leaf chain) to {containerId,\n * manifestHash} references. The server already stores each manifest and resolves\n * it from its own store, so a write echoes only the hashes instead of\n * re-embedding the full signed bundles it received in the writer projection.\n */\nexport function containerPathRefs(\n  path: ContainerKeyingPathResponse[\"path\"],\n): ContainerManifestRef[] {\n  return path.map((bundle) => {\n    const containerId = readManifestContainerId(bundle);\n    if (!containerId) {\n      throw new Error(\"Container path manifest is missing a container id\");\n    }\n    return { containerId, manifestHash: bundle.manifestHash };\n  });\n}\n\nexport function authorizingContainerPathRefs(\n  writerProjection: DocumentWriterProjectionResponse,\n): ContainerManifestRef[][] {\n  return writerProjection.authorizingContainerPaths.map((projection) =>\n    containerPathRefs(projection.path),\n  );\n}\n\nexport function authorizingContainerPathRefsForLinkSet(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerId: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}): ContainerManifestRef[][] {\n  const paths = input.writerProjection.authorizingContainerPaths.filter(\n    (projection) =>\n      input.operation === \"link\" ||\n      projectionLeafContainerId(projection) !== input.targetContainerId,\n  );\n  if (paths.length === 0) {\n    throw new Error(\"Document link-set authorizing paths are missing\");\n  }\n\n  return paths.map((projection) => containerPathRefs(projection.path));\n}\n"]}

package/data/documents/shared/responses.d.ts

@@ -1,6 +1,6 @@
 import type { DocumentCreateResponse, DocumentLinkSetMutationResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { DocumentCreatePlan, DocumentLinkSetMutationPlan, PersistedDocumentCreateState } from "./types.js";
-export { DocumentSyncResponseUpdateContentKeyError, isRetryableDocumentSyncConflict, isUpstreamDeletedDocumentSyncFailure, persistedDocumentSyncStateFromResponse, submitDocumentSync, } from "./syncResponses.js";
+export { DocumentSyncResponseUpdateContentKeyError, isRetryableDocumentSyncConflict, isUpstreamDeletedDocumentSyncFailure, persistedDocumentSyncStateFromResponse, submitDocumentSync, } from "./sync/syncResponses.js";
 export declare function assertDocumentCreateResponseMatchesPlan(plan: DocumentCreatePlan, response: DocumentCreateResponse): void;
 export declare function persistedDocumentCreateStateFromResponse(plan: DocumentCreatePlan, response: DocumentCreateResponse): PersistedDocumentCreateState;
 /**

package/data/documents/shared/responses.js

@@ -1,6 +1,6 @@
 import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
 import { readRecordString, serializeCanonical, serializedPersistedDocumentState, } from "./readers.js";
-export { DocumentSyncResponseUpdateContentKeyError, isRetryableDocumentSyncConflict, isUpstreamDeletedDocumentSyncFailure, persistedDocumentSyncStateFromResponse, submitDocumentSync, } from "./syncResponses.js";
+export { DocumentSyncResponseUpdateContentKeyError, isRetryableDocumentSyncConflict, isUpstreamDeletedDocumentSyncFailure, persistedDocumentSyncStateFromResponse, submitDocumentSync, } from "./sync/syncResponses.js";
 function assertDocumentMutationManifestMatchesPlan(input) {
     const { label, plan, response } = input;
     if (response.id !== plan.documentId) {

package/data/documents/shared/responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"responses.js","sourceRoot":"","sources":["responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,oCAAoC,EACpC,sCAAsC,EACtC,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAkBzB,SAAS,yCAAyC,CAAC,KAKlD;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,IACE,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;QAChE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IACE,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC;QAC5D,IAAI,CAAC,SAAS,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,IACE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAChE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,IACE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC;QACpE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC;IACpD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QACD,IACE,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,gBAAgB,CAAC;YAC/D,IAAI,CAAC,UAAU,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IACE,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC;QAC1C,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAAC,KAMlD;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,QAAQ,CAAC,gBAAgB,CAAC,eAAe,KAAK,KAAK,CAAC,uBAAuB,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,IACE,kBAAkB,CAChB,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EACjC,qBAAqB,CACtB;QACD,kBAAkB,CAAC,KAAK,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,mBAAmB,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC;QACtE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAAC,KAOlD;IACC,yCAAyC,CAAC,KAAK,CAAC,CAAC;IACjD,yCAAyC,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,IAAwB,EACxB,QAAgC;IAEhC,yCAAyC,CAAC;QACxC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACtE,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO;QAChE,KAAK,EAAE,0BAA0B;QACjC,IAAI;QACJ,oBAAoB,EAAE,IAAI;QAC1B,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,IAAwB,EACxB,QAAgC;IAEhC,uCAAuC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAExD,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,QAAQ,CAAC,cAAc;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gDAAgD,CAC9D,gBAAkD;IAElD,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;QACnD,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,sBAAsB,EAAE,gBAAgB,CAAC,gBAAgB;KAC1D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iDAAiD,CAC/D,IAAiC,EACjC,QAAyC;IAEzC,yCAAyC,CAAC;QACxC,uBAAuB,EAAE,IAAI,CAAC,eAAe;QAC7C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO;QAChE,KAAK,EAAE,4BAA4B;QACnC,IAAI;QACJ,oBAAoB,EAAE,KAAK;QAC3B,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,QAAQ,CAAC,cAAc;KAChD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type {\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  readRecordString,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"./readers\";\nimport type {\n  DocumentCreatePlan,\n  DocumentLinkSetMutationPlan,\n  PersistedDocumentCreateState,\n} from \"./types\";\n\nexport {\n  DocumentSyncResponseUpdateContentKeyError,\n  isRetryableDocumentSyncConflict,\n  isUpstreamDeletedDocumentSyncFailure,\n  persistedDocumentSyncStateFromResponse,\n  submitDocumentSync,\n} from \"./syncResponses\";\n\ntype DocumentMutationPlan = Pick<\n  DocumentCreatePlan,\n  | \"documentId\"\n  | \"event\"\n  | \"eventHash\"\n  | \"manifest\"\n  | \"manifestHash\"\n  | \"state\"\n  | \"targetHash\"\n  | \"targets\"\n> & {\n  // Link and unlink bodies are both serialized canonically, so the shared\n  // matcher does not care which event body shape the plan carries.\n  body: unknown;\n};\n\nfunction assertDocumentMutationManifestMatchesPlan(input: {\n  label: string;\n  plan: DocumentMutationPlan;\n  probeStateDocumentId: boolean;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  const { label, plan, response } = input;\n  if (response.id !== plan.documentId) {\n    throw new Error(`${label} id mismatch`);\n  }\n  if (response.accessManifest.manifestHash !== plan.manifestHash) {\n    throw new Error(`${label} manifest hash mismatch`);\n  }\n  if (\n    serializeCanonical(response.accessManifest.manifest, \"manifest\") !==\n    serializeCanonical(plan.manifest, \"manifest\")\n  ) {\n    throw new Error(`${label} manifest mismatch`);\n  }\n\n  const responseEvent = response.accessManifest.event;\n  if (!isPlainRecord(responseEvent)) {\n    throw new Error(`${label} event bundle is invalid`);\n  }\n  if (\n    readRecordString(responseEvent, \"eventHash\", \"event bundle\") !==\n    plan.eventHash\n  ) {\n    throw new Error(`${label} event hash mismatch`);\n  }\n  if (\n    serializeCanonical(Reflect.get(responseEvent, \"event\"), \"event\") !==\n    serializeCanonical(plan.event, \"event\")\n  ) {\n    throw new Error(`${label} event mismatch`);\n  }\n  if (\n    serializeCanonical(Reflect.get(responseEvent, \"body\"), \"event body\") !==\n    serializeCanonical(plan.body, \"event body\")\n  ) {\n    throw new Error(`${label} event body mismatch`);\n  }\n\n  const responseState = response.accessManifest.state;\n  if (input.probeStateDocumentId) {\n    if (!isPlainRecord(responseState)) {\n      throw new Error(`${label} state is invalid`);\n    }\n    if (\n      readRecordString(responseState, \"documentId\", \"document state\") !==\n      plan.documentId\n    ) {\n      throw new Error(`${label} document id mismatch`);\n    }\n  }\n  if (\n    serializeCanonical(responseState, \"state\") !==\n    serializeCanonical(plan.state, \"state\")\n  ) {\n    throw new Error(`${label} state mismatch`);\n  }\n}\n\nfunction assertDocumentMutationKeyBundlesMatchPlan(input: {\n  expectedContentKeyEpoch: number;\n  expectedContentKeyTargets: unknown;\n  label: string;\n  plan: DocumentMutationPlan;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  const { label, plan, response } = input;\n  if (response.contentKeyBundle.documentId !== plan.documentId) {\n    throw new Error(`${label} content-key document mismatch`);\n  }\n  if (\n    response.contentKeyBundle.contentKeyEpoch !== input.expectedContentKeyEpoch\n  ) {\n    throw new Error(`${label} content-key epoch mismatch`);\n  }\n  if (response.contentKeyBundle.linkSetManifestHash !== plan.manifestHash) {\n    throw new Error(`${label} link manifest mismatch`);\n  }\n  if (response.contentKeyBundle.targetHash !== plan.targetHash) {\n    throw new Error(`${label} target hash mismatch`);\n  }\n  if (\n    serializeCanonical(\n      response.contentKeyBundle.targets,\n      \"content-key targets\",\n    ) !==\n    serializeCanonical(input.expectedContentKeyTargets, \"content-key targets\")\n  ) {\n    throw new Error(`${label} content-key targets mismatch`);\n  }\n  if (response.documentKekTargets.documentId !== plan.documentId) {\n    throw new Error(`${label} target document mismatch`);\n  }\n  if (response.documentKekTargets.linkSetManifestHash !== plan.manifestHash) {\n    throw new Error(`${label} target manifest mismatch`);\n  }\n  if (response.documentKekTargets.documentKeyTargetHash !== plan.targetHash) {\n    throw new Error(`${label} document target hash mismatch`);\n  }\n  if (\n    serializeCanonical(response.documentKekTargets.targets, \"KEK targets\") !==\n    serializeCanonical(plan.targets, \"KEK targets\")\n  ) {\n    throw new Error(`${label} KEK targets mismatch`);\n  }\n}\n\nfunction assertDocumentMutationResponseMatchesPlan(input: {\n  expectedContentKeyEpoch: number;\n  expectedContentKeyTargets: unknown;\n  label: string;\n  plan: DocumentMutationPlan;\n  probeStateDocumentId: boolean;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  assertDocumentMutationManifestMatchesPlan(input);\n  assertDocumentMutationKeyBundlesMatchPlan(input);\n}\n\nexport function assertDocumentCreateResponseMatchesPlan(\n  plan: DocumentCreatePlan,\n  response: DocumentCreateResponse,\n): void {\n  assertDocumentMutationResponseMatchesPlan({\n    expectedContentKeyEpoch: plan.request.contentKeyBundle.contentKeyEpoch,\n    expectedContentKeyTargets: plan.request.contentKeyBundle.targets,\n    label: \"Document create response\",\n    plan,\n    probeStateDocumentId: true,\n    response,\n  });\n}\n\nexport function persistedDocumentCreateStateFromResponse(\n  plan: DocumentCreatePlan,\n  response: DocumentCreateResponse,\n): PersistedDocumentCreateState {\n  assertDocumentCreateResponseMatchesPlan(plan, response);\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: response.id,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: response.accessManifest,\n  });\n}\n\n/**\n * Builds the persisted create-state from a fetched writer projection, for the\n * idempotent-create adopt path where the original create response (which\n * `persistedDocumentCreateStateFromResponse` consumes) was lost. The projection\n * carries the same committed manifest, content-key bundle and KEK targets — the\n * caller must verify it with `assertDocumentWriterProjectionConsistent` first.\n */\nexport function persistedDocumentCreateStateFromWriterProjection(\n  writerProjection: DocumentWriterProjectionResponse,\n): PersistedDocumentCreateState {\n  return serializedPersistedDocumentState({\n    contentKeyBundle: writerProjection.contentKeyBundle,\n    documentId: writerProjection.documentId,\n    documentKekTargets: writerProjection.documentKekTargets,\n    documentManifestBundle: writerProjection.documentManifest,\n  });\n}\n\nexport function persistedDocumentLinkSetMutationStateFromResponse(\n  plan: DocumentLinkSetMutationPlan,\n  response: DocumentLinkSetMutationResponse,\n): PersistedDocumentCreateState {\n  assertDocumentMutationResponseMatchesPlan({\n    expectedContentKeyEpoch: plan.contentKeyEpoch,\n    expectedContentKeyTargets: plan.request.contentKeyBundle.targets,\n    label: \"Document link-set response\",\n    plan,\n    probeStateDocumentId: false,\n    response,\n  });\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: response.id,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: response.accessManifest,\n  });\n}\n"]}
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,oCAAoC,EACpC,sCAAsC,EACtC,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAkB9B,SAAS,yCAAyC,CAAC,KAKlD;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,IACE,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;QAChE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IACE,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC;QAC5D,IAAI,CAAC,SAAS,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,IACE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAChE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,IACE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC;QACpE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC;IACpD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QACD,IACE,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,gBAAgB,CAAC;YAC/D,IAAI,CAAC,UAAU,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IACE,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC;QAC1C,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAAC,KAMlD;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,QAAQ,CAAC,gBAAgB,CAAC,eAAe,KAAK,KAAK,CAAC,uBAAuB,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,IACE,kBAAkB,CAChB,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EACjC,qBAAqB,CACtB;QACD,kBAAkB,CAAC,KAAK,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,mBAAmB,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC;QACtE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAAC,KAOlD;IACC,yCAAyC,CAAC,KAAK,CAAC,CAAC;IACjD,yCAAyC,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,IAAwB,EACxB,QAAgC;IAEhC,yCAAyC,CAAC;QACxC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACtE,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO;QAChE,KAAK,EAAE,0BAA0B;QACjC,IAAI;QACJ,oBAAoB,EAAE,IAAI;QAC1B,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,IAAwB,EACxB,QAAgC;IAEhC,uCAAuC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAExD,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,QAAQ,CAAC,cAAc;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gDAAgD,CAC9D,gBAAkD;IAElD,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;QACnD,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,sBAAsB,EAAE,gBAAgB,CAAC,gBAAgB;KAC1D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iDAAiD,CAC/D,IAAiC,EACjC,QAAyC;IAEzC,yCAAyC,CAAC;QACxC,uBAAuB,EAAE,IAAI,CAAC,eAAe;QAC7C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO;QAChE,KAAK,EAAE,4BAA4B;QACnC,IAAI;QACJ,oBAAoB,EAAE,KAAK;QAC3B,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,QAAQ,CAAC,cAAc;KAChD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type {\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  readRecordString,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"./readers\";\nimport type {\n  DocumentCreatePlan,\n  DocumentLinkSetMutationPlan,\n  PersistedDocumentCreateState,\n} from \"./types\";\n\nexport {\n  DocumentSyncResponseUpdateContentKeyError,\n  isRetryableDocumentSyncConflict,\n  isUpstreamDeletedDocumentSyncFailure,\n  persistedDocumentSyncStateFromResponse,\n  submitDocumentSync,\n} from \"./sync/syncResponses\";\n\ntype DocumentMutationPlan = Pick<\n  DocumentCreatePlan,\n  | \"documentId\"\n  | \"event\"\n  | \"eventHash\"\n  | \"manifest\"\n  | \"manifestHash\"\n  | \"state\"\n  | \"targetHash\"\n  | \"targets\"\n> & {\n  // Link and unlink bodies are both serialized canonically, so the shared\n  // matcher does not care which event body shape the plan carries.\n  body: unknown;\n};\n\nfunction assertDocumentMutationManifestMatchesPlan(input: {\n  label: string;\n  plan: DocumentMutationPlan;\n  probeStateDocumentId: boolean;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  const { label, plan, response } = input;\n  if (response.id !== plan.documentId) {\n    throw new Error(`${label} id mismatch`);\n  }\n  if (response.accessManifest.manifestHash !== plan.manifestHash) {\n    throw new Error(`${label} manifest hash mismatch`);\n  }\n  if (\n    serializeCanonical(response.accessManifest.manifest, \"manifest\") !==\n    serializeCanonical(plan.manifest, \"manifest\")\n  ) {\n    throw new Error(`${label} manifest mismatch`);\n  }\n\n  const responseEvent = response.accessManifest.event;\n  if (!isPlainRecord(responseEvent)) {\n    throw new Error(`${label} event bundle is invalid`);\n  }\n  if (\n    readRecordString(responseEvent, \"eventHash\", \"event bundle\") !==\n    plan.eventHash\n  ) {\n    throw new Error(`${label} event hash mismatch`);\n  }\n  if (\n    serializeCanonical(Reflect.get(responseEvent, \"event\"), \"event\") !==\n    serializeCanonical(plan.event, \"event\")\n  ) {\n    throw new Error(`${label} event mismatch`);\n  }\n  if (\n    serializeCanonical(Reflect.get(responseEvent, \"body\"), \"event body\") !==\n    serializeCanonical(plan.body, \"event body\")\n  ) {\n    throw new Error(`${label} event body mismatch`);\n  }\n\n  const responseState = response.accessManifest.state;\n  if (input.probeStateDocumentId) {\n    if (!isPlainRecord(responseState)) {\n      throw new Error(`${label} state is invalid`);\n    }\n    if (\n      readRecordString(responseState, \"documentId\", \"document state\") !==\n      plan.documentId\n    ) {\n      throw new Error(`${label} document id mismatch`);\n    }\n  }\n  if (\n    serializeCanonical(responseState, \"state\") !==\n    serializeCanonical(plan.state, \"state\")\n  ) {\n    throw new Error(`${label} state mismatch`);\n  }\n}\n\nfunction assertDocumentMutationKeyBundlesMatchPlan(input: {\n  expectedContentKeyEpoch: number;\n  expectedContentKeyTargets: unknown;\n  label: string;\n  plan: DocumentMutationPlan;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  const { label, plan, response } = input;\n  if (response.contentKeyBundle.documentId !== plan.documentId) {\n    throw new Error(`${label} content-key document mismatch`);\n  }\n  if (\n    response.contentKeyBundle.contentKeyEpoch !== input.expectedContentKeyEpoch\n  ) {\n    throw new Error(`${label} content-key epoch mismatch`);\n  }\n  if (response.contentKeyBundle.linkSetManifestHash !== plan.manifestHash) {\n    throw new Error(`${label} link manifest mismatch`);\n  }\n  if (response.contentKeyBundle.targetHash !== plan.targetHash) {\n    throw new Error(`${label} target hash mismatch`);\n  }\n  if (\n    serializeCanonical(\n      response.contentKeyBundle.targets,\n      \"content-key targets\",\n    ) !==\n    serializeCanonical(input.expectedContentKeyTargets, \"content-key targets\")\n  ) {\n    throw new Error(`${label} content-key targets mismatch`);\n  }\n  if (response.documentKekTargets.documentId !== plan.documentId) {\n    throw new Error(`${label} target document mismatch`);\n  }\n  if (response.documentKekTargets.linkSetManifestHash !== plan.manifestHash) {\n    throw new Error(`${label} target manifest mismatch`);\n  }\n  if (response.documentKekTargets.documentKeyTargetHash !== plan.targetHash) {\n    throw new Error(`${label} document target hash mismatch`);\n  }\n  if (\n    serializeCanonical(response.documentKekTargets.targets, \"KEK targets\") !==\n    serializeCanonical(plan.targets, \"KEK targets\")\n  ) {\n    throw new Error(`${label} KEK targets mismatch`);\n  }\n}\n\nfunction assertDocumentMutationResponseMatchesPlan(input: {\n  expectedContentKeyEpoch: number;\n  expectedContentKeyTargets: unknown;\n  label: string;\n  plan: DocumentMutationPlan;\n  probeStateDocumentId: boolean;\n  response: DocumentCreateResponse | DocumentLinkSetMutationResponse;\n}): void {\n  assertDocumentMutationManifestMatchesPlan(input);\n  assertDocumentMutationKeyBundlesMatchPlan(input);\n}\n\nexport function assertDocumentCreateResponseMatchesPlan(\n  plan: DocumentCreatePlan,\n  response: DocumentCreateResponse,\n): void {\n  assertDocumentMutationResponseMatchesPlan({\n    expectedContentKeyEpoch: plan.request.contentKeyBundle.contentKeyEpoch,\n    expectedContentKeyTargets: plan.request.contentKeyBundle.targets,\n    label: \"Document create response\",\n    plan,\n    probeStateDocumentId: true,\n    response,\n  });\n}\n\nexport function persistedDocumentCreateStateFromResponse(\n  plan: DocumentCreatePlan,\n  response: DocumentCreateResponse,\n): PersistedDocumentCreateState {\n  assertDocumentCreateResponseMatchesPlan(plan, response);\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: response.id,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: response.accessManifest,\n  });\n}\n\n/**\n * Builds the persisted create-state from a fetched writer projection, for the\n * idempotent-create adopt path where the original create response (which\n * `persistedDocumentCreateStateFromResponse` consumes) was lost. The projection\n * carries the same committed manifest, content-key bundle and KEK targets — the\n * caller must verify it with `assertDocumentWriterProjectionConsistent` first.\n */\nexport function persistedDocumentCreateStateFromWriterProjection(\n  writerProjection: DocumentWriterProjectionResponse,\n): PersistedDocumentCreateState {\n  return serializedPersistedDocumentState({\n    contentKeyBundle: writerProjection.contentKeyBundle,\n    documentId: writerProjection.documentId,\n    documentKekTargets: writerProjection.documentKekTargets,\n    documentManifestBundle: writerProjection.documentManifest,\n  });\n}\n\nexport function persistedDocumentLinkSetMutationStateFromResponse(\n  plan: DocumentLinkSetMutationPlan,\n  response: DocumentLinkSetMutationResponse,\n): PersistedDocumentCreateState {\n  assertDocumentMutationResponseMatchesPlan({\n    expectedContentKeyEpoch: plan.contentKeyEpoch,\n    expectedContentKeyTargets: plan.request.contentKeyBundle.targets,\n    label: \"Document link-set response\",\n    plan,\n    probeStateDocumentId: false,\n    response,\n  });\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: response.id,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: response.accessManifest,\n  });\n}\n"]}

package/data/documents/shared/sync/documentSyncUpdateDecryption.js

@@ -0,0 +1,238 @@
+import { assertAesGcmIv, CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, } from "../../../../internal/crypto/index.js";
+import { base64ToBytes } from "../../../../internal/encoding/index.js";
+import { versionVectorsEqual } from "../../../../internal/loro/index.js";
+import { isPlainObject as isPlainRecord } from "../../../../internal/validators/isPlainObject.js";
+import { contentRecordAdditionalDataBytes } from "../contentRecordAdditionalData.js";
+import { deriveDocumentContentRecordKey, deriveDocumentPlaintextHashKey, } from "../contentRecordKeys.js";
+import { assertDecryptedDocumentUpdateMetadata } from "../documentUpdateIntegrity.js";
+import { assertDocumentUpdatePlaintextHash } from "../plaintextHash.js";
+import { assertOnlyRecordKeys, asWebCryptoBytes, readRecordPositiveInteger, readRecordString, readWriteHeader, } from "../readers.js";
+import { DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT, DOCUMENT_ENCRYPTED_UPDATE_KEYS, } from "../types.js";
+import { isolateDocumentSyncUpdateError } from "./documentSyncUpdateIsolation.js";
+function parseDocumentEncryptedUpdate(encryptedData) {
+    let value;
+    try {
+        value = JSON.parse(encryptedData);
+    }
+    catch {
+        throw new Error("Document encrypted update is invalid JSON");
+    }
+    if (!isPlainRecord(value)) {
+        throw new Error("Document encrypted update must be an object");
+    }
+    assertOnlyRecordKeys(value, DOCUMENT_ENCRYPTED_UPDATE_KEYS, "Document encrypted update");
+    if (readRecordString(value, "format", "Document encrypted update") !==
+        DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT) {
+        throw new Error("Document encrypted update format is invalid");
+    }
+    const version = readRecordPositiveInteger(value, "version", "Document encrypted update");
+    if (version !== 1) {
+        throw new Error(`Document encrypted update version ${version} is invalid; expected 1`);
+    }
+    if (readRecordString(value, "encryptionSuite", "Document encrypted update") !==
+        CONTENT_RECORD_ENCRYPTION_SUITE) {
+        throw new Error("Document encrypted update suite is invalid");
+    }
+    const iv = base64ToBytes(readRecordString(value, "iv", "Document encrypted update"));
+    assertAesGcmIv(iv, "Document encrypted update IV is invalid");
+    return {
+        ciphertext: base64ToBytes(readRecordString(value, "ciphertext", "Document encrypted update")),
+        contentKeyEpoch: readRecordPositiveInteger(value, "contentKeyEpoch", "Document encrypted update"),
+        contentRecordId: readRecordString(value, "contentRecordId", "Document encrypted update"),
+        metadataHash: readRecordString(value, "metadataHash", "Document encrypted update"),
+        nonceDomainHash: readRecordString(value, "nonceDomainHash", "Document encrypted update"),
+        iv,
+    };
+}
+async function assertDocumentEncryptedUpdateMatchesHeader(input) {
+    const { encrypted, update } = input;
+    const hasCheckpointMetadata = update.checkpointKind !== undefined ||
+        update.checkpointPayloadKind !== undefined ||
+        update.sourceVersionVector !== undefined;
+    if (hasCheckpointMetadata &&
+        (update.checkpointKind !== "rotate_baseline" ||
+            update.checkpointPayloadKind !== "full_history_snapshot" ||
+            !update.sourceVersionVector ||
+            !versionVectorsEqual(update.sourceVersionVector, update.partialEndVersionVector))) {
+        throw new Error("Document rotation checkpoint metadata mismatch");
+    }
+    if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {
+        throw new Error("Document encrypted update content-key epoch mismatch");
+    }
+    if (update.documentId !== input.documentId) {
+        throw new Error("Document encrypted update document id mismatch");
+    }
+    if (encrypted.contentRecordId !==
+        readRecordString(update.writeHeader, "contentRecordId", "write header")) {
+        throw new Error("Document encrypted update content record mismatch");
+    }
+    const metadataHash = await computeDocumentContentRecordMetadataHash({
+        ...(update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: update.checkpointKind }),
+        ...(update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: update.checkpointPayloadKind }),
+        documentId: input.documentId,
+        partialEndVersionVector: update.partialEndVersionVector,
+        partialStartVersionVector: update.partialStartVersionVector,
+        plaintextHash: update.plaintextHash,
+        ...(update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: update.sourceVersionVector }),
+        updateId: update.id,
+    });
+    if (encrypted.metadataHash !== metadataHash ||
+        encrypted.metadataHash !==
+            readRecordString(update.writeHeader, "metadataHash", "write header")) {
+        throw new Error("Document encrypted update metadata hash mismatch");
+    }
+    const nonceDomainHash = await computeContentRecordNonceDomainHash({
+        version: 1,
+        organizationId: input.organizationId,
+        objectKind: "document",
+        objectId: input.documentId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId: encrypted.contentRecordId,
+    });
+    if (encrypted.nonceDomainHash !== nonceDomainHash ||
+        encrypted.nonceDomainHash !==
+            readRecordString(update.writeHeader, "nonceDomainHash", "write header")) {
+        throw new Error("Document encrypted update nonce domain mismatch");
+    }
+    const ciphertextHash = await computeDocumentContentRecordCiphertextHash(input.encryptedData);
+    if (ciphertextHash !==
+        readRecordString(update.writeHeader, "ciphertextHash", "write header")) {
+        throw new Error("Document encrypted update ciphertext hash mismatch");
+    }
+}
+async function verifiedEncryptedSyncUpdate(input) {
+    try {
+        const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);
+        await assertDocumentEncryptedUpdateMatchesHeader({
+            encrypted,
+            encryptedData: input.update.encryptedData,
+            ...input,
+        });
+        return encrypted;
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "encrypted_record",
+            updateId: input.update.id,
+        });
+    }
+}
+/** Verifies the encrypted record's structure and every binding to its header. */
+export async function assertDocumentSyncUpdateEncryptedRecord(update) {
+    let contentKeyEpoch;
+    let documentId;
+    let organizationId;
+    try {
+        const header = readWriteHeader(update.writeHeader, "Document sync response write header");
+        if (header.objectKind !== "document") {
+            throw new Error("Document sync response write header kind mismatch");
+        }
+        contentKeyEpoch = header.contentKeyEpoch;
+        documentId = header.objectId;
+        organizationId = header.organizationId;
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: update,
+            stage: "write_header",
+            updateId: update.id,
+        });
+    }
+    await verifiedEncryptedSyncUpdate({
+        contentKeyEpoch,
+        documentId,
+        organizationId,
+        update,
+    });
+}
+async function decryptPayload(input) {
+    try {
+        const keyInput = {
+            contentKeyMaterial: input.contentKeyMaterial,
+            contentKeyEpoch: input.contentKeyEpoch,
+            contentRecordId: input.encrypted.contentRecordId,
+            documentId: input.documentId,
+            organizationId: input.organizationId,
+        };
+        const [recordKey, plaintextHashKey] = await Promise.all([
+            deriveDocumentContentRecordKey({ ...keyInput, usage: "decrypt" }),
+            deriveDocumentPlaintextHashKey(keyInput),
+        ]);
+        const updateData = new Uint8Array(await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: asWebCryptoBytes(input.encrypted.iv),
+            additionalData: contentRecordAdditionalDataBytes({
+                contentKeyEpoch: input.contentKeyEpoch,
+                contentRecordId: input.encrypted.contentRecordId,
+                documentId: input.documentId,
+                metadataHash: input.encrypted.metadataHash,
+                nonceDomainHash: input.encrypted.nonceDomainHash,
+                organizationId: input.organizationId,
+            }),
+        }, recordKey, asWebCryptoBytes(input.encrypted.ciphertext)));
+        return { plaintextHashKey, updateData };
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "decrypt",
+            updateId: input.update.id,
+        });
+    }
+}
+export async function decryptDocumentSyncUpdate(input) {
+    const encrypted = await verifiedEncryptedSyncUpdate(input);
+    const { plaintextHashKey, updateData } = await decryptPayload({
+        ...input,
+        encrypted,
+    });
+    try {
+        await assertDocumentUpdatePlaintextHash(updateData, input.update.plaintextHash, plaintextHashKey);
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "plaintext_integrity",
+            updateId: input.update.id,
+        });
+    }
+    try {
+        assertDecryptedDocumentUpdateMetadata(updateData, input.update);
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "loro_metadata",
+            updateId: input.update.id,
+        });
+    }
+    return {
+        ...(input.update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: input.update.checkpointKind }),
+        ...(input.update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: input.update.checkpointPayloadKind }),
+        id: input.update.id,
+        partialEndVersionVector: input.update.partialEndVersionVector,
+        partialStartVersionVector: input.update.partialStartVersionVector,
+        ...(input.update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: input.update.sourceVersionVector }),
+        updateData,
+    };
+}
+//# sourceMappingURL=documentSyncUpdateDecryption.js.map

package/data/documents/shared/sync/documentSyncUpdateDecryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncUpdateDecryption.js","sourceRoot":"","sources":["documentSyncUpdateDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,qCAAqC,EACrC,8BAA8B,GAE/B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAI/E,SAAS,4BAA4B,CACnC,aAAqB;IAErB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,oBAAoB,CAClB,KAAK,EACL,8BAA8B,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,2BAA2B,CAAC;QAC9D,qCAAqC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CACvC,KAAK,EACL,SAAS,EACT,2BAA2B,CAC5B,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,yBAAyB,CACtE,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,2BAA2B,CAAC;QACvE,+BAA+B,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CACtB,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAC3D,CAAC;IACF,cAAc,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;IAC9D,OAAO;QACL,UAAU,EAAE,aAAa,CACvB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,2BAA2B,CAAC,CACnE;QACD,eAAe,EAAE,yBAAyB,CACxC,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,YAAY,EAAE,gBAAgB,CAC5B,KAAK,EACL,cAAc,EACd,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,EAAE;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAOzD;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,qBAAqB,GACzB,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,qBAAqB,KAAK,SAAS;QAC1C,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC;IAC3C,IACE,qBAAqB;QACrB,CAAC,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC1C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB;YACxD,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,mBAAmB,CAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,uBAAuB,CAC/B,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,SAAS,CAAC,eAAe;QACzB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,YAAY,KAAK,YAAY;QACvC,SAAS,CAAC,YAAY;YACpB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IACE,SAAS,CAAC,eAAe,KAAK,eAAe;QAC7C,SAAS,CAAC,eAAe;YACvB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,0CAA0C,CAAC;YAC/C,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,MAA0B;IAE1B,IAAI,eAAuB,CAAC;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,MAAM;YACtB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,2BAA2B,CAAC;QAChC,eAAe;QACf,UAAU;QACV,cAAc;QACd,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAO7B;IACC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;YAChD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,8BAA8B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACjE,8BAA8B,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,cAAc,EAAE,gCAAgC,CAAC;gBAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;gBAC1C,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAC7C,CACF,CAAC;QACF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iCAAiC,CACrC,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import {\n  assertAesGcmIv,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport { versionVectorsEqual } from \"@tearleads/loro\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { contentRecordAdditionalDataBytes } from \"../contentRecordAdditionalData\";\nimport {\n  deriveDocumentContentRecordKey,\n  deriveDocumentPlaintextHashKey,\n} from \"../contentRecordKeys\";\nimport { assertDecryptedDocumentUpdateMetadata } from \"../documentUpdateIntegrity\";\nimport { assertDocumentUpdatePlaintextHash } from \"../plaintextHash\";\nimport {\n  assertOnlyRecordKeys,\n  asWebCryptoBytes,\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n} from \"../readers\";\nimport {\n  type DecryptedDocumentSyncUpdate,\n  DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n  DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n  type ParsedDocumentEncryptedUpdate,\n} from \"../types\";\nimport { isolateDocumentSyncUpdateError } from \"./documentSyncUpdateIsolation\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\n\nfunction parseDocumentEncryptedUpdate(\n  encryptedData: string,\n): ParsedDocumentEncryptedUpdate {\n  let value: unknown;\n  try {\n    value = JSON.parse(encryptedData);\n  } catch {\n    throw new Error(\"Document encrypted update is invalid JSON\");\n  }\n  if (!isPlainRecord(value)) {\n    throw new Error(\"Document encrypted update must be an object\");\n  }\n  assertOnlyRecordKeys(\n    value,\n    DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n    \"Document encrypted update\",\n  );\n  if (\n    readRecordString(value, \"format\", \"Document encrypted update\") !==\n    DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT\n  ) {\n    throw new Error(\"Document encrypted update format is invalid\");\n  }\n  const version = readRecordPositiveInteger(\n    value,\n    \"version\",\n    \"Document encrypted update\",\n  );\n  if (version !== 1) {\n    throw new Error(\n      `Document encrypted update version ${version} is invalid; expected 1`,\n    );\n  }\n  if (\n    readRecordString(value, \"encryptionSuite\", \"Document encrypted update\") !==\n    CONTENT_RECORD_ENCRYPTION_SUITE\n  ) {\n    throw new Error(\"Document encrypted update suite is invalid\");\n  }\n\n  const iv = base64ToBytes(\n    readRecordString(value, \"iv\", \"Document encrypted update\"),\n  );\n  assertAesGcmIv(iv, \"Document encrypted update IV is invalid\");\n  return {\n    ciphertext: base64ToBytes(\n      readRecordString(value, \"ciphertext\", \"Document encrypted update\"),\n    ),\n    contentKeyEpoch: readRecordPositiveInteger(\n      value,\n      \"contentKeyEpoch\",\n      \"Document encrypted update\",\n    ),\n    contentRecordId: readRecordString(\n      value,\n      \"contentRecordId\",\n      \"Document encrypted update\",\n    ),\n    metadataHash: readRecordString(\n      value,\n      \"metadataHash\",\n      \"Document encrypted update\",\n    ),\n    nonceDomainHash: readRecordString(\n      value,\n      \"nonceDomainHash\",\n      \"Document encrypted update\",\n    ),\n    iv,\n  };\n}\n\nasync function assertDocumentEncryptedUpdateMatchesHeader(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  encryptedData: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<void> {\n  const { encrypted, update } = input;\n  const hasCheckpointMetadata =\n    update.checkpointKind !== undefined ||\n    update.checkpointPayloadKind !== undefined ||\n    update.sourceVersionVector !== undefined;\n  if (\n    hasCheckpointMetadata &&\n    (update.checkpointKind !== \"rotate_baseline\" ||\n      update.checkpointPayloadKind !== \"full_history_snapshot\" ||\n      !update.sourceVersionVector ||\n      !versionVectorsEqual(\n        update.sourceVersionVector,\n        update.partialEndVersionVector,\n      ))\n  ) {\n    throw new Error(\"Document rotation checkpoint metadata mismatch\");\n  }\n  if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {\n    throw new Error(\"Document encrypted update content-key epoch mismatch\");\n  }\n  if (update.documentId !== input.documentId) {\n    throw new Error(\"Document encrypted update document id mismatch\");\n  }\n  if (\n    encrypted.contentRecordId !==\n    readRecordString(update.writeHeader, \"contentRecordId\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update content record mismatch\");\n  }\n\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: input.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    encrypted.metadataHash !== metadataHash ||\n    encrypted.metadataHash !==\n      readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update metadata hash mismatch\");\n  }\n\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (\n    encrypted.nonceDomainHash !== nonceDomainHash ||\n    encrypted.nonceDomainHash !==\n      readRecordString(update.writeHeader, \"nonceDomainHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update nonce domain mismatch\");\n  }\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    input.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update ciphertext hash mismatch\");\n  }\n}\n\nasync function verifiedEncryptedSyncUpdate(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<ParsedDocumentEncryptedUpdate> {\n  try {\n    const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);\n    await assertDocumentEncryptedUpdateMatchesHeader({\n      encrypted,\n      encryptedData: input.update.encryptedData,\n      ...input,\n    });\n    return encrypted;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"encrypted_record\",\n      updateId: input.update.id,\n    });\n  }\n}\n\n/** Verifies the encrypted record's structure and every binding to its header. */\nexport async function assertDocumentSyncUpdateEncryptedRecord(\n  update: SyncResponseUpdate,\n): Promise<void> {\n  let contentKeyEpoch: number;\n  let documentId: string;\n  let organizationId: string;\n  try {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (header.objectKind !== \"document\") {\n      throw new Error(\"Document sync response write header kind mismatch\");\n    }\n    contentKeyEpoch = header.contentKeyEpoch;\n    documentId = header.objectId;\n    organizationId = header.organizationId;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: update,\n      stage: \"write_header\",\n      updateId: update.id,\n    });\n  }\n  await verifiedEncryptedSyncUpdate({\n    contentKeyEpoch,\n    documentId,\n    organizationId,\n    update,\n  });\n}\n\nasync function decryptPayload(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<{ plaintextHashKey: CryptoKey; updateData: Uint8Array }> {\n  try {\n    const keyInput = {\n      contentKeyMaterial: input.contentKeyMaterial,\n      contentKeyEpoch: input.contentKeyEpoch,\n      contentRecordId: input.encrypted.contentRecordId,\n      documentId: input.documentId,\n      organizationId: input.organizationId,\n    };\n    const [recordKey, plaintextHashKey] = await Promise.all([\n      deriveDocumentContentRecordKey({ ...keyInput, usage: \"decrypt\" }),\n      deriveDocumentPlaintextHashKey(keyInput),\n    ]);\n    const updateData = new Uint8Array(\n      await crypto.subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: asWebCryptoBytes(input.encrypted.iv),\n          additionalData: contentRecordAdditionalDataBytes({\n            contentKeyEpoch: input.contentKeyEpoch,\n            contentRecordId: input.encrypted.contentRecordId,\n            documentId: input.documentId,\n            metadataHash: input.encrypted.metadataHash,\n            nonceDomainHash: input.encrypted.nonceDomainHash,\n            organizationId: input.organizationId,\n          }),\n        },\n        recordKey,\n        asWebCryptoBytes(input.encrypted.ciphertext),\n      ),\n    );\n    return { plaintextHashKey, updateData };\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"decrypt\",\n      updateId: input.update.id,\n    });\n  }\n}\n\nexport async function decryptDocumentSyncUpdate(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<DecryptedDocumentSyncUpdate> {\n  const encrypted = await verifiedEncryptedSyncUpdate(input);\n  const { plaintextHashKey, updateData } = await decryptPayload({\n    ...input,\n    encrypted,\n  });\n  try {\n    await assertDocumentUpdatePlaintextHash(\n      updateData,\n      input.update.plaintextHash,\n      plaintextHashKey,\n    );\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"plaintext_integrity\",\n      updateId: input.update.id,\n    });\n  }\n  try {\n    assertDecryptedDocumentUpdateMetadata(updateData, input.update);\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"loro_metadata\",\n      updateId: input.update.id,\n    });\n  }\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    updateData,\n  };\n}\n"]}