@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/sync/syncResponseAuthorization.js

@@ -0,0 +1,63 @@
+import { computeDocumentContentKeyTargetHash, makeVerifiedDocumentKekTargets, } from "../../../../internal/crypto/index.js";
+import { resolveEventContainerPaths } from "../../../keyingProjectionVerification/document/documentDependencyPaths.js";
+import { sortDocumentTargets } from "../readers.js";
+export async function documentWriteAuthorizationForHeader(input) {
+    const source = input.plan.documentWriterAuthorization;
+    if (!source) {
+        if (input.allowMissingAuthorization) {
+            return null;
+        }
+        throw new Error("Document sync response lacks verified writer-authorization material");
+    }
+    const documentManifest = source.documentManifestByHash.get(input.manifestHash);
+    if (!documentManifest) {
+        throw new Error("Document sync response write manifest is not in verified history");
+    }
+    if (input.contentKeyBundle.documentId !== input.plan.documentId) {
+        throw new Error("Document sync response content-key bundle belongs to another document");
+    }
+    const targets = sortDocumentTargets(input.authorizationTargets);
+    if ((await computeDocumentContentKeyTargetHash(targets)) !== input.targetHash) {
+        throw new Error("Document sync response write targets are not canonical");
+    }
+    const linkedContainerIds = new Set(documentManifest.state.linkedContainerIds);
+    if (targets.length !== linkedContainerIds.size ||
+        targets.some((target) => !linkedContainerIds.has(target.containerId))) {
+        throw new Error("Document sync response write targets do not match the signed link set");
+    }
+    const { dependencyContainerPaths } = resolveEventContainerPaths({
+        containerPathByManifestHash: source.containerPathByManifestHash,
+        dependencyManifestHashes: input.dependencyManifestHashes,
+    });
+    // A writer needs one committed target, and can be unable to read another
+    // linked container. Validate the targets that are cited without inventing
+    // paths for uncited targets or dropping signed ancestor evidence.
+    for (const target of targets) {
+        const path = dependencyContainerPaths.find((candidate) => candidate.at(-1)?.manifestHash === target.containerManifestHash);
+        if (!path)
+            continue;
+        const leaf = path.at(-1);
+        if (!leaf ||
+            leaf.state.containerId !== target.containerId ||
+            leaf.state.organizationId !== input.plan.organizationId ||
+            leaf.state.containerKeyEpochId !== target.containerKeyEpochId) {
+            throw new Error("Document sync response write target lacks a verified container path");
+        }
+    }
+    const authorizingContainerPaths = dependencyContainerPaths;
+    const documentKekTargets = makeVerifiedDocumentKekTargets({
+        documentId: input.contentKeyBundle.documentId,
+        documentKeyTargetHash: input.targetHash,
+        linkedContainerKeyEpochIds: targets.map((target) => target.containerKeyEpochId),
+        linkedContainerManifestHashes: targets.map((target) => target.containerManifestHash),
+        linkSetManifestHash: input.manifestHash,
+        targets,
+    });
+    return {
+        authorizingContainerPaths,
+        documentKekTargets,
+        documentManifest,
+        principalPolicies: source.principalPolicies,
+    };
+}
+//# sourceMappingURL=syncResponseAuthorization.js.map

package/data/documents/shared/sync/syncResponseAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncResponseAuthorization.js","sourceRoot":"","sources":["syncResponseAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EAEnC,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAWzD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACxD,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,IACE,CAAC,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IACE,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;QAC/D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CACxC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,MAAM,CAAC,qBAAqB,CAClE,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IACE,CAAC,IAAI;YACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YAC7C,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc;YACvD,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EAC7D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;IAC3D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;QACxD,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,qBAAqB,EAAE,KAAK,CAAC,UAAU;QACvC,0BAA0B,EAAE,OAAO,CAAC,GAAG,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CACvC;QACD,6BAA6B,EAAE,OAAO,CAAC,GAAG,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC;QACD,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,yBAAyB;QACzB,kBAAkB;QAClB,gBAAgB;QAChB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computeDocumentContentKeyTargetHash,\n  type DocumentContentKeyTarget,\n  makeVerifiedDocumentKekTargets,\n} from \"@tearleads/crypto\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { resolveEventContainerPaths } from \"../../../keyingProjectionVerification/document/documentDependencyPaths\";\nimport { sortDocumentTargets } from \"../readers\";\nimport type { DocumentSyncPlan } from \"../types\";\n\nexport async function documentWriteAuthorizationForHeader(input: {\n  readonly allowMissingAuthorization: boolean;\n  readonly dependencyManifestHashes: readonly string[];\n  readonly authorizationTargets: readonly DocumentContentKeyTarget[];\n  readonly contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  readonly manifestHash: string;\n  readonly plan: Pick<\n    DocumentSyncPlan,\n    \"documentId\" | \"organizationId\" | \"documentWriterAuthorization\"\n  >;\n  readonly targetHash: string;\n}) {\n  const source = input.plan.documentWriterAuthorization;\n  if (!source) {\n    if (input.allowMissingAuthorization) {\n      return null;\n    }\n    throw new Error(\n      \"Document sync response lacks verified writer-authorization material\",\n    );\n  }\n  const documentManifest = source.documentManifestByHash.get(\n    input.manifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\n      \"Document sync response write manifest is not in verified history\",\n    );\n  }\n  if (input.contentKeyBundle.documentId !== input.plan.documentId) {\n    throw new Error(\n      \"Document sync response content-key bundle belongs to another document\",\n    );\n  }\n\n  const targets = sortDocumentTargets(input.authorizationTargets);\n  if (\n    (await computeDocumentContentKeyTargetHash(targets)) !== input.targetHash\n  ) {\n    throw new Error(\"Document sync response write targets are not canonical\");\n  }\n  const linkedContainerIds = new Set(documentManifest.state.linkedContainerIds);\n  if (\n    targets.length !== linkedContainerIds.size ||\n    targets.some((target) => !linkedContainerIds.has(target.containerId))\n  ) {\n    throw new Error(\n      \"Document sync response write targets do not match the signed link set\",\n    );\n  }\n\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash: source.containerPathByManifestHash,\n    dependencyManifestHashes: input.dependencyManifestHashes,\n  });\n  // A writer needs one committed target, and can be unable to read another\n  // linked container. Validate the targets that are cited without inventing\n  // paths for uncited targets or dropping signed ancestor evidence.\n  for (const target of targets) {\n    const path = dependencyContainerPaths.find(\n      (candidate) =>\n        candidate.at(-1)?.manifestHash === target.containerManifestHash,\n    );\n    if (!path) continue;\n    const leaf = path.at(-1);\n    if (\n      !leaf ||\n      leaf.state.containerId !== target.containerId ||\n      leaf.state.organizationId !== input.plan.organizationId ||\n      leaf.state.containerKeyEpochId !== target.containerKeyEpochId\n    ) {\n      throw new Error(\n        \"Document sync response write target lacks a verified container path\",\n      );\n    }\n  }\n  const authorizingContainerPaths = dependencyContainerPaths;\n  const documentKekTargets = makeVerifiedDocumentKekTargets({\n    documentId: input.contentKeyBundle.documentId,\n    documentKeyTargetHash: input.targetHash,\n    linkedContainerKeyEpochIds: targets.map(\n      (target) => target.containerKeyEpochId,\n    ),\n    linkedContainerManifestHashes: targets.map(\n      (target) => target.containerManifestHash,\n    ),\n    linkSetManifestHash: input.manifestHash,\n    targets,\n  });\n  return {\n    authorizingContainerPaths,\n    documentKekTargets,\n    documentManifest,\n    principalPolicies: source.principalPolicies,\n  };\n}\n"]}

package/data/documents/shared/sync/syncResponses.d.ts

@@ -0,0 +1,11 @@
+import { type DocumentSyncResponse } from "../../../../internal/validators/response/index.js";
+export { submitDocumentSync } from "./syncPagination.js";
+import type { DocumentSyncPlan, DocumentSyncSubmitFailure, DocumentWriterPublicKeyResolver, PersistedDocumentSyncState } from "../types.js";
+export declare class DocumentSyncResponseUpdateContentKeyError extends Error {
+    constructor(message: string);
+}
+export declare function persistedDocumentSyncStateFromResponse(plan: DocumentSyncPlan, response: DocumentSyncResponse, options: {
+    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;
+}): Promise<PersistedDocumentSyncState>;
+export declare function isRetryableDocumentSyncConflict(failure: DocumentSyncSubmitFailure): boolean;
+export declare function isUpstreamDeletedDocumentSyncFailure(failure: DocumentSyncSubmitFailure): boolean;

package/data/documents/shared/sync/syncResponses.js

@@ -0,0 +1,285 @@
+import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, verifyWriteHeader, } from "../../../../internal/crypto/index.js";
+import { isPlainObject as isPlainRecord } from "../../../../internal/validators/isPlainObject.js";
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, DOCUMENT_SYNC_ERROR_CODES, } from "../../../../internal/validators/response/index.js";
+import { parseWalLsn } from "../../../../internal/validators/util/index.js";
+import { throwKeyingVerificationShapeFailure } from "../../../keyingProjectionVerification/error.js";
+import { readRecordPositiveInteger, readRecordString, readWriteHeader, serializeCanonical, serializedPersistedDocumentState, } from "../readers.js";
+export { submitDocumentSync } from "./syncPagination.js";
+import { documentWriteAuthorizationForHeader } from "./syncResponseAuthorization.js";
+// Remote-primary databases without a portable WAL position use the zero LSN
+// as an explicit "checkpoint not tracked" sentinel. It is accepted only when
+// the response declares that mode, letting a local record carrying a checkpoint
+// from another backend move to that primary without weakening tracked checks.
+// This protects against replica lag, not a server that falsely declares its own
+// consistency capability; the authenticated server remains the source of data.
+const UNTRACKED_COMMIT_LSN = "0/0";
+export class DocumentSyncResponseUpdateContentKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DocumentSyncResponseUpdateContentKeyError";
+    }
+}
+function assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response) {
+    const expected = plan.request.outgoingUpdates.map((update) => update.id);
+    const accepted = response.acceptedOutgoingUpdateIds;
+    const expectedSorted = [...expected].sort();
+    const acceptedSorted = [...accepted].sort();
+    if (expectedSorted.length !== acceptedSorted.length ||
+        expectedSorted.some((id, index) => id !== acceptedSorted[index])) {
+        throw new Error("Document sync response accepted update mismatch");
+    }
+}
+async function assertDocumentSyncResponseUpdateMatchesPlan(input) {
+    const { plan, update } = input;
+    if (update.documentId !== plan.documentId) {
+        throw new Error("Document sync response update document mismatch");
+    }
+    const header = readWriteHeader(update.writeHeader, "Document sync response write header");
+    await assertDocumentSyncResponseUpdateHashes({ update });
+    const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({
+        contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,
+        header,
+        plan,
+    });
+    assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });
+    await assertDocumentSyncResponseNonceDomain({ header, plan });
+    await assertDocumentSyncResponseWriteHeaderSignature({
+        header,
+        contentKeyBundle,
+        plan,
+        resolveWriterPublicKey: input.resolveWriterPublicKey,
+        update,
+    });
+}
+function assertDocumentSyncResponseUpdateContentKeyBundle(input) {
+    const { header, plan } = input;
+    if (header.contentKeyEpoch > plan.contentKeyEpoch) {
+        throw new DocumentSyncResponseUpdateContentKeyError("Document sync response includes a future content-key epoch");
+    }
+    const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);
+    if (!bundle) {
+        throw new DocumentSyncResponseUpdateContentKeyError("Document sync response content-key bundle missing");
+    }
+    if (bundle.documentId !== plan.documentId ||
+        bundle.contentKeyEpoch !== header.contentKeyEpoch) {
+        throw new Error("Document sync response content-key bundle mismatch");
+    }
+    return bundle;
+}
+async function assertDocumentSyncResponseUpdateHashes(input) {
+    const { update } = input;
+    const ciphertextHash = await computeDocumentContentRecordCiphertextHash(update.encryptedData);
+    if (ciphertextHash !==
+        readRecordString(update.writeHeader, "ciphertextHash", "write header")) {
+        throw new Error("Document sync response ciphertext hash mismatch");
+    }
+    const metadataHash = await computeDocumentContentRecordMetadataHash({
+        ...(update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: update.checkpointKind }),
+        ...(update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: update.checkpointPayloadKind }),
+        documentId: update.documentId,
+        partialEndVersionVector: update.partialEndVersionVector,
+        partialStartVersionVector: update.partialStartVersionVector,
+        plaintextHash: update.plaintextHash,
+        ...(update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: update.sourceVersionVector }),
+        updateId: update.id,
+    });
+    if (metadataHash !==
+        readRecordString(update.writeHeader, "metadataHash", "write header")) {
+        throw new Error("Document sync response metadata hash mismatch");
+    }
+}
+function assertDocumentSyncResponseWriteHeaderFields(input) {
+    const { header, plan, update } = input;
+    const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);
+    if (header.version !== 1 ||
+        header.objectKind !== "document" ||
+        header.objectId !== plan.documentId ||
+        header.organizationId !== plan.organizationId ||
+        header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||
+        header.writerKeyFingerprint !== update.authorFingerprint ||
+        (mustMatchCurrentBoundary &&
+            (header.contentKeyEpoch !== plan.contentKeyEpoch ||
+                header.accessManifestHash !== plan.expectedLinkSetManifestHash ||
+                header.targetHash !== plan.expectedTargetHash))) {
+        throw new Error("Document sync response write header mismatch");
+    }
+}
+function isAcceptedOutgoingSyncUpdate(plan, update) {
+    return plan.request.outgoingUpdates.some((outgoingUpdate) => outgoingUpdate.id === update.id);
+}
+async function assertDocumentSyncResponseNonceDomain(input) {
+    const { header, plan } = input;
+    const nonceDomainHash = await computeContentRecordNonceDomainHash({
+        version: 1,
+        organizationId: plan.organizationId,
+        objectKind: "document",
+        objectId: plan.documentId,
+        contentKeyEpoch: header.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId: header.contentRecordId,
+    });
+    if (nonceDomainHash !== header.nonceDomainHash) {
+        throw new Error("Document sync response nonce domain mismatch");
+    }
+}
+async function assertDocumentSyncResponseWriteHeaderSignature(input) {
+    const { header, plan, update } = input;
+    const writerPublicKey = await input.resolveWriterPublicKey({
+        writerSigningKeyFingerprint: header.writerKeyFingerprint,
+        writerUserId: header.writerUserId,
+    });
+    if (!writerPublicKey) {
+        throw new Error("Document sync response writer public key missing");
+    }
+    const documentAuthorization = await documentWriteAuthorizationForHeader({
+        allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),
+        authorizationTargets: update.authorizationTargets,
+        dependencyManifestHashes: header.dependencyManifestHashes,
+        contentKeyBundle: input.contentKeyBundle,
+        manifestHash: header.accessManifestHash,
+        plan,
+        targetHash: header.targetHash,
+    });
+    const verified = await verifyWriteHeader({
+        authorizationMembership: "referenced",
+        expectedAccessManifestHash: documentAuthorization
+            ? header.accessManifestHash
+            : plan.expectedLinkSetManifestHash,
+        expectedObject: {
+            objectKind: "document",
+            objectId: plan.documentId,
+            organizationId: plan.organizationId,
+        },
+        header,
+        ...(documentAuthorization ? { documentAuthorization } : {}),
+        expectedTargetHash: documentAuthorization
+            ? header.targetHash
+            : plan.expectedTargetHash,
+        writerPublicKey,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+}
+function assertDocumentSyncCommitCheckpointMatchesPlan(plan, response) {
+    if (response.commitLsnMode === "untracked" &&
+        response.commitLsn !== UNTRACKED_COMMIT_LSN) {
+        throw new Error("Document sync response untracked commit LSN must use the 0/0 sentinel");
+    }
+    if (response.commitLsn === UNTRACKED_COMMIT_LSN &&
+        response.commitLsnMode !== "untracked") {
+        throw new Error("Document sync response 0/0 commit LSN must be declared untracked");
+    }
+    if (response.commitLsn !== null) {
+        parseWalLsn(response.commitLsn, "Document sync response commit LSN");
+    }
+    if (plan.minLsn === undefined) {
+        return;
+    }
+    const minLsn = parseWalLsn(plan.minLsn, "Document sync requested minimum LSN");
+    if (response.commitLsn === null) {
+        throw new Error("Document sync response commit LSN is missing");
+    }
+    if (!(response.commitLsn === UNTRACKED_COMMIT_LSN &&
+        response.commitLsnMode === "untracked") &&
+        parseWalLsn(response.commitLsn, "Document sync response commit LSN") <
+            minLsn) {
+        throw new Error("Document sync response commit LSN is stale");
+    }
+}
+function documentSyncManifestEpoch(plan) {
+    if (!isPlainRecord(plan.documentManifest.state)) {
+        throw new Error("Document sync manifest state is invalid");
+    }
+    return readRecordPositiveInteger(plan.documentManifest.state, "epoch", "Document sync manifest state");
+}
+// The one load-bearing epoch check: no returned update may claim an
+// accessEpoch newer than the current manifest epoch.
+function assertDocumentSyncAccessEpochsNotInFuture(plan, response) {
+    const currentAccessEpoch = documentSyncManifestEpoch(plan);
+    for (const update of response.updates) {
+        if (update.accessEpoch > currentAccessEpoch) {
+            throw new Error("Document sync response includes a future access epoch");
+        }
+    }
+}
+function contentKeyBundleCanonical(bundle) {
+    return serializeCanonical(bundle, "content-key bundle");
+}
+function documentSyncContentKeyBundlesByEpoch(plan, response) {
+    if (contentKeyBundleCanonical(response.contentKeyBundle) !==
+        contentKeyBundleCanonical(plan.sourceContentKeyBundle)) {
+        throw new Error("Document sync response content-key bundle mismatch");
+    }
+    const bundleByEpoch = new Map();
+    const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];
+    for (const bundle of bundles) {
+        if (bundle.documentId !== plan.documentId) {
+            throw new Error("Document sync response content-key bundle document mismatch");
+        }
+        if (!Number.isInteger(bundle.contentKeyEpoch) ||
+            bundle.contentKeyEpoch <= 0) {
+            throw new Error("Document sync response content-key bundle epoch mismatch");
+        }
+        // The current epoch travels only as contentKeyBundle; the array carries
+        // each older epoch once.
+        if (bundleByEpoch.has(bundle.contentKeyEpoch)) {
+            throw new Error("Document sync response repeats a content-key epoch");
+        }
+        bundleByEpoch.set(bundle.contentKeyEpoch, bundle);
+    }
+    return bundleByEpoch;
+}
+async function persistedDocumentSyncStateFromResponseInternal(plan, response, options) {
+    if (response.documentId !== plan.documentId) {
+        throw new Error("Document sync response document id mismatch");
+    }
+    const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(plan, response);
+    if (serializeCanonical(response.documentKekTargets, "KEK targets") !==
+        serializeCanonical(plan.documentKekTargets, "KEK targets")) {
+        throw new Error("Document sync response KEK target mismatch");
+    }
+    assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);
+    assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);
+    assertDocumentSyncAccessEpochsNotInFuture(plan, response);
+    await Promise.all(response.updates.map((update) => assertDocumentSyncResponseUpdateMatchesPlan({
+        contentKeyBundlesByEpoch,
+        plan,
+        resolveWriterPublicKey: options.resolveWriterPublicKey,
+        update,
+    })));
+    return serializedPersistedDocumentState({
+        contentKeyBundle: response.contentKeyBundle,
+        documentId: plan.documentId,
+        documentKekTargets: response.documentKekTargets,
+        documentManifestBundle: plan.documentManifest,
+    });
+}
+export async function persistedDocumentSyncStateFromResponse(plan, response, options) {
+    try {
+        return await persistedDocumentSyncStateFromResponseInternal(plan, response, options);
+    }
+    catch (error) {
+        if (error instanceof DocumentSyncResponseUpdateContentKeyError)
+            throw error;
+        throwKeyingVerificationShapeFailure(error);
+    }
+}
+export function isRetryableDocumentSyncConflict(failure) {
+    return (failure.status === 409 &&
+        failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale);
+}
+// The wipe gate is deliberately strict — coded 404s only, which is the right
+// failure mode for a destructive action. A bare 404 proves nothing about the
+// document: proxy/tunnel error pages, deploy-skew route misses, and
+// container-level lookups all produce one.
+export function isUpstreamDeletedDocumentSyncFailure(failure) {
+    return (failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE);
+}
+//# sourceMappingURL=syncResponses.js.map

package/data/documents/shared/sync/syncResponses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncResponses.js","sourceRoot":"","sources":["syncResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AAClG,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQtD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAElF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAClE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,wCAAwC,CAC/C,IAAsB,EACtB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IACE,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2CAA2C,CAAC,KAQ1D;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;IACF,MAAM,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;QACxE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM;QACN,IAAI;KACL,CAAC,CAAC;IACH,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,qCAAqC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,8CAA8C,CAAC;QACnD,MAAM;QACN,gBAAgB;QAChB,IAAI;QACJ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gDAAgD,CAAC,KAOzD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,IAAI,yCAAyC,CACjD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yCAAyC,CACjD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACrC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAErD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,YAAY;QACZ,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,2CAA2C,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5E,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;QACnC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC7C,MAAM,CAAC,eAAe,KAAK,+BAA+B;QAC1D,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,iBAAiB;QACxD,CAAC,wBAAwB;YACvB,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC9C,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,2BAA2B;gBAC9D,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,MAA+C;IAE/C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CACtC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qCAAqC,CAAC,KAGpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAC;IACH,IAAI,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAM7D;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;QACzD,2BAA2B,EAAE,MAAM,CAAC,oBAAoB;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,yBAAyB,EAAE,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC;QACrE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,0BAA0B,EAAE,qBAAqB;YAC/C,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,IAAI,CAAC,2BAA2B;QACpC,cAAc,EAAE;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;QACD,MAAM;QACN,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,kBAAkB,EAAE,qBAAqB;YACvC,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,IAAI,CAAC,kBAAkB;QAC3B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,6CAA6C,CACpD,IAAsB,EACtB,QAA8B;IAE9B,IACE,QAAQ,CAAC,aAAa,KAAK,WAAW;QACtC,QAAQ,CAAC,SAAS,KAAK,oBAAoB,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CACxB,IAAI,CAAC,MAAM,EACX,qCAAqC,CACtC,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IACE,CAAC,CACC,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,CACvC;QACD,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAClE,MAAM,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,yBAAyB,CAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAC3B,OAAO,EACP,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,qDAAqD;AACrD,SAAS,yCAAyC,CAChD,IAAsB,EACtB,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,WAAW,GAAG,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgD;IAEhD,OAAO,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oCAAoC,CAC3C,IAAsB,EACtB,QAA8B;IAE9B,IACE,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpD,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,CAAC,eAAe,IAAI,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8CAA8C,CAC3D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,IAAI,EACJ,QAAQ,CACT,CAAC;IACF,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC9D,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,wCAAwC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,6CAA6C,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9D,yCAAyC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,2CAA2C,CAAC;QAC1C,wBAAwB;QACxB,IAAI;QACJ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IAEF,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,8CAA8C,CACzD,IAAI,EACJ,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yCAAyC;YAAE,MAAM,KAAK,CAAC;QAC5E,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,UAAU,CACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,UAAU,oCAAoC,CAClD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,6BAA6B,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  verifyWriteHeader,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  DOCUMENT_SYNC_ERROR_CODES,\n  type DocumentSyncResponse,\n} from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport { throwKeyingVerificationShapeFailure } from \"../../../keyingProjectionVerification/error\";\nimport {\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"../readers\";\n\nexport { submitDocumentSync } from \"./syncPagination\";\n\nimport type {\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n  DocumentWriterPublicKeyResolver,\n  PersistedDocumentSyncState,\n} from \"../types\";\nimport { documentWriteAuthorizationForHeader } from \"./syncResponseAuthorization\";\n\n// Remote-primary databases without a portable WAL position use the zero LSN\n// as an explicit \"checkpoint not tracked\" sentinel. It is accepted only when\n// the response declares that mode, letting a local record carrying a checkpoint\n// from another backend move to that primary without weakening tracked checks.\n// This protects against replica lag, not a server that falsely declares its own\n// consistency capability; the authenticated server remains the source of data.\nconst UNTRACKED_COMMIT_LSN = \"0/0\";\n\nexport class DocumentSyncResponseUpdateContentKeyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DocumentSyncResponseUpdateContentKeyError\";\n  }\n}\n\nfunction assertAcceptedOutgoingUpdateIdsMatchPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const expected = plan.request.outgoingUpdates.map((update) => update.id);\n  const accepted = response.acceptedOutgoingUpdateIds;\n  const expectedSorted = [...expected].sort();\n  const acceptedSorted = [...accepted].sort();\n  if (\n    expectedSorted.length !== acceptedSorted.length ||\n    expectedSorted.some((id, index) => id !== acceptedSorted[index])\n  ) {\n    throw new Error(\"Document sync response accepted update mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseUpdateMatchesPlan(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n}): Promise<void> {\n  const { plan, update } = input;\n  if (update.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response update document mismatch\");\n  }\n  const header = readWriteHeader(\n    update.writeHeader,\n    \"Document sync response write header\",\n  );\n  await assertDocumentSyncResponseUpdateHashes({ update });\n  const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({\n    contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,\n    header,\n    plan,\n  });\n  assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });\n  await assertDocumentSyncResponseNonceDomain({ header, plan });\n  await assertDocumentSyncResponseWriteHeaderSignature({\n    header,\n    contentKeyBundle,\n    plan,\n    resolveWriterPublicKey: input.resolveWriterPublicKey,\n    update,\n  });\n}\n\nfunction assertDocumentSyncResponseUpdateContentKeyBundle(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): DocumentSyncResponse[\"contentKeyBundle\"] {\n  const { header, plan } = input;\n  if (header.contentKeyEpoch > plan.contentKeyEpoch) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response includes a future content-key epoch\",\n    );\n  }\n\n  const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);\n  if (!bundle) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response content-key bundle missing\",\n    );\n  }\n  if (\n    bundle.documentId !== plan.documentId ||\n    bundle.contentKeyEpoch !== header.contentKeyEpoch\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n  return bundle;\n}\n\nasync function assertDocumentSyncResponseUpdateHashes(input: {\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { update } = input;\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    update.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response ciphertext hash mismatch\");\n  }\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: update.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    metadataHash !==\n    readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response metadata hash mismatch\");\n  }\n}\n\nfunction assertDocumentSyncResponseWriteHeaderFields(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): void {\n  const { header, plan, update } = input;\n  const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);\n\n  if (\n    header.version !== 1 ||\n    header.objectKind !== \"document\" ||\n    header.objectId !== plan.documentId ||\n    header.organizationId !== plan.organizationId ||\n    header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||\n    header.writerKeyFingerprint !== update.authorFingerprint ||\n    (mustMatchCurrentBoundary &&\n      (header.contentKeyEpoch !== plan.contentKeyEpoch ||\n        header.accessManifestHash !== plan.expectedLinkSetManifestHash ||\n        header.targetHash !== plan.expectedTargetHash))\n  ) {\n    throw new Error(\"Document sync response write header mismatch\");\n  }\n}\n\nfunction isAcceptedOutgoingSyncUpdate(\n  plan: DocumentSyncPlan,\n  update: DocumentSyncResponse[\"updates\"][number],\n): boolean {\n  return plan.request.outgoingUpdates.some(\n    (outgoingUpdate) => outgoingUpdate.id === update.id,\n  );\n}\n\nasync function assertDocumentSyncResponseNonceDomain(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): Promise<void> {\n  const { header, plan } = input;\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: plan.organizationId,\n    objectKind: \"document\",\n    objectId: plan.documentId,\n    contentKeyEpoch: header.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: header.contentRecordId,\n  });\n  if (nonceDomainHash !== header.nonceDomainHash) {\n    throw new Error(\"Document sync response nonce domain mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseWriteHeaderSignature(input: {\n  contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { header, plan, update } = input;\n  const writerPublicKey = await input.resolveWriterPublicKey({\n    writerSigningKeyFingerprint: header.writerKeyFingerprint,\n    writerUserId: header.writerUserId,\n  });\n  if (!writerPublicKey) {\n    throw new Error(\"Document sync response writer public key missing\");\n  }\n\n  const documentAuthorization = await documentWriteAuthorizationForHeader({\n    allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),\n    authorizationTargets: update.authorizationTargets,\n    dependencyManifestHashes: header.dependencyManifestHashes,\n    contentKeyBundle: input.contentKeyBundle,\n    manifestHash: header.accessManifestHash,\n    plan,\n    targetHash: header.targetHash,\n  });\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    expectedAccessManifestHash: documentAuthorization\n      ? header.accessManifestHash\n      : plan.expectedLinkSetManifestHash,\n    expectedObject: {\n      objectKind: \"document\",\n      objectId: plan.documentId,\n      organizationId: plan.organizationId,\n    },\n    header,\n    ...(documentAuthorization ? { documentAuthorization } : {}),\n    expectedTargetHash: documentAuthorization\n      ? header.targetHash\n      : plan.expectedTargetHash,\n    writerPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n\nfunction assertDocumentSyncCommitCheckpointMatchesPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  if (\n    response.commitLsnMode === \"untracked\" &&\n    response.commitLsn !== UNTRACKED_COMMIT_LSN\n  ) {\n    throw new Error(\n      \"Document sync response untracked commit LSN must use the 0/0 sentinel\",\n    );\n  }\n  if (\n    response.commitLsn === UNTRACKED_COMMIT_LSN &&\n    response.commitLsnMode !== \"untracked\"\n  ) {\n    throw new Error(\n      \"Document sync response 0/0 commit LSN must be declared untracked\",\n    );\n  }\n  if (response.commitLsn !== null) {\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\");\n  }\n  if (plan.minLsn === undefined) {\n    return;\n  }\n  const minLsn = parseWalLsn(\n    plan.minLsn,\n    \"Document sync requested minimum LSN\",\n  );\n  if (response.commitLsn === null) {\n    throw new Error(\"Document sync response commit LSN is missing\");\n  }\n  if (\n    !(\n      response.commitLsn === UNTRACKED_COMMIT_LSN &&\n      response.commitLsnMode === \"untracked\"\n    ) &&\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\") <\n      minLsn\n  ) {\n    throw new Error(\"Document sync response commit LSN is stale\");\n  }\n}\n\nfunction documentSyncManifestEpoch(plan: DocumentSyncPlan): number {\n  if (!isPlainRecord(plan.documentManifest.state)) {\n    throw new Error(\"Document sync manifest state is invalid\");\n  }\n\n  return readRecordPositiveInteger(\n    plan.documentManifest.state,\n    \"epoch\",\n    \"Document sync manifest state\",\n  );\n}\n\n// The one load-bearing epoch check: no returned update may claim an\n// accessEpoch newer than the current manifest epoch.\nfunction assertDocumentSyncAccessEpochsNotInFuture(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const currentAccessEpoch = documentSyncManifestEpoch(plan);\n  for (const update of response.updates) {\n    if (update.accessEpoch > currentAccessEpoch) {\n      throw new Error(\"Document sync response includes a future access epoch\");\n    }\n  }\n}\n\nfunction contentKeyBundleCanonical(\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"],\n): string {\n  return serializeCanonical(bundle, \"content-key bundle\");\n}\n\nfunction documentSyncContentKeyBundlesByEpoch(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  if (\n    contentKeyBundleCanonical(response.contentKeyBundle) !==\n    contentKeyBundleCanonical(plan.sourceContentKeyBundle)\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n\n  const bundleByEpoch = new Map<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >();\n  const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];\n\n  for (const bundle of bundles) {\n    if (bundle.documentId !== plan.documentId) {\n      throw new Error(\n        \"Document sync response content-key bundle document mismatch\",\n      );\n    }\n    if (\n      !Number.isInteger(bundle.contentKeyEpoch) ||\n      bundle.contentKeyEpoch <= 0\n    ) {\n      throw new Error(\n        \"Document sync response content-key bundle epoch mismatch\",\n      );\n    }\n\n    // The current epoch travels only as contentKeyBundle; the array carries\n    // each older epoch once.\n    if (bundleByEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    bundleByEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return bundleByEpoch;\n}\n\nasync function persistedDocumentSyncStateFromResponseInternal(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  if (response.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response document id mismatch\");\n  }\n  const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(\n    plan,\n    response,\n  );\n  if (\n    serializeCanonical(response.documentKekTargets, \"KEK targets\") !==\n    serializeCanonical(plan.documentKekTargets, \"KEK targets\")\n  ) {\n    throw new Error(\"Document sync response KEK target mismatch\");\n  }\n  assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);\n  assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);\n  assertDocumentSyncAccessEpochsNotInFuture(plan, response);\n\n  await Promise.all(\n    response.updates.map((update) =>\n      assertDocumentSyncResponseUpdateMatchesPlan({\n        contentKeyBundlesByEpoch,\n        plan,\n        resolveWriterPublicKey: options.resolveWriterPublicKey,\n        update,\n      }),\n    ),\n  );\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: plan.documentId,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: plan.documentManifest,\n  });\n}\n\nexport async function persistedDocumentSyncStateFromResponse(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  try {\n    return await persistedDocumentSyncStateFromResponseInternal(\n      plan,\n      response,\n      options,\n    );\n  } catch (error) {\n    if (error instanceof DocumentSyncResponseUpdateContentKeyError) throw error;\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function isRetryableDocumentSyncConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale\n  );\n}\n\n// The wipe gate is deliberately strict — coded 404s only, which is the right\n// failure mode for a destructive action. A bare 404 proves nothing about the\n// document: proxy/tunnel error pages, deploy-skew route misses, and\n// container-level lookups all produce one.\nexport function isUpstreamDeletedDocumentSyncFailure(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n  );\n}\n"]}

package/data/documents/shared/sync/syncSubmitFailure.d.ts

@@ -0,0 +1,9 @@
+import type { ReferencedPrincipalStateResponse } from "../../../../internal/validators/response/index.js";
+export interface DocumentSyncSubmitFailure {
+    readonly code?: string | undefined;
+    readonly message: string;
+    readonly ok: false;
+    readonly report: () => void;
+    readonly stalePrincipalHeads?: readonly ReferencedPrincipalStateResponse[] | undefined;
+    readonly status: number | null;
+}

package/data/documents/shared/types.d.ts

@@ -4,10 +4,10 @@ import type { ContainerManifestRef, DocumentContentKeyTargetEnvelope, DocumentCr
 import type { ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentLinkSetMutationResponse, DocumentPurgeProofResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListDocumentAttachmentsResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerRekeyApi } from "../../containers/shared/types.js";
 import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer, DocumentWriterProjectionAuthorization as WriterAuthorization } from "../../keyingProjectionVerification/index.js";
-import type { DocumentRecord } from "../../sqlite/documentPersistence.js";
+import type { DocumentRecord } from "../../sqlite/documentPersistence/index.js";
 import type { ExecSql } from "../../sqlite/sqlSchema.js";
-import type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
-export type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
+import type { DocumentSyncSubmitFailure } from "./sync/syncSubmitFailure.js";
+export type { DocumentSyncSubmitFailure } from "./sync/syncSubmitFailure.js";
 export declare const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT = "tearleads.document.loro-update";
 export declare const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN = "tearleads.document.content-record-key-info";
 export declare const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN = "tearleads.document.content-record-plaintext-hash-key-info";

package/data/documents/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF,MAAM,CAAC,MAAM,qCAAqC,GAChD,gCAAgC,CAAC;AACnC,MAAM,CAAC,MAAM,uCAAuC,GAClD,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,sDAAsD,GACjE,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAC7C,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,iCAAiC,GAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAsB9C,MAAM,UAAU,yBAAyB,CACvC,KAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yEAAyE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iFAAiF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,CAAC;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,MAAM;YACT,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,MAAM;gBACT,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  DocumentContentKeyTarget,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentUnlinkAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n  DocumentCreateRequest,\n  DocumentLinkSetMutationRequest,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentPurgeProofResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n} from \"../../containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n  DocumentWriterProjectionAuthorization as WriterAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { requireProjectionUserKeyResolver } from \"../../keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT =\n  \"tearleads.document.loro-update\";\nexport const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-plaintext-hash-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.document.content-record-aad\";\nexport const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.document.content-record-hkdf-salt\");\nexport const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([\n  \"ciphertext\",\n  \"contentKeyEpoch\",\n  \"contentRecordId\",\n  \"encryptionSuite\",\n  \"format\",\n  \"iv\",\n  \"metadataHash\",\n  \"nonceDomainHash\",\n  \"version\",\n]);\nexport const TEXT_ENCODER = new TextEncoder();\ninterface ProjectionVerificationBase {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport type ProjectionVerificationOptions = ProjectionVerificationBase &\n  (\n    | {\n        readonly execSql: ExecSql;\n        readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n        readonly trustedLocalProjection?: undefined;\n      }\n    | {\n        readonly execSql?: ExecSql | undefined;\n        readonly resolveProjectionUserKey?: undefined;\n        readonly trustedLocalProjection: true;\n      }\n  );\n\nexport function resolveProjectionVerifier(\n  input: ProjectionVerificationOptions,\n  label: string,\n): ProjectionUserKeyResolver | null {\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        `${label} cannot combine projection key verification with local projection trust`,\n      );\n    }\n    return requireProjectionUserKeyResolver(\n      input.resolveProjectionUserKey,\n      label,\n    );\n  }\n  if (input.trustedLocalProjection === true) {\n    return null;\n  }\n  throw new Error(\n    `${label} requires projection key verification or an explicitly trusted local projection`,\n  );\n}\n\nexport function projectionVerificationOptions(\n  input: ProjectionVerificationOptions,\n): ProjectionVerificationOptions {\n  const warm = input.warmReferencedPrincipalPolicies;\n  const shared = {\n    ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n    ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),\n  };\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        \"Projection use cannot combine key verification with local projection trust\",\n      );\n    }\n    return {\n      execSql: input.execSql,\n      ...shared,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    };\n  }\n  if (input.trustedLocalProjection === true) {\n    return input.execSql\n      ? {\n          execSql: input.execSql,\n          ...shared,\n          trustedLocalProjection: true,\n        }\n      : { ...shared, trustedLocalProjection: true };\n  }\n\n  throw new Error(\n    \"Projection use requires key verification or an explicitly trusted local projection\",\n  );\n}\n\nexport type DocumentCreateAuthor = ContainerMutationAuthor;\n\nexport interface BuildDocumentCreatePlanInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  contentKeyEpoch?: number;\n  documentId?: string;\n  eventId?: string;\n  signedAt?: string;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n}\n\nexport interface DocumentCreatePlan {\n  body: DocumentLinkAccessEventBody;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  request: DocumentCreateRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentCreatePlan {\n  contentKey: Uint8Array;\n  plan: DocumentCreatePlan;\n}\n\nexport interface DocumentCreateApi {\n  // Lets idempotent create inspect an expected already-exists conflict.\n  createDocumentResult(\n    input: DocumentCreateRequest,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentCreateResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  // Result-returning variant used by the create path so a terminal projection\n  // fetch failure (e.g. a 402 billing block or a 403 after access revocation)\n  // can be persisted to the write queue instead of collapsing to a silent\n  // null.\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  // Needed to adopt an existing remote document on a create conflict: the\n  // committed manifest, content-key bundle and KEK targets are refetched here\n  // (the create response that carried them was lost).\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  evictContainerWriterProjection(containerId: string): void;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nexport interface CreateRemoteDocumentResult {\n  contentKey: Uint8Array;\n  documentId: string;\n  persistedState: PersistedDocumentCreateState;\n  // `plan` and `response` are absent when the result was adopted from an\n  // existing remote document on a create conflict: there is no fresh create\n  // response, and the local plan does not match the committed manifest (the\n  // first attempt used a different content key). Consumers read only\n  // documentId/writerProjection/persistedState.\n  plan?: DocumentCreatePlan | undefined;\n  response?: DocumentCreateResponse | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport type DocumentLinkSetMutationOperation = \"link\" | \"unlink\";\nexport type DocumentLinkSetMutationBody =\n  | DocumentLinkAccessEventBody\n  | DocumentUnlinkAccessEventBody;\n\nexport interface DocumentLinkSetTargetState {\n  readonly currentTargets: readonly DocumentContentKeyTarget[];\n  readonly linkedContainerIds: readonly string[];\n  readonly target: DocumentContentKeyTarget;\n  readonly targets: readonly DocumentContentKeyTarget[];\n}\n\nexport interface BuildDocumentLinkSetMutationPlanInput {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  eventId?: string | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  signedAt?: string | undefined;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DocumentLinkSetMutationPlan {\n  body: DocumentLinkSetMutationBody;\n  contentKeyEpoch: number;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentLinkSetMutationPlan {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  plan: DocumentLinkSetMutationPlan;\n}\n\nexport interface DocumentLinkSetEventPlan {\n  authorizingContainerPathRefs: ContainerManifestRef[][];\n  body: DocumentLinkSetMutationBody;\n  event: AccessEvent;\n  eventHash: string;\n}\n\n/**\n * What a failed link-set mutation could tell the caller: the HTTP status (or\n * null for network/local failures) and a short message. Threaded up to the\n * move-intent queue so a permission failure reads as one, instead of the\n * generic \"rejected or unavailable\".\n */\nexport type DocumentLinkSetMutationFailure = Pick<\n  DocumentSyncSubmitFailure,\n  \"code\" | \"message\" | \"status\"\n>;\n\nexport type DocumentLinkSetFailureHandler = (\n  failure: DocumentLinkSetMutationFailure,\n) => void;\n\ntype DocumentLinkSetMutationResult =\n  | { readonly data: DocumentLinkSetMutationResponse; readonly ok: true }\n  | (DocumentLinkSetMutationFailure & { readonly ok: false });\n\nexport interface DocumentLinkSetMutationApi {\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n  linkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n  unlinkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n}\n\nexport interface RelinkRemoteDocumentResult {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  documentId: string;\n  linkedContainerIds: readonly string[];\n  persistedState: PersistedDocumentCreateState;\n  plan: DocumentLinkSetMutationPlan;\n  response: DocumentLinkSetMutationResponse;\n}\n\nexport interface DocumentSyncPreparedUpdate {\n  checkpointKind?: DocumentOutgoingUpdate[\"checkpointKind\"] | undefined;\n  checkpointPayloadKind?:\n    | DocumentOutgoingUpdate[\"checkpointPayloadKind\"]\n    | undefined;\n  ciphertextHash: string;\n  contentRecordId?: string | undefined;\n  encryptedData: string;\n  id: string;\n  metadataHash: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  plaintextHash: string;\n  signedAt?: string | undefined;\n  sourceVersionVector?: string | undefined;\n}\n\nexport interface DocumentEncryptedPendingUpdate {\n  contentRecordId: string;\n  encryptedData: string;\n  metadataHash: string;\n  ciphertextHash: string;\n  plaintextHash: string;\n}\n\nexport interface ParsedDocumentEncryptedUpdate {\n  ciphertext: Uint8Array;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  iv: Uint8Array;\n}\n\nexport interface DecryptedDocumentSyncUpdate {\n  checkpointKind?: \"rotate_baseline\";\n  checkpointPayloadKind?: \"full_history_snapshot\";\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  sourceVersionVector?: string;\n  updateData: Uint8Array;\n}\n\nexport interface BuildDocumentSyncPlanInput {\n  author: DocumentCreateAuthor;\n  authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];\n  containerRekeys?: DocumentSyncRequest[\"containerRekeys\"];\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentId?: string | undefined;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  historyMode?: \"raw\" | undefined;\n  inlineRekeyCommitId?: string | undefined;\n  localVersionVector: string | null;\n  minLsn?: string | undefined;\n  outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;\n  pullCursor?: string | undefined;\n  signedAt?: string | undefined;\n}\n\nexport interface DocumentSyncPlan {\n  contentKeyEpoch: number;\n  documentId: string;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  documentWriterAuthorization?: WriterAuthorization | undefined;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  minLsn?: string | undefined;\n  organizationId: string;\n  request: DocumentSyncRequest;\n  sourceContentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n}\n\nexport interface MaterializedDocumentSyncPlan {\n  contentKey: Uint8Array;\n  /**\n   * True when the plan carries a re-wrapped content-key bundle at the next\n   * epoch to heal a stale bundle (a linked container's KEK rotated under it).\n   * On submit success the caller must evict this document's cached writer\n   * projection so later passes see the healed state instead of re-healing.\n   */\n  healedStaleContentKeyBundle: boolean;\n  /**\n   * Pending-queue ids a heal deliberately did NOT submit (superseded rotation\n   * checkpoints). On heal success they are reported as settled — the\n   * committed covering baseline subsumes their content, and resubmitting them\n   * post-heal could mask it as the latest baseline at the healed epoch.\n   */\n  heldBackPendingUpdateIds: readonly string[];\n  plan: DocumentSyncPlan;\n  writerProjection: DocumentWriterProjectionResponse;\n  /** Synthetic baseline id; its ack does not settle a pending queue row. */\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nexport interface SyncRemoteDocumentResult {\n  contentKey: Uint8Array;\n  decryptedUpdates: DecryptedDocumentSyncUpdate[];\n  /**\n   * Pending updates whose persisted re-key bound is exhausted. Non-zero means\n   * a terminal failure was just recorded for them — callers must not treat\n   * the pass as clean and clear it.\n   */\n  exhaustedPendingUpdateCount: number;\n  /**\n   * True only when this bounded pass made durable progress but left pending\n   * work. Headless hosts should refresh the queue and schedule another\n   * pass. Terminal exhaustion reports false and uses the failure callback.\n   */\n  hasDeferredPendingUpdates: boolean;\n  /** Verified page progress was persisted, but remote pages remain. */\n  hasIncompletePull: boolean;\n  persistedState: PersistedDocumentSyncState;\n  plan: DocumentSyncPlan;\n  rekeyedPendingUpdateIds: readonly string[];\n  response: DocumentSyncResponse;\n  settledPendingUpdateIds: readonly string[];\n  acceptedRecoveryBaseline: boolean;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DocumentSyncRequestResultOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n\nexport interface DocumentSyncApi {\n  rekeyContainer: ContainerRekeyApi[\"rekeyContainer\"];\n  /**\n   * Optional status-bearing rekey. Present on the real client; an adapter that\n   * omits it still repairs, but a permanent refusal cannot then be told from a\n   * transient one and is reported as a plain abandon.\n   */\n  rekeyContainerResult?: ContainerRekeyApi[\"rekeyContainerResult\"];\n  /**\n   * Optional. A repair that must carry descendant rekeys reads each one's\n   * projection; without this such a repair is refused and the pass abandons.\n   */\n  getContainerWriterProjection?: ContainerRekeyApi[\"getContainerWriterProjection\"];\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentPurgeProof?(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  syncDocumentResult(\n    documentId: string,\n    input: DocumentSyncRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<\n    | {\n        readonly data: DocumentSyncResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n}\n\nexport type DocumentWriterPublicKeyResolver = (input: {\n  writerSigningKeyFingerprint: string;\n  writerUserId: string;\n}) => Promise<Uint8Array | null>;\n\nexport type PersistedDocumentCreateState = Pick<\n  DocumentRecord,\n  | \"documentId\"\n  | \"contentKeyBundle\"\n  | \"documentKekTargets\"\n  | \"documentManifestBundle\"\n>;\n\nexport type PersistedDocumentSyncState = PersistedDocumentCreateState;\n\nexport interface UnwrappedContainerKek {\n  containerId: string;\n  /**\n   * Null for keyring-recovered historical keys, which carry key material and\n   * the epoch id committing to it but no epoch record to hash.\n   *\n   * Such a key still satisfies a parent wrap: the epoch-record fingerprint is\n   * a selector for choosing among envelopes, not the security boundary, so a\n   * null hash falls back to selecting on the epoch id while AEAD authenticates\n   * (see `containerKekPath.ts`). That is what lets a descendant pinned to a\n   * rotated parent be opened rather than stranded.\n   */\n  keyEpochHash: string | null;\n  keyMaterial: Uint8Array;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF,MAAM,CAAC,MAAM,qCAAqC,GAChD,gCAAgC,CAAC;AACnC,MAAM,CAAC,MAAM,uCAAuC,GAClD,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,sDAAsD,GACjE,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAC7C,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,iCAAiC,GAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAsB9C,MAAM,UAAU,yBAAyB,CACvC,KAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yEAAyE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iFAAiF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,CAAC;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,MAAM;YACT,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,MAAM;gBACT,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  DocumentContentKeyTarget,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentUnlinkAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n  DocumentCreateRequest,\n  DocumentLinkSetMutationRequest,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentPurgeProofResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n} from \"../../containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n  DocumentWriterProjectionAuthorization as WriterAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { requireProjectionUserKeyResolver } from \"../../keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { DocumentSyncSubmitFailure } from \"./sync/syncSubmitFailure\";\n\nexport type { DocumentSyncSubmitFailure } from \"./sync/syncSubmitFailure\";\n\nexport const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT =\n  \"tearleads.document.loro-update\";\nexport const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-plaintext-hash-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.document.content-record-aad\";\nexport const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.document.content-record-hkdf-salt\");\nexport const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([\n  \"ciphertext\",\n  \"contentKeyEpoch\",\n  \"contentRecordId\",\n  \"encryptionSuite\",\n  \"format\",\n  \"iv\",\n  \"metadataHash\",\n  \"nonceDomainHash\",\n  \"version\",\n]);\nexport const TEXT_ENCODER = new TextEncoder();\ninterface ProjectionVerificationBase {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport type ProjectionVerificationOptions = ProjectionVerificationBase &\n  (\n    | {\n        readonly execSql: ExecSql;\n        readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n        readonly trustedLocalProjection?: undefined;\n      }\n    | {\n        readonly execSql?: ExecSql | undefined;\n        readonly resolveProjectionUserKey?: undefined;\n        readonly trustedLocalProjection: true;\n      }\n  );\n\nexport function resolveProjectionVerifier(\n  input: ProjectionVerificationOptions,\n  label: string,\n): ProjectionUserKeyResolver | null {\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        `${label} cannot combine projection key verification with local projection trust`,\n      );\n    }\n    return requireProjectionUserKeyResolver(\n      input.resolveProjectionUserKey,\n      label,\n    );\n  }\n  if (input.trustedLocalProjection === true) {\n    return null;\n  }\n  throw new Error(\n    `${label} requires projection key verification or an explicitly trusted local projection`,\n  );\n}\n\nexport function projectionVerificationOptions(\n  input: ProjectionVerificationOptions,\n): ProjectionVerificationOptions {\n  const warm = input.warmReferencedPrincipalPolicies;\n  const shared = {\n    ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n    ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),\n  };\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        \"Projection use cannot combine key verification with local projection trust\",\n      );\n    }\n    return {\n      execSql: input.execSql,\n      ...shared,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    };\n  }\n  if (input.trustedLocalProjection === true) {\n    return input.execSql\n      ? {\n          execSql: input.execSql,\n          ...shared,\n          trustedLocalProjection: true,\n        }\n      : { ...shared, trustedLocalProjection: true };\n  }\n\n  throw new Error(\n    \"Projection use requires key verification or an explicitly trusted local projection\",\n  );\n}\n\nexport type DocumentCreateAuthor = ContainerMutationAuthor;\n\nexport interface BuildDocumentCreatePlanInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  contentKeyEpoch?: number;\n  documentId?: string;\n  eventId?: string;\n  signedAt?: string;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n}\n\nexport interface DocumentCreatePlan {\n  body: DocumentLinkAccessEventBody;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  request: DocumentCreateRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentCreatePlan {\n  contentKey: Uint8Array;\n  plan: DocumentCreatePlan;\n}\n\nexport interface DocumentCreateApi {\n  // Lets idempotent create inspect an expected already-exists conflict.\n  createDocumentResult(\n    input: DocumentCreateRequest,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentCreateResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  // Result-returning variant used by the create path so a terminal projection\n  // fetch failure (e.g. a 402 billing block or a 403 after access revocation)\n  // can be persisted to the write queue instead of collapsing to a silent\n  // null.\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  // Needed to adopt an existing remote document on a create conflict: the\n  // committed manifest, content-key bundle and KEK targets are refetched here\n  // (the create response that carried them was lost).\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  evictContainerWriterProjection(containerId: string): void;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nexport interface CreateRemoteDocumentResult {\n  contentKey: Uint8Array;\n  documentId: string;\n  persistedState: PersistedDocumentCreateState;\n  // `plan` and `response` are absent when the result was adopted from an\n  // existing remote document on a create conflict: there is no fresh create\n  // response, and the local plan does not match the committed manifest (the\n  // first attempt used a different content key). Consumers read only\n  // documentId/writerProjection/persistedState.\n  plan?: DocumentCreatePlan | undefined;\n  response?: DocumentCreateResponse | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport type DocumentLinkSetMutationOperation = \"link\" | \"unlink\";\nexport type DocumentLinkSetMutationBody =\n  | DocumentLinkAccessEventBody\n  | DocumentUnlinkAccessEventBody;\n\nexport interface DocumentLinkSetTargetState {\n  readonly currentTargets: readonly DocumentContentKeyTarget[];\n  readonly linkedContainerIds: readonly string[];\n  readonly target: DocumentContentKeyTarget;\n  readonly targets: readonly DocumentContentKeyTarget[];\n}\n\nexport interface BuildDocumentLinkSetMutationPlanInput {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  eventId?: string | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  signedAt?: string | undefined;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DocumentLinkSetMutationPlan {\n  body: DocumentLinkSetMutationBody;\n  contentKeyEpoch: number;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentLinkSetMutationPlan {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  plan: DocumentLinkSetMutationPlan;\n}\n\nexport interface DocumentLinkSetEventPlan {\n  authorizingContainerPathRefs: ContainerManifestRef[][];\n  body: DocumentLinkSetMutationBody;\n  event: AccessEvent;\n  eventHash: string;\n}\n\n/**\n * What a failed link-set mutation could tell the caller: the HTTP status (or\n * null for network/local failures) and a short message. Threaded up to the\n * move-intent queue so a permission failure reads as one, instead of the\n * generic \"rejected or unavailable\".\n */\nexport type DocumentLinkSetMutationFailure = Pick<\n  DocumentSyncSubmitFailure,\n  \"code\" | \"message\" | \"status\"\n>;\n\nexport type DocumentLinkSetFailureHandler = (\n  failure: DocumentLinkSetMutationFailure,\n) => void;\n\ntype DocumentLinkSetMutationResult =\n  | { readonly data: DocumentLinkSetMutationResponse; readonly ok: true }\n  | (DocumentLinkSetMutationFailure & { readonly ok: false });\n\nexport interface DocumentLinkSetMutationApi {\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n  linkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n  unlinkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n}\n\nexport interface RelinkRemoteDocumentResult {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  documentId: string;\n  linkedContainerIds: readonly string[];\n  persistedState: PersistedDocumentCreateState;\n  plan: DocumentLinkSetMutationPlan;\n  response: DocumentLinkSetMutationResponse;\n}\n\nexport interface DocumentSyncPreparedUpdate {\n  checkpointKind?: DocumentOutgoingUpdate[\"checkpointKind\"] | undefined;\n  checkpointPayloadKind?:\n    | DocumentOutgoingUpdate[\"checkpointPayloadKind\"]\n    | undefined;\n  ciphertextHash: string;\n  contentRecordId?: string | undefined;\n  encryptedData: string;\n  id: string;\n  metadataHash: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  plaintextHash: string;\n  signedAt?: string | undefined;\n  sourceVersionVector?: string | undefined;\n}\n\nexport interface DocumentEncryptedPendingUpdate {\n  contentRecordId: string;\n  encryptedData: string;\n  metadataHash: string;\n  ciphertextHash: string;\n  plaintextHash: string;\n}\n\nexport interface ParsedDocumentEncryptedUpdate {\n  ciphertext: Uint8Array;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  iv: Uint8Array;\n}\n\nexport interface DecryptedDocumentSyncUpdate {\n  checkpointKind?: \"rotate_baseline\";\n  checkpointPayloadKind?: \"full_history_snapshot\";\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  sourceVersionVector?: string;\n  updateData: Uint8Array;\n}\n\nexport interface BuildDocumentSyncPlanInput {\n  author: DocumentCreateAuthor;\n  authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];\n  containerRekeys?: DocumentSyncRequest[\"containerRekeys\"];\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentId?: string | undefined;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  historyMode?: \"raw\" | undefined;\n  inlineRekeyCommitId?: string | undefined;\n  localVersionVector: string | null;\n  minLsn?: string | undefined;\n  outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;\n  pullCursor?: string | undefined;\n  signedAt?: string | undefined;\n}\n\nexport interface DocumentSyncPlan {\n  contentKeyEpoch: number;\n  documentId: string;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  documentWriterAuthorization?: WriterAuthorization | undefined;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  minLsn?: string | undefined;\n  organizationId: string;\n  request: DocumentSyncRequest;\n  sourceContentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n}\n\nexport interface MaterializedDocumentSyncPlan {\n  contentKey: Uint8Array;\n  /**\n   * True when the plan carries a re-wrapped content-key bundle at the next\n   * epoch to heal a stale bundle (a linked container's KEK rotated under it).\n   * On submit success the caller must evict this document's cached writer\n   * projection so later passes see the healed state instead of re-healing.\n   */\n  healedStaleContentKeyBundle: boolean;\n  /**\n   * Pending-queue ids a heal deliberately did NOT submit (superseded rotation\n   * checkpoints). On heal success they are reported as settled — the\n   * committed covering baseline subsumes their content, and resubmitting them\n   * post-heal could mask it as the latest baseline at the healed epoch.\n   */\n  heldBackPendingUpdateIds: readonly string[];\n  plan: DocumentSyncPlan;\n  writerProjection: DocumentWriterProjectionResponse;\n  /** Synthetic baseline id; its ack does not settle a pending queue row. */\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nexport interface SyncRemoteDocumentResult {\n  contentKey: Uint8Array;\n  decryptedUpdates: DecryptedDocumentSyncUpdate[];\n  /**\n   * Pending updates whose persisted re-key bound is exhausted. Non-zero means\n   * a terminal failure was just recorded for them — callers must not treat\n   * the pass as clean and clear it.\n   */\n  exhaustedPendingUpdateCount: number;\n  /**\n   * True only when this bounded pass made durable progress but left pending\n   * work. Headless hosts should refresh the queue and schedule another\n   * pass. Terminal exhaustion reports false and uses the failure callback.\n   */\n  hasDeferredPendingUpdates: boolean;\n  /** Verified page progress was persisted, but remote pages remain. */\n  hasIncompletePull: boolean;\n  persistedState: PersistedDocumentSyncState;\n  plan: DocumentSyncPlan;\n  rekeyedPendingUpdateIds: readonly string[];\n  response: DocumentSyncResponse;\n  settledPendingUpdateIds: readonly string[];\n  acceptedRecoveryBaseline: boolean;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DocumentSyncRequestResultOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n\nexport interface DocumentSyncApi {\n  rekeyContainer: ContainerRekeyApi[\"rekeyContainer\"];\n  /**\n   * Optional status-bearing rekey. Present on the real client; an adapter that\n   * omits it still repairs, but a permanent refusal cannot then be told from a\n   * transient one and is reported as a plain abandon.\n   */\n  rekeyContainerResult?: ContainerRekeyApi[\"rekeyContainerResult\"];\n  /**\n   * Optional. A repair that must carry descendant rekeys reads each one's\n   * projection; without this such a repair is refused and the pass abandons.\n   */\n  getContainerWriterProjection?: ContainerRekeyApi[\"getContainerWriterProjection\"];\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentPurgeProof?(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  syncDocumentResult(\n    documentId: string,\n    input: DocumentSyncRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<\n    | {\n        readonly data: DocumentSyncResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n}\n\nexport type DocumentWriterPublicKeyResolver = (input: {\n  writerSigningKeyFingerprint: string;\n  writerUserId: string;\n}) => Promise<Uint8Array | null>;\n\nexport type PersistedDocumentCreateState = Pick<\n  DocumentRecord,\n  | \"documentId\"\n  | \"contentKeyBundle\"\n  | \"documentKekTargets\"\n  | \"documentManifestBundle\"\n>;\n\nexport type PersistedDocumentSyncState = PersistedDocumentCreateState;\n\nexport interface UnwrappedContainerKek {\n  containerId: string;\n  /**\n   * Null for keyring-recovered historical keys, which carry key material and\n   * the epoch id committing to it but no epoch record to hash.\n   *\n   * Such a key still satisfies a parent wrap: the epoch-record fingerprint is\n   * a selector for choosing among envelopes, not the security boundary, so a\n   * null hash falls back to selecting on the epoch id while AEAD authenticates\n   * (see `containerKekPath.ts`). That is what lets a descendant pinned to a\n   * rotated parent be opened rather than stranded.\n   */\n  keyEpochHash: string | null;\n  keyMaterial: Uint8Array;\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/accessManifestCheckpointEnforcement.js

@@ -0,0 +1,61 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { advanceKeyingCheckpointsAtomically, validateKeyingCheckpointsAtomically, } from "../../persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
+function objectKey(manifest) {
+    const { objectKind, organizationId, objectId } = manifest.checkpoint;
+    return JSON.stringify([objectKind, organizationId, objectId]);
+}
+function manifestsByObject(manifests) {
+    const byObject = new Map();
+    for (const manifest of manifests) {
+        const key = objectKey(manifest);
+        let byHash = byObject.get(key);
+        if (!byHash) {
+            byHash = new Map();
+            byObject.set(key, byHash);
+        }
+        byHash.set(manifest.manifestHash, manifest);
+    }
+    return byObject;
+}
+function accessManifestCheckpointAdvances(input) {
+    const evidenceByObject = manifestsByObject(input.verifiedManifests);
+    const headsByObject = manifestsByObject(input.verifiedHeads);
+    const advances = [];
+    for (const [key, headsByHash] of headsByObject) {
+        if (headsByHash.size !== 1) {
+            throw new KeyingVerificationError("equivocation", `projection declares conflicting access manifest heads for ${key}`);
+        }
+        const head = headsByHash.values().next().value;
+        if (!head) {
+            continue;
+        }
+        const predecessors = [
+            ...(evidenceByObject.get(key)?.values() ?? []),
+        ].filter((manifest) => manifest.manifestHash !== head.manifestHash);
+        advances.push({ head, predecessors });
+    }
+    return advances;
+}
+export async function validateAccessManifestCheckpoints(input) {
+    await validateKeyingCheckpointsAtomically({
+        access: accessManifestCheckpointAdvances(input),
+        execSql: input.execSql,
+        policies: input.policies,
+        authorizationPolicies: input.authorizationPolicies,
+        stillCurrent: input.stillCurrent,
+        verifiedBundles: input.verifiedBundles,
+    });
+}
+export async function enforceAccessManifestCheckpoints(input) {
+    await advanceKeyingCheckpointsAtomically({
+        access: accessManifestCheckpointAdvances(input),
+        documentPurgeCheckpoint: input.documentPurgeCheckpoint,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: input.policies,
+        authorizationPolicies: input.authorizationPolicies,
+        stillCurrent: input.stillCurrent,
+        verifiedBundles: input.verifiedBundles,
+    });
+}
+//# sourceMappingURL=accessManifestCheckpointEnforcement.js.map