@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/containers/child/share/sharePrincipalPolicy.js

@@ -0,0 +1,194 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../../data/keyingProjectionVerification/error.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
+import { savePrincipalPolicyBundle } from "../../../../data/persistence/principalPolicy/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../../data/persistence/principalPolicy/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../../data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../../../organizations/groupMetadata/groupMetadataBinding.js";
+import { groupPolicyNameMismatch, } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../../principals/externalAdminPolicy.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../../principals/policyVerification.js";
+async function retainVerifiedSharePolicies(input) {
+    const retainedAt = new Date().toISOString();
+    if (input.organizationPolicy) {
+        for (const entry of externalAdminPolicyPersistenceEntries(input.organizationPolicy)) {
+            await retainVerifiedPrincipalPolicyBundle({
+                ...entry,
+                execSql: input.execSql,
+                organizationId: input.organizationId,
+                stillCurrent: input.stillCurrent,
+                updatedAt: retainedAt,
+            });
+        }
+    }
+    await retainVerifiedPrincipalPolicyBundle({
+        bundle: input.bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policy: input.policy,
+        stillCurrent: input.stillCurrent,
+        updatedAt: retainedAt,
+    });
+    return [
+        ...(input.organizationPolicy
+            ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map((entry) => entry.policy)
+            : []),
+        input.policy,
+    ];
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export async function advanceVerifiedSharePolicies(execSql, verified, stillCurrent) {
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql,
+        organizationId: verified.organizationId,
+        policies: verified.checkpointPolicies,
+        stillCurrent,
+    });
+    if (stillCurrent?.() === false)
+        return;
+    for (const bundle of verified.dependencyBundles) {
+        await savePrincipalPolicyBundle(execSql, bundle, new Date().toISOString(), verified.organizationId, { stillCurrent });
+        if (stillCurrent?.() === false)
+            return;
+    }
+}
+function assertGroupPolicyTarget(bundle, groupId) {
+    if (bundle.currentState.principalType !== "group" ||
+        bundle.currentState.principalId !== groupId) {
+        throw new Error("Container share principal policy target mismatch");
+    }
+}
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "principal policy signer key fingerprint mismatch";
+        case "not-found":
+            return "principal policy signer key could not be loaded";
+    }
+}
+async function loadGroupSharePolicyBundle(input) {
+    if (input.expectedGroupHead &&
+        (input.expectedGroupHead.principalType !== "group" ||
+            input.expectedGroupHead.principalId !== input.groupId)) {
+        throw new Error("Container share expected group policy target mismatch");
+    }
+    const bundleFromCache = input.expectedGroupHead
+        ? await loadPrincipalPolicyBundleForReference(input.execSql, input.expectedGroupHead, input.localCheckpoint)
+        : null;
+    let bundle = bundleFromCache;
+    bundle ??= await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!bundle) {
+        throw new Error("Container share principal policy could not be loaded");
+    }
+    assertGroupPolicyTarget(bundle, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), input.expectedGroupHead)) {
+        throw new Error("Container share group policy does not match the signed organization directory");
+    }
+    return bundle;
+}
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message) {
+        super("object_mismatch", message);
+        this.name = "GroupShareNameMismatchError";
+    }
+}
+/**
+ * The share picker labels groups from the organization read model, which a
+ * compromised server can relabel, so the name the user chose must equal the
+ * name committed in the target's verified policy. Names compare by their
+ * canonical key so look-alike spellings count as the same name. Uniqueness of
+ * signed names within an organization is enforced where names enter — group
+ * creation verifies every group in the signed directory — so a single
+ * verified match identifies the group.
+ */
+async function assertShareGroupName(input) {
+    // The label comes from the untrusted read model. Signed names never carry
+    // an invisible code point, so a label that does is a look-alike that would
+    // only match after canonicalization strips it; refuse it outright.
+    const mismatch = await groupPolicyNameMismatch(input.bundle, input.expectedGroupName, input.readEncryptedName);
+    if (mismatch === "forbidden_characters") {
+        throw new GroupShareNameMismatchError("Container share group name contains control or format characters");
+    }
+    if (mismatch === "name_mismatch") {
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    }
+}
+export async function loadVerifiedGroupSharePrincipalPolicy(input) {
+    const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        currentPolicyReader: input.apiClient,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!organizationAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const committedGroupHead = requireOrganizationGroupHead(organizationAdminPolicy.descriptor, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)) {
+        throw new Error("Container share expected group head conflicts with the signed organization directory");
+    }
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.groupId);
+    const bundle = await loadGroupSharePolicyBundle({
+        ...input,
+        expectedGroupHead: committedGroupHead,
+        localCheckpoint,
+    });
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: committedGroupHead,
+        loadExternalAuthority: async () => organizationAdminPolicy.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Container share principal policy verification failed");
+    }
+    assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);
+    if (input.expectedGroupName !== undefined) {
+        await assertShareGroupName({
+            readEncryptedName: input.readEncryptedName,
+            bundle,
+            expectedGroupName: input.expectedGroupName,
+        });
+    }
+    const checkpointPolicies = await retainVerifiedSharePolicies({
+        bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        organizationPolicy: organizationAdminPolicy,
+        policy: verified.value,
+        stillCurrent: input.stillCurrent,
+    });
+    return {
+        bundle,
+        checkpointPolicies,
+        dependencyBundles: externalAdminPolicyPersistenceEntries(organizationAdminPolicy).map((entry) => entry.bundle),
+        organizationId: input.organizationId,
+        policy: verified.value,
+    };
+}
+//# sourceMappingURL=sharePrincipalPolicy.js.map

package/workflows/containers/child/share/sharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mFAAmF,CAAC;AACvI,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AACpH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kFAAkF,CAAC;AACzI,OAAO,EAAE,mCAAmC,EAAE,MAAM,0FAA0F,CAAC;AAC/I,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}

package/workflows/containers/child/share/shareProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareProjection.js","sourceRoot":"","sources":["shareProjection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAG0E,EAC1E,wBAAmD;IAEnD,MAAM,gBAAgB,GACpB,KAAK,CAAC,kBAAkB;QACxB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAAC;QAC9D,GAAG,KAAK;QACR,kBAAkB,EAAE,gBAAgB;QACpC,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACtE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { projectionWithCurrentAncestors } from \"./shareAncestorRepair\";\n\n/** The container's projection, with any lazily stale chain above it repaired. */\nexport async function resolveShareProjection(\n  input: Omit<\n    Parameters<typeof projectionWithCurrentAncestors>[0],\n    \"previousProjection\" | \"resolveProjectionUserKey\"\n  > & { previousProjection?: ContainerWriterProjectionResponse | undefined },\n  resolveProjectionUserKey: ProjectionUserKeyResolver,\n): Promise<ContainerWriterProjectionResponse | null> {\n  const servedProjection =\n    input.previousProjection ??\n    (await input.apiClient.getContainerWriterProjection(input.containerId));\n  if (!servedProjection || input.stillCurrent?.() === false) return null;\n  const previousProjection = await projectionWithCurrentAncestors({\n    ...input,\n    previousProjection: servedProjection,\n    resolveProjectionUserKey,\n  });\n  return input.stillCurrent?.() === false ? null : previousProjection;\n}\n"]}

package/workflows/containers/index.d.ts

@@ -2,21 +2,21 @@ export { ContainerAuthorAccessError } from "../../data/containers/shared/authorA
 export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
 export type { ContainerReciteApi } from "../../data/containers/shared/reciteApi.js";
 export type { ContainerMutationAuthor, MaterializedContainerRekeyPlan, } from "../../data/containers/shared/types.js";
-export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
-export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/keyringRebuild.js";
-export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
+export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { type ContainerWriteRefusal, classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js

@@ -4,23 +4,23 @@ export { ContainerAuthorAccessError } from "../../data/containers/shared/authorA
 // A create or move past the readable path length; `code` is
 // `container_path_too_deep`. Queued moves are abandoned, queued creates wait.
 export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
-export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
-export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
 // A share's projection verification can be cancelled by a newer generation
 // underneath the caller; hosts filter that outcome from their own reporting.
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
 // A rebuilt keyring override that a concurrent rotation outdated: rebuild it.
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/keyringOverrideLineage\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yDAAyD,CAAC;AACjE,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}

package/workflows/containers/writeRefusal.js

@@ -1,5 +1,5 @@
 import { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
-import { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
 function namedError(error, name) {
     return error instanceof Error && error.name === name;
 }

package/workflows/containers/writeRefusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"writeRefusal.js","sourceRoot":"","sources":["writeRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAkB1D,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,0EAA0E;IAC1E,IACE,KAAK,YAAY,mCAAmC;QACpD,UAAU,CAAC,KAAK,EAAE,qCAAqC,CAAC,EACxD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,IACE,KAAK,YAAY,+BAA+B;QAChD,UAAU,CAAC,KAAK,EAAE,iCAAiC,CAAC,EACpD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\n\n/**\n * Why the SDK refused to author a container-scoped write before anything was\n * encrypted or sent:\n *\n * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this\n *   writer's next document sync pass, or a peer, re-keys it parent-first.\n * - `repair-inaccessible`: the same, but the stale container is one this writer\n *   can neither re-key nor be given the key for. Queued changes stay queued and\n *   sync once a member with access to `containerId` repairs it.\n * - `unauthorized`: the signed path grants this signer too little access.\n */\nexport type ContainerWriteRefusal =\n  | { readonly kind: \"repair-required\"; readonly containerId: string }\n  | { readonly kind: \"repair-inaccessible\"; readonly containerId: string }\n  | { readonly kind: \"unauthorized\" };\n\nfunction namedError(error: unknown, name: string): error is Error {\n  return error instanceof Error && error.name === name;\n}\n\n/** A same-named error from elsewhere may lack the field; never say \"undefined\". */\nfunction repairContainerId(error: unknown): string | null {\n  const containerId = Reflect.get(Object(error), \"containerId\");\n  return typeof containerId === \"string\" && containerId.length > 0\n    ? containerId\n    : null;\n}\n\n/** Null for anything else, including keying-verification failures. */\nexport function classifyContainerWriteRefusal(\n  error: unknown,\n): ContainerWriteRefusal | null {\n  // Match by name as well: a host bundling the SDK twice holds two classes.\n  if (\n    error instanceof ContainerKekRepairInaccessibleError ||\n    namedError(error, \"ContainerKekRepairInaccessibleError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-inaccessible\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    namedError(error, \"ContainerKekRepairRequiredError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-required\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerAuthorAccessError ||\n    namedError(error, \"ContainerAuthorAccessError\")\n  ) {\n    return { kind: \"unauthorized\" };\n  }\n  return null;\n}\n"]}
+{"version":3,"file":"writeRefusal.js","sourceRoot":"","sources":["writeRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAkBvE,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,0EAA0E;IAC1E,IACE,KAAK,YAAY,mCAAmC;QACpD,UAAU,CAAC,KAAK,EAAE,qCAAqC,CAAC,EACxD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,IACE,KAAK,YAAY,+BAA+B;QAChD,UAAU,CAAC,KAAK,EAAE,iCAAiC,CAAC,EACpD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\n\n/**\n * Why the SDK refused to author a container-scoped write before anything was\n * encrypted or sent:\n *\n * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this\n *   writer's next document sync pass, or a peer, re-keys it parent-first.\n * - `repair-inaccessible`: the same, but the stale container is one this writer\n *   can neither re-key nor be given the key for. Queued changes stay queued and\n *   sync once a member with access to `containerId` repairs it.\n * - `unauthorized`: the signed path grants this signer too little access.\n */\nexport type ContainerWriteRefusal =\n  | { readonly kind: \"repair-required\"; readonly containerId: string }\n  | { readonly kind: \"repair-inaccessible\"; readonly containerId: string }\n  | { readonly kind: \"unauthorized\" };\n\nfunction namedError(error: unknown, name: string): error is Error {\n  return error instanceof Error && error.name === name;\n}\n\n/** A same-named error from elsewhere may lack the field; never say \"undefined\". */\nfunction repairContainerId(error: unknown): string | null {\n  const containerId = Reflect.get(Object(error), \"containerId\");\n  return typeof containerId === \"string\" && containerId.length > 0\n    ? containerId\n    : null;\n}\n\n/** Null for anything else, including keying-verification failures. */\nexport function classifyContainerWriteRefusal(\n  error: unknown,\n): ContainerWriteRefusal | null {\n  // Match by name as well: a host bundling the SDK twice holds two classes.\n  if (\n    error instanceof ContainerKekRepairInaccessibleError ||\n    namedError(error, \"ContainerKekRepairInaccessibleError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-inaccessible\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    namedError(error, \"ContainerKekRepairRequiredError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-required\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerAuthorAccessError ||\n    namedError(error, \"ContainerAuthorAccessError\")\n  ) {\n    return { kind: \"unauthorized\" };\n  }\n  return null;\n}\n"]}

package/workflows/documents/create/createAdoption.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, unwrapDocumentContentKeyFromWriterProjection, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, unwrapDocumentContentKeyFromWriterProjection, } from "../../../data/documents/shared/projection/index.js";
 import { persistedDocumentCreateStateFromWriterProjection } from "../../../data/documents/shared/responses.js";
 import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
 import { readAccessEvent, readAccessManifest, } from "../../../data/keyingProjectionVerification/readers.js";

package/workflows/documents/create/createResponse.js

@@ -1,6 +1,6 @@
-import { acknowledgeDocumentMutation } from "../../../data/documents/shared/mutationAcknowledgement.js";
-import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection/index.js";
 import { persistedDocumentCreateStateFromResponse } from "../../../data/documents/shared/responses.js";
+import { acknowledgeDocumentMutation } from "../../../data/documents/shared/sync/mutationAcknowledgement.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { nullOnProjectionVerificationCancellation } from "../../../data/keyingProjectionVerification/types.js";
 import { adoptExistingRemoteDocument } from "./createAdoption.js";

package/workflows/documents/create/createResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"createResponse.js","sourceRoot":"","sources":["createResponse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AASpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,wCAAwC,EAAE,MAAM,kDAAkD,CAAC;AAE5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,wCAAwC,CAC7D,gBAAgB,CAAC,IAAI,EACrB,QAAQ,CACT,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAClE,wCAAwC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,2BAA2B,CAAC;YAC1B,GAAG,KAAK;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,WAAW;YAC1D,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;YAChE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,cAAc;QACd,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n} from \"@tearleads/validators/response\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/mutationAcknowledgement\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { nullOnProjectionVerificationCancellation } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { adoptExistingRemoteDocument } from \"./createAdoption\";\nimport { documentWriterProjectionFromCreateResponse } from \"./createProjection\";\n\n/** A matched acknowledgement remains committed if authorization evidence races. */\nexport async function acknowledgeRemoteDocumentCreate(\n  input: {\n    readonly apiClient: DocumentCreateApi;\n    readonly author: DocumentCreateAuthor;\n    readonly containerProjection: ContainerWriterProjectionResponse;\n    readonly execSql: ExecSql;\n    readonly materializedPlan: MaterializedDocumentCreatePlan;\n    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n    readonly response: DocumentCreateResponse;\n    readonly targetSecretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<CreateRemoteDocumentResult | null> {\n  const { materializedPlan, response } = input;\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    materializedPlan.plan,\n    response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const writerProjection = documentWriterProjectionFromCreateResponse(input);\n  try {\n    const targets = await nullOnProjectionVerificationCancellation(() =>\n      assertDocumentWriterProjectionConsistent(writerProjection, input),\n    );\n    if (!targets || input.stillCurrent?.() === false) return null;\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n    // A principal pin can advance while POST is in flight. Recover the already\n    // committed document from fresh evidence, without submitting another create.\n    // The adoption path still verifies its author, scope, chain and key binding.\n    return nullOnProjectionVerificationCancellation(() =>\n      adoptExistingRemoteDocument({\n        ...input,\n        documentId: response.id,\n        expectedContainerId: input.containerProjection.containerId,\n        expectedOrganizationId: input.containerProjection.organizationId,\n        expectedSignerUserId: input.author.signerUserId,\n      }),\n    );\n  }\n  input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);\n  return {\n    contentKey: materializedPlan.contentKey,\n    documentId: response.id,\n    persistedState,\n    plan: materializedPlan.plan,\n    response,\n    writerProjection,\n  };\n}\n"]}
+{"version":3,"file":"createResponse.js","sourceRoot":"","sources":["createResponse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAS1G,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,wCAAwC,EAAE,MAAM,kDAAkD,CAAC;AAE5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,wCAAwC,CAC7D,gBAAgB,CAAC,IAAI,EACrB,QAAQ,CACT,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAClE,wCAAwC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,2BAA2B,CAAC;YAC1B,GAAG,KAAK;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,WAAW;YAC1D,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;YAChE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,cAAc;QACd,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/sync/mutationAcknowledgement\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { nullOnProjectionVerificationCancellation } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { adoptExistingRemoteDocument } from \"./createAdoption\";\nimport { documentWriterProjectionFromCreateResponse } from \"./createProjection\";\n\n/** A matched acknowledgement remains committed if authorization evidence races. */\nexport async function acknowledgeRemoteDocumentCreate(\n  input: {\n    readonly apiClient: DocumentCreateApi;\n    readonly author: DocumentCreateAuthor;\n    readonly containerProjection: ContainerWriterProjectionResponse;\n    readonly execSql: ExecSql;\n    readonly materializedPlan: MaterializedDocumentCreatePlan;\n    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n    readonly response: DocumentCreateResponse;\n    readonly targetSecretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<CreateRemoteDocumentResult | null> {\n  const { materializedPlan, response } = input;\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    materializedPlan.plan,\n    response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const writerProjection = documentWriterProjectionFromCreateResponse(input);\n  try {\n    const targets = await nullOnProjectionVerificationCancellation(() =>\n      assertDocumentWriterProjectionConsistent(writerProjection, input),\n    );\n    if (!targets || input.stillCurrent?.() === false) return null;\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n    // A principal pin can advance while POST is in flight. Recover the already\n    // committed document from fresh evidence, without submitting another create.\n    // The adoption path still verifies its author, scope, chain and key binding.\n    return nullOnProjectionVerificationCancellation(() =>\n      adoptExistingRemoteDocument({\n        ...input,\n        documentId: response.id,\n        expectedContainerId: input.containerProjection.containerId,\n        expectedOrganizationId: input.containerProjection.organizationId,\n        expectedSignerUserId: input.author.signerUserId,\n      }),\n    );\n  }\n  input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);\n  return {\n    contentKey: materializedPlan.contentKey,\n    documentId: response.id,\n    persistedState,\n    plan: materializedPlan.plan,\n    response,\n    writerProjection,\n  };\n}\n"]}

package/workflows/documents/create/index.js

@@ -1,7 +1,7 @@
 import { DOCUMENT_SYNC_ERROR_CODES, } from "../../../internal/validators/response/index.js";
 import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
 import { buildDocumentCreatePlan } from "../../../data/documents/shared/events.js";
-import { wrapDocumentContentKeyForCreate } from "../../../data/documents/shared/projection.js";
+import { wrapDocumentContentKeyForCreate } from "../../../data/documents/shared/projection/index.js";
 import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
 import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { isContainerCreatePending } from "../../../data/persistence/container-contents/pendingContainerCreate.js";

package/workflows/documents/documentMutationCommit.d.ts

@@ -1,6 +1,6 @@
 import { type DocumentProjectorRegistry, type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
 import type { DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
-import type { PendingUpdateFields } from "../../data/sqlite/documentPersistence.js";
+import type { PendingUpdateFields } from "../../data/sqlite/documentPersistence/index.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import { type PrepareDocumentMutationInput } from "./documentMutationPreparation.js";
 export interface PersistedDocumentState {

package/workflows/documents/documentMutationPreparation.d.ts

@@ -1,4 +1,4 @@
-import { type DocumentSyncPullContinuation } from "../../data/documents/shared/syncPagination.js";
+import { type DocumentSyncPullContinuation } from "../../data/documents/shared/sync/syncPagination.js";
 import type { DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import { mergePersistedDocumentHistory } from "./historyContent.js";

package/workflows/documents/documentMutationPreparation.js

@@ -1,5 +1,5 @@
 import { mergeVersionVectors, satisfiesVersionVector } from "../../internal/loro/index.js";
-import { documentSyncPullContinuationsEqual, } from "../../data/documents/shared/syncPagination.js";
+import { documentSyncPullContinuationsEqual, } from "../../data/documents/shared/sync/syncPagination.js";
 import { canWriteEffectiveAccessLevel } from "../../data/keying/accessLevel.js";
 import { mergePersistedDocumentHistory } from "./historyContent.js";
 function sameNullableDocumentValue(left, right) {

package/workflows/documents/documentMutationPreparation.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentMutationPreparation.js","sourceRoot":"","sources":["documentMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,kCAAkC,GACnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAM7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAyBjE,SAAS,yBAAyB,CAChC,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAoC,EACpC,QAA8B;IAE9B,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QAC1B,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,yBAAyB,CACvB,OAAO,CAAC,eAAe,EACvB,QAAQ,CAAC,eAAe,CACzB;QACD,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;YACpC,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,gBAAgB,EACxB,QAAQ,CAAC,gBAAgB,CAC1B;QACD,yBAAyB,CACvB,OAAO,CAAC,kBAAkB,EAC1B,QAAQ,CAAC,kBAAkB,CAC5B;QACD,yBAAyB,CACvB,OAAO,CAAC,sBAAsB,EAC9B,QAAQ,CAAC,sBAAsB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,MAA4B;IAE5B,OAAO,CACL,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;QACvE,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QACxD,CAAC,yBAAyB,CACxB,OAAO,CAAC,kBAAkB,EAC1B,MAAM,CAAC,kBAAkB,CAC1B;QACD,CAAC,kCAAkC,CACjC,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,gBAAgB,CACxB;QACD,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoC,EACpC,aAAmC;IAEnC,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,aAAa,CAAC,kBAAkB,EAChC,CAAC;QACD,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAmC,EACnC,aAA0C;IAE1C,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,aAAa,KAAK,IAAI;QACtB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC;IACjE,MAAM,8BAA8B,GAClC,CAAC,iBAAiB;QAClB,CAAC,aAAa,CAAC,kBAAkB,KAAK,IAAI;YACxC,aAAa,CAAC,kBAAkB,KAAK,SAAS;YAC9C,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,iBAAiB,CAClB,CAAC,CAAC;IACP,OAAO,CACL,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU;QAC3D,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CACvC;QACD,8BAA8B;QAC9B,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;YAC1C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACtE,CAAC,4BAA4B,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC3C,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAoC,EACpC,QAA+C;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,qBAAqB,GACzB,yBAAyB,CACvB,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,MAAM,CAAC,aAAa,CAC9B;QACD,OAAO,EAAE,kBAAkB,KAAK,QAAQ,CAAC,MAAM,CAAC,kBAAkB;QAClE,yBAAyB,CACvB,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CACnC,CAAC;IACJ,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC;QAC3D,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,CAAC;YAChC,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;QACL,0BAA0B,EACxB,CAAC,sBAAsB;YACvB,CAAC,qBAAqB;YACtB,CAAC,oBAAoB;YACrB,CAAC,kCAAkC,CACjC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,CAAC,gBAAgB,CAC1B;QACH,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC,EACnC,OAAgB,EAChB,KAAoC;IAEpC,MAAM,oBAAoB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAC/D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,kBAAkB,GACtB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,oBAAoB,KAAK,IAAI,CAAC;IAChE,MAAM,qBAAqB,GAAG,oBAAoB,IAAI,KAAK,CAAC,aAAa,CAAC;IAC1E,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,+BAA+B,CAC3D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,GAC1D,kBAAkB,IAAI,mBAAmB,IAAI,qBAAqB;QAChE,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE;QACrE,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;YACpE,CAAC,CAAC,0BAA0B,CACxB,qBAAqB,EACrB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACV,MAAM,uBAAuB,GAAG,8BAA8B,CAC5D,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAI,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;QACtD,MAAM,6BAA6B,CAAC;YAClC,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,uBAAuB,IAAI,oBAAoB;YAC/C,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,kBAAkB;QAClB,qBAAqB;QACrB,0BAA0B;QAC1B,aAAa,EACX,sBAAsB,KAAK,SAAS;YAClC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;QAC3E,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n} from \"../../data/documents/shared/syncPagination\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/keying/accessLevel\";\nimport type {\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { mergePersistedDocumentHistory } from \"./historyContent\";\n\nexport interface ExpectedDocumentSyncState {\n  pullContinuation: DocumentSyncPullContinuation | null;\n  record: StoredDocumentRecord;\n}\n\nexport interface PrepareDocumentMutationInput {\n  currentDoc: Parameters<typeof mergePersistedDocumentHistory>[0][\"doc\"];\n  currentRecord: StoredDocumentRecord | null;\n  expectedSyncState?: ExpectedDocumentSyncState | undefined;\n  historyCheckpoint?:\n    | {\n        coveredTailIds: readonly string[];\n        endVersionVector: string;\n        pruneCoveredLocalState: boolean;\n        snapshot: string;\n      }\n    | undefined;\n  historyUpdateOrigin?: \"local\" | \"remote\" | undefined;\n  historyUpdates?: readonly string[] | undefined;\n  localId: string;\n  persistence: DocumentsPersistence;\n}\n\nfunction sameNullableDocumentValue(\n  left: string | null | undefined,\n  right: string | null | undefined,\n): boolean {\n  return (left ?? null) === (right ?? null);\n}\n\nexport function documentSyncSecurityContextMatches(\n  current: StoredDocumentRecord | null,\n  expected: StoredDocumentRecord,\n): boolean {\n  return (\n    current !== null &&\n    current.id === expected.id &&\n    current.documentId === expected.documentId &&\n    current.containerId === expected.containerId &&\n    current.accessEpoch === expected.accessEpoch &&\n    sameNullableDocumentValue(\n      current.accessStateHash,\n      expected.accessStateHash,\n    ) &&\n    (current.effectiveAccessLevel ?? null) ===\n      (expected.effectiveAccessLevel ?? null) &&\n    sameNullableDocumentValue(\n      current.contentKeyBundle,\n      expected.contentKeyBundle,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentKekTargets,\n      expected.documentKekTargets,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentManifestBundle,\n      expected.documentManifestBundle,\n    )\n  );\n}\n\nfunction patchSpecifiesContainer(\n  patch: Partial<StoredDocumentRecord>,\n): boolean {\n  return Object.hasOwn(patch, \"containerId\");\n}\n\nfunction documentSyncStateDiffers(\n  current: StoredDocumentRecord,\n  cached: StoredDocumentRecord,\n): boolean {\n  return (\n    !sameNullableDocumentValue(current.lastCommitLsn, cached.lastCommitLsn) ||\n    current.snapshotEndVersion !== cached.snapshotEndVersion ||\n    !sameNullableDocumentValue(\n      current.pendingBaseVersion,\n      cached.pendingBaseVersion,\n    ) ||\n    !documentSyncPullContinuationsEqual(\n      current.pullContinuation,\n      cached.pullContinuation,\n    ) ||\n    Boolean(current.pullContinuationRecoveryRequired) !==\n      Boolean(cached.pullContinuationRecoveryRequired)\n  );\n}\n\nfunction mergeMutationFrontiers(\n  patch: Partial<StoredDocumentRecord>,\n  durableRecord: StoredDocumentRecord,\n): Partial<StoredDocumentRecord> {\n  const nextPatch = { ...patch };\n  if (patch.snapshotEndVersion !== undefined) {\n    nextPatch.snapshotEndVersion = mergeVersionVectors([\n      durableRecord.snapshotEndVersion,\n      patch.snapshotEndVersion,\n    ]);\n  }\n  if (\n    patch.pendingBaseVersion !== undefined &&\n    patch.pendingBaseVersion !== null &&\n    durableRecord.pendingBaseVersion\n  ) {\n    nextPatch.pendingBaseVersion = mergeVersionVectors([\n      durableRecord.pendingBaseVersion,\n      patch.pendingBaseVersion,\n    ]);\n  }\n  return nextPatch;\n}\n\nfunction ordinarySaveNeedsHistoryRebase(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  if (\n    input.expectedSyncState !== undefined ||\n    durableRecord === null ||\n    input.currentRecord === null\n  ) {\n    return false;\n  }\n  const cachedPendingBase = input.currentRecord.pendingBaseVersion;\n  const durableCoversCachedPendingBase =\n    !cachedPendingBase ||\n    (durableRecord.pendingBaseVersion !== null &&\n      durableRecord.pendingBaseVersion !== undefined &&\n      satisfiesVersionVector(\n        durableRecord.pendingBaseVersion,\n        cachedPendingBase,\n      ));\n  return (\n    durableRecord.id === input.currentRecord.id &&\n    durableRecord.documentId === input.currentRecord.documentId &&\n    satisfiesVersionVector(\n      durableRecord.snapshotEndVersion,\n      input.currentRecord.snapshotEndVersion,\n    ) &&\n    durableCoversCachedPendingBase &&\n    documentSyncStateDiffers(durableRecord, input.currentRecord)\n  );\n}\n\nfunction ordinarySaveIdentityWasReplaced(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (durableRecord.id !== input.currentRecord.id ||\n      durableRecord.documentId !== input.currentRecord.documentId)\n  );\n}\n\nfunction ordinarySaveWriteAccessWasRevoked(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    canWriteEffectiveAccessLevel(input.currentRecord.effectiveAccessLevel) &&\n    !canWriteEffectiveAccessLevel(durableRecord.effectiveAccessLevel)\n  );\n}\n\nfunction recoveryGenerationWasSuperseded(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (input.currentRecord.recoveryGeneration ?? 0) !==\n      (durableRecord.recoveryGeneration ?? 0)\n  );\n}\n\nfunction resolveSyncSettlementState(\n  current: StoredDocumentRecord | null,\n  expected: ExpectedDocumentSyncState | undefined,\n): { pullContinuationSuperseded: boolean; securityContextMatches: boolean } {\n  if (!expected) {\n    return { pullContinuationSuperseded: false, securityContextMatches: true };\n  }\n  const securityContextMatches = documentSyncSecurityContextMatches(\n    current,\n    expected.record,\n  );\n  const contentFrontiersMatch =\n    sameNullableDocumentValue(\n      current?.lastCommitLsn,\n      expected.record.lastCommitLsn,\n    ) &&\n    current?.snapshotEndVersion === expected.record.snapshotEndVersion &&\n    sameNullableDocumentValue(\n      current?.pendingBaseVersion,\n      expected.record.pendingBaseVersion,\n    );\n  const recoveryStateMatches =\n    Boolean(current?.pullContinuationRecoveryRequired) ===\n      Boolean(expected.record.pullContinuationRecoveryRequired) &&\n    (current?.recoveryGeneration ?? 0) ===\n      (expected.record.recoveryGeneration ?? 0);\n  return {\n    pullContinuationSuperseded:\n      !securityContextMatches ||\n      !contentFrontiersMatch ||\n      !recoveryStateMatches ||\n      !documentSyncPullContinuationsEqual(\n        current?.pullContinuation,\n        expected.pullContinuation,\n      ),\n    securityContextMatches,\n  };\n}\n\nexport async function prepareDocumentMutation(\n  input: PrepareDocumentMutationInput,\n  execSql: ExecSql,\n  patch: Partial<StoredDocumentRecord>,\n) {\n  const durableCurrentRecord = await input.persistence.loadDocument(\n    execSql,\n    input.localId,\n  );\n  const creationSuperseded =\n    input.currentRecord === null && durableCurrentRecord !== null;\n  const mutationCurrentRecord = durableCurrentRecord ?? input.currentRecord;\n  const identityWasReplaced = ordinarySaveIdentityWasReplaced(\n    input,\n    durableCurrentRecord,\n  );\n  const writeAccessWasRevoked = ordinarySaveWriteAccessWasRevoked(\n    input,\n    durableCurrentRecord,\n  );\n  const recoveryWasSuperseded = recoveryGenerationWasSuperseded(\n    input,\n    durableCurrentRecord,\n  );\n  const { pullContinuationSuperseded, securityContextMatches } =\n    creationSuperseded || identityWasReplaced || writeAccessWasRevoked\n      ? { pullContinuationSuperseded: true, securityContextMatches: false }\n      : recoveryWasSuperseded\n        ? { pullContinuationSuperseded: true, securityContextMatches: true }\n        : resolveSyncSettlementState(\n            mutationCurrentRecord,\n            input.expectedSyncState,\n          );\n  const ordinarySaveNeedsRebase = ordinarySaveNeedsHistoryRebase(\n    input,\n    durableCurrentRecord,\n  );\n\n  if (ordinarySaveNeedsRebase && securityContextMatches) {\n    await mergePersistedDocumentHistory({\n      doc: input.currentDoc,\n      execSql,\n      localId: input.localId,\n      persistence: input.persistence,\n    });\n  }\n  const mutationPatch = pullContinuationSuperseded\n    ? {}\n    : ordinarySaveNeedsRebase && durableCurrentRecord\n      ? mergeMutationFrontiers(patch, durableCurrentRecord)\n      : patch;\n  const authoritativeContainer = patchSpecifiesContainer(mutationPatch)\n    ? undefined\n    : await input.persistence.loadDocumentContainer(execSql, input.localId);\n  return {\n    creationSuperseded,\n    mutationCurrentRecord,\n    pullContinuationSuperseded,\n    resolvedPatch:\n      authoritativeContainer === undefined\n        ? mutationPatch\n        : { ...mutationPatch, containerId: authoritativeContainer.containerId },\n    securityContextMatches,\n  };\n}\n"]}
+{"version":3,"file":"documentMutationPreparation.js","sourceRoot":"","sources":["documentMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,kCAAkC,GACnC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAM7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAyBjE,SAAS,yBAAyB,CAChC,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAoC,EACpC,QAA8B;IAE9B,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QAC1B,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,yBAAyB,CACvB,OAAO,CAAC,eAAe,EACvB,QAAQ,CAAC,eAAe,CACzB;QACD,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;YACpC,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,gBAAgB,EACxB,QAAQ,CAAC,gBAAgB,CAC1B;QACD,yBAAyB,CACvB,OAAO,CAAC,kBAAkB,EAC1B,QAAQ,CAAC,kBAAkB,CAC5B;QACD,yBAAyB,CACvB,OAAO,CAAC,sBAAsB,EAC9B,QAAQ,CAAC,sBAAsB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,MAA4B;IAE5B,OAAO,CACL,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;QACvE,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QACxD,CAAC,yBAAyB,CACxB,OAAO,CAAC,kBAAkB,EAC1B,MAAM,CAAC,kBAAkB,CAC1B;QACD,CAAC,kCAAkC,CACjC,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,gBAAgB,CACxB;QACD,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoC,EACpC,aAAmC;IAEnC,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,aAAa,CAAC,kBAAkB,EAChC,CAAC;QACD,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAmC,EACnC,aAA0C;IAE1C,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,aAAa,KAAK,IAAI;QACtB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC;IACjE,MAAM,8BAA8B,GAClC,CAAC,iBAAiB;QAClB,CAAC,aAAa,CAAC,kBAAkB,KAAK,IAAI;YACxC,aAAa,CAAC,kBAAkB,KAAK,SAAS;YAC9C,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,iBAAiB,CAClB,CAAC,CAAC;IACP,OAAO,CACL,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU;QAC3D,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CACvC;QACD,8BAA8B;QAC9B,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;YAC1C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACtE,CAAC,4BAA4B,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC3C,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAoC,EACpC,QAA+C;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,qBAAqB,GACzB,yBAAyB,CACvB,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,MAAM,CAAC,aAAa,CAC9B;QACD,OAAO,EAAE,kBAAkB,KAAK,QAAQ,CAAC,MAAM,CAAC,kBAAkB;QAClE,yBAAyB,CACvB,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CACnC,CAAC;IACJ,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC;QAC3D,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,CAAC;YAChC,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;QACL,0BAA0B,EACxB,CAAC,sBAAsB;YACvB,CAAC,qBAAqB;YACtB,CAAC,oBAAoB;YACrB,CAAC,kCAAkC,CACjC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,CAAC,gBAAgB,CAC1B;QACH,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC,EACnC,OAAgB,EAChB,KAAoC;IAEpC,MAAM,oBAAoB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAC/D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,kBAAkB,GACtB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,oBAAoB,KAAK,IAAI,CAAC;IAChE,MAAM,qBAAqB,GAAG,oBAAoB,IAAI,KAAK,CAAC,aAAa,CAAC;IAC1E,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,+BAA+B,CAC3D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,GAC1D,kBAAkB,IAAI,mBAAmB,IAAI,qBAAqB;QAChE,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE;QACrE,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;YACpE,CAAC,CAAC,0BAA0B,CACxB,qBAAqB,EACrB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACV,MAAM,uBAAuB,GAAG,8BAA8B,CAC5D,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAI,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;QACtD,MAAM,6BAA6B,CAAC;YAClC,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,uBAAuB,IAAI,oBAAoB;YAC/C,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,kBAAkB;QAClB,qBAAqB;QACrB,0BAA0B;QAC1B,aAAa,EACX,sBAAsB,KAAK,SAAS;YAClC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;QAC3E,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n} from \"../../data/documents/shared/sync/syncPagination\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/keying/accessLevel\";\nimport type {\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { mergePersistedDocumentHistory } from \"./historyContent\";\n\nexport interface ExpectedDocumentSyncState {\n  pullContinuation: DocumentSyncPullContinuation | null;\n  record: StoredDocumentRecord;\n}\n\nexport interface PrepareDocumentMutationInput {\n  currentDoc: Parameters<typeof mergePersistedDocumentHistory>[0][\"doc\"];\n  currentRecord: StoredDocumentRecord | null;\n  expectedSyncState?: ExpectedDocumentSyncState | undefined;\n  historyCheckpoint?:\n    | {\n        coveredTailIds: readonly string[];\n        endVersionVector: string;\n        pruneCoveredLocalState: boolean;\n        snapshot: string;\n      }\n    | undefined;\n  historyUpdateOrigin?: \"local\" | \"remote\" | undefined;\n  historyUpdates?: readonly string[] | undefined;\n  localId: string;\n  persistence: DocumentsPersistence;\n}\n\nfunction sameNullableDocumentValue(\n  left: string | null | undefined,\n  right: string | null | undefined,\n): boolean {\n  return (left ?? null) === (right ?? null);\n}\n\nexport function documentSyncSecurityContextMatches(\n  current: StoredDocumentRecord | null,\n  expected: StoredDocumentRecord,\n): boolean {\n  return (\n    current !== null &&\n    current.id === expected.id &&\n    current.documentId === expected.documentId &&\n    current.containerId === expected.containerId &&\n    current.accessEpoch === expected.accessEpoch &&\n    sameNullableDocumentValue(\n      current.accessStateHash,\n      expected.accessStateHash,\n    ) &&\n    (current.effectiveAccessLevel ?? null) ===\n      (expected.effectiveAccessLevel ?? null) &&\n    sameNullableDocumentValue(\n      current.contentKeyBundle,\n      expected.contentKeyBundle,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentKekTargets,\n      expected.documentKekTargets,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentManifestBundle,\n      expected.documentManifestBundle,\n    )\n  );\n}\n\nfunction patchSpecifiesContainer(\n  patch: Partial<StoredDocumentRecord>,\n): boolean {\n  return Object.hasOwn(patch, \"containerId\");\n}\n\nfunction documentSyncStateDiffers(\n  current: StoredDocumentRecord,\n  cached: StoredDocumentRecord,\n): boolean {\n  return (\n    !sameNullableDocumentValue(current.lastCommitLsn, cached.lastCommitLsn) ||\n    current.snapshotEndVersion !== cached.snapshotEndVersion ||\n    !sameNullableDocumentValue(\n      current.pendingBaseVersion,\n      cached.pendingBaseVersion,\n    ) ||\n    !documentSyncPullContinuationsEqual(\n      current.pullContinuation,\n      cached.pullContinuation,\n    ) ||\n    Boolean(current.pullContinuationRecoveryRequired) !==\n      Boolean(cached.pullContinuationRecoveryRequired)\n  );\n}\n\nfunction mergeMutationFrontiers(\n  patch: Partial<StoredDocumentRecord>,\n  durableRecord: StoredDocumentRecord,\n): Partial<StoredDocumentRecord> {\n  const nextPatch = { ...patch };\n  if (patch.snapshotEndVersion !== undefined) {\n    nextPatch.snapshotEndVersion = mergeVersionVectors([\n      durableRecord.snapshotEndVersion,\n      patch.snapshotEndVersion,\n    ]);\n  }\n  if (\n    patch.pendingBaseVersion !== undefined &&\n    patch.pendingBaseVersion !== null &&\n    durableRecord.pendingBaseVersion\n  ) {\n    nextPatch.pendingBaseVersion = mergeVersionVectors([\n      durableRecord.pendingBaseVersion,\n      patch.pendingBaseVersion,\n    ]);\n  }\n  return nextPatch;\n}\n\nfunction ordinarySaveNeedsHistoryRebase(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  if (\n    input.expectedSyncState !== undefined ||\n    durableRecord === null ||\n    input.currentRecord === null\n  ) {\n    return false;\n  }\n  const cachedPendingBase = input.currentRecord.pendingBaseVersion;\n  const durableCoversCachedPendingBase =\n    !cachedPendingBase ||\n    (durableRecord.pendingBaseVersion !== null &&\n      durableRecord.pendingBaseVersion !== undefined &&\n      satisfiesVersionVector(\n        durableRecord.pendingBaseVersion,\n        cachedPendingBase,\n      ));\n  return (\n    durableRecord.id === input.currentRecord.id &&\n    durableRecord.documentId === input.currentRecord.documentId &&\n    satisfiesVersionVector(\n      durableRecord.snapshotEndVersion,\n      input.currentRecord.snapshotEndVersion,\n    ) &&\n    durableCoversCachedPendingBase &&\n    documentSyncStateDiffers(durableRecord, input.currentRecord)\n  );\n}\n\nfunction ordinarySaveIdentityWasReplaced(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (durableRecord.id !== input.currentRecord.id ||\n      durableRecord.documentId !== input.currentRecord.documentId)\n  );\n}\n\nfunction ordinarySaveWriteAccessWasRevoked(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    canWriteEffectiveAccessLevel(input.currentRecord.effectiveAccessLevel) &&\n    !canWriteEffectiveAccessLevel(durableRecord.effectiveAccessLevel)\n  );\n}\n\nfunction recoveryGenerationWasSuperseded(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (input.currentRecord.recoveryGeneration ?? 0) !==\n      (durableRecord.recoveryGeneration ?? 0)\n  );\n}\n\nfunction resolveSyncSettlementState(\n  current: StoredDocumentRecord | null,\n  expected: ExpectedDocumentSyncState | undefined,\n): { pullContinuationSuperseded: boolean; securityContextMatches: boolean } {\n  if (!expected) {\n    return { pullContinuationSuperseded: false, securityContextMatches: true };\n  }\n  const securityContextMatches = documentSyncSecurityContextMatches(\n    current,\n    expected.record,\n  );\n  const contentFrontiersMatch =\n    sameNullableDocumentValue(\n      current?.lastCommitLsn,\n      expected.record.lastCommitLsn,\n    ) &&\n    current?.snapshotEndVersion === expected.record.snapshotEndVersion &&\n    sameNullableDocumentValue(\n      current?.pendingBaseVersion,\n      expected.record.pendingBaseVersion,\n    );\n  const recoveryStateMatches =\n    Boolean(current?.pullContinuationRecoveryRequired) ===\n      Boolean(expected.record.pullContinuationRecoveryRequired) &&\n    (current?.recoveryGeneration ?? 0) ===\n      (expected.record.recoveryGeneration ?? 0);\n  return {\n    pullContinuationSuperseded:\n      !securityContextMatches ||\n      !contentFrontiersMatch ||\n      !recoveryStateMatches ||\n      !documentSyncPullContinuationsEqual(\n        current?.pullContinuation,\n        expected.pullContinuation,\n      ),\n    securityContextMatches,\n  };\n}\n\nexport async function prepareDocumentMutation(\n  input: PrepareDocumentMutationInput,\n  execSql: ExecSql,\n  patch: Partial<StoredDocumentRecord>,\n) {\n  const durableCurrentRecord = await input.persistence.loadDocument(\n    execSql,\n    input.localId,\n  );\n  const creationSuperseded =\n    input.currentRecord === null && durableCurrentRecord !== null;\n  const mutationCurrentRecord = durableCurrentRecord ?? input.currentRecord;\n  const identityWasReplaced = ordinarySaveIdentityWasReplaced(\n    input,\n    durableCurrentRecord,\n  );\n  const writeAccessWasRevoked = ordinarySaveWriteAccessWasRevoked(\n    input,\n    durableCurrentRecord,\n  );\n  const recoveryWasSuperseded = recoveryGenerationWasSuperseded(\n    input,\n    durableCurrentRecord,\n  );\n  const { pullContinuationSuperseded, securityContextMatches } =\n    creationSuperseded || identityWasReplaced || writeAccessWasRevoked\n      ? { pullContinuationSuperseded: true, securityContextMatches: false }\n      : recoveryWasSuperseded\n        ? { pullContinuationSuperseded: true, securityContextMatches: true }\n        : resolveSyncSettlementState(\n            mutationCurrentRecord,\n            input.expectedSyncState,\n          );\n  const ordinarySaveNeedsRebase = ordinarySaveNeedsHistoryRebase(\n    input,\n    durableCurrentRecord,\n  );\n\n  if (ordinarySaveNeedsRebase && securityContextMatches) {\n    await mergePersistedDocumentHistory({\n      doc: input.currentDoc,\n      execSql,\n      localId: input.localId,\n      persistence: input.persistence,\n    });\n  }\n  const mutationPatch = pullContinuationSuperseded\n    ? {}\n    : ordinarySaveNeedsRebase && durableCurrentRecord\n      ? mergeMutationFrontiers(patch, durableCurrentRecord)\n      : patch;\n  const authoritativeContainer = patchSpecifiesContainer(mutationPatch)\n    ? undefined\n    : await input.persistence.loadDocumentContainer(execSql, input.localId);\n  return {\n    creationSuperseded,\n    mutationCurrentRecord,\n    pullContinuationSuperseded,\n    resolvedPatch:\n      authoritativeContainer === undefined\n        ? mutationPatch\n        : { ...mutationPatch, containerId: authoritativeContainer.containerId },\n    securityContextMatches,\n  };\n}\n"]}

package/workflows/documents/index.d.ts

@@ -1,10 +1,10 @@
-export { type DocumentSyncUpdateIsolationError, type IncomingDocumentSyncUpdateValidator, isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection.js";
+export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection/index.js";
 export { persistedDocumentCreateStateFromResponse } from "../../data/documents/shared/responses.js";
-export { type DocumentSyncPullContinuation, documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/syncPagination.js";
+export { type DocumentSyncUpdateIsolationError, type IncomingDocumentSyncUpdateValidator, isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/sync/documentSyncUpdateIsolation.js";
+export { type DocumentSyncPullContinuation, documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/sync/syncPagination.js";
 export type { DocumentCreateAuthor, DocumentLinkSetFailureHandler, DocumentLinkSetMutationFailure, RelinkRemoteDocumentResult, } from "../../data/documents/shared/types.js";
-export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentHistoryPersistence.js";
-export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence.js";
+export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence/index.js";
+export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentPersistence/documentHistoryPersistence.js";
 export type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 export { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
 export { settleOutgoingPassAndDecideReArm } from "../../data/sync/outgoingUpdateSettlement.js";

package/workflows/documents/index.js

@@ -1,9 +1,9 @@
-export { isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection.js";
+export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection/index.js";
 export { persistedDocumentCreateStateFromResponse } from "../../data/documents/shared/responses.js";
-export { documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/syncPagination.js";
-export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentHistoryPersistence.js";
-export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence.js";
+export { isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/sync/documentSyncUpdateIsolation.js";
+export { documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/sync/syncPagination.js";
+export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence/index.js";
+export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentPersistence/documentHistoryPersistence.js";
 export { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
 export { settleOutgoingPassAndDecideReArm } from "../../data/sync/outgoingUpdateSettlement.js";
 export { didRegainSyncPrerequisites, isDatabaseUnavailableError, } from "../../data/sync/syncCoordinator.js";