@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/documentSyncUpdateDecryption.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentSyncUpdateDecryption.js","sourceRoot":"","sources":["documentSyncUpdateDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,qCAAqC,EACrC,8BAA8B,GAE/B,MAAM,SAAS,CAAC;AAIjB,SAAS,4BAA4B,CACnC,aAAqB;IAErB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,oBAAoB,CAClB,KAAK,EACL,8BAA8B,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,2BAA2B,CAAC;QAC9D,qCAAqC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CACvC,KAAK,EACL,SAAS,EACT,2BAA2B,CAC5B,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,yBAAyB,CACtE,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,2BAA2B,CAAC;QACvE,+BAA+B,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CACtB,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAC3D,CAAC;IACF,cAAc,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;IAC9D,OAAO;QACL,UAAU,EAAE,aAAa,CACvB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,2BAA2B,CAAC,CACnE;QACD,eAAe,EAAE,yBAAyB,CACxC,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,YAAY,EAAE,gBAAgB,CAC5B,KAAK,EACL,cAAc,EACd,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,EAAE;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAOzD;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,qBAAqB,GACzB,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,qBAAqB,KAAK,SAAS;QAC1C,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC;IAC3C,IACE,qBAAqB;QACrB,CAAC,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC1C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB;YACxD,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,mBAAmB,CAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,uBAAuB,CAC/B,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,SAAS,CAAC,eAAe;QACzB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,YAAY,KAAK,YAAY;QACvC,SAAS,CAAC,YAAY;YACpB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IACE,SAAS,CAAC,eAAe,KAAK,eAAe;QAC7C,SAAS,CAAC,eAAe;YACvB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,0CAA0C,CAAC;YAC/C,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,MAA0B;IAE1B,IAAI,eAAuB,CAAC;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,MAAM;YACtB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,2BAA2B,CAAC;QAChC,eAAe;QACf,UAAU;QACV,cAAc;QACd,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAO7B;IACC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;YAChD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,8BAA8B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACjE,8BAA8B,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,cAAc,EAAE,gCAAgC,CAAC;gBAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;gBAC1C,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAC7C,CACF,CAAC;QACF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iCAAiC,CACrC,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import {\n  assertAesGcmIv,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport { versionVectorsEqual } from \"@tearleads/loro\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { contentRecordAdditionalDataBytes } from \"./contentRecordAdditionalData\";\nimport {\n  deriveDocumentContentRecordKey,\n  deriveDocumentPlaintextHashKey,\n} from \"./contentRecordKeys\";\nimport { isolateDocumentSyncUpdateError } from \"./documentSyncUpdateIsolation\";\nimport { assertDecryptedDocumentUpdateMetadata } from \"./documentUpdateIntegrity\";\nimport { assertDocumentUpdatePlaintextHash } from \"./plaintextHash\";\nimport {\n  assertOnlyRecordKeys,\n  asWebCryptoBytes,\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n} from \"./readers\";\nimport {\n  type DecryptedDocumentSyncUpdate,\n  DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n  DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n  type ParsedDocumentEncryptedUpdate,\n} from \"./types\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\n\nfunction parseDocumentEncryptedUpdate(\n  encryptedData: string,\n): ParsedDocumentEncryptedUpdate {\n  let value: unknown;\n  try {\n    value = JSON.parse(encryptedData);\n  } catch {\n    throw new Error(\"Document encrypted update is invalid JSON\");\n  }\n  if (!isPlainRecord(value)) {\n    throw new Error(\"Document encrypted update must be an object\");\n  }\n  assertOnlyRecordKeys(\n    value,\n    DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n    \"Document encrypted update\",\n  );\n  if (\n    readRecordString(value, \"format\", \"Document encrypted update\") !==\n    DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT\n  ) {\n    throw new Error(\"Document encrypted update format is invalid\");\n  }\n  const version = readRecordPositiveInteger(\n    value,\n    \"version\",\n    \"Document encrypted update\",\n  );\n  if (version !== 1) {\n    throw new Error(\n      `Document encrypted update version ${version} is invalid; expected 1`,\n    );\n  }\n  if (\n    readRecordString(value, \"encryptionSuite\", \"Document encrypted update\") !==\n    CONTENT_RECORD_ENCRYPTION_SUITE\n  ) {\n    throw new Error(\"Document encrypted update suite is invalid\");\n  }\n\n  const iv = base64ToBytes(\n    readRecordString(value, \"iv\", \"Document encrypted update\"),\n  );\n  assertAesGcmIv(iv, \"Document encrypted update IV is invalid\");\n  return {\n    ciphertext: base64ToBytes(\n      readRecordString(value, \"ciphertext\", \"Document encrypted update\"),\n    ),\n    contentKeyEpoch: readRecordPositiveInteger(\n      value,\n      \"contentKeyEpoch\",\n      \"Document encrypted update\",\n    ),\n    contentRecordId: readRecordString(\n      value,\n      \"contentRecordId\",\n      \"Document encrypted update\",\n    ),\n    metadataHash: readRecordString(\n      value,\n      \"metadataHash\",\n      \"Document encrypted update\",\n    ),\n    nonceDomainHash: readRecordString(\n      value,\n      \"nonceDomainHash\",\n      \"Document encrypted update\",\n    ),\n    iv,\n  };\n}\n\nasync function assertDocumentEncryptedUpdateMatchesHeader(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  encryptedData: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<void> {\n  const { encrypted, update } = input;\n  const hasCheckpointMetadata =\n    update.checkpointKind !== undefined ||\n    update.checkpointPayloadKind !== undefined ||\n    update.sourceVersionVector !== undefined;\n  if (\n    hasCheckpointMetadata &&\n    (update.checkpointKind !== \"rotate_baseline\" ||\n      update.checkpointPayloadKind !== \"full_history_snapshot\" ||\n      !update.sourceVersionVector ||\n      !versionVectorsEqual(\n        update.sourceVersionVector,\n        update.partialEndVersionVector,\n      ))\n  ) {\n    throw new Error(\"Document rotation checkpoint metadata mismatch\");\n  }\n  if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {\n    throw new Error(\"Document encrypted update content-key epoch mismatch\");\n  }\n  if (update.documentId !== input.documentId) {\n    throw new Error(\"Document encrypted update document id mismatch\");\n  }\n  if (\n    encrypted.contentRecordId !==\n    readRecordString(update.writeHeader, \"contentRecordId\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update content record mismatch\");\n  }\n\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: input.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    encrypted.metadataHash !== metadataHash ||\n    encrypted.metadataHash !==\n      readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update metadata hash mismatch\");\n  }\n\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (\n    encrypted.nonceDomainHash !== nonceDomainHash ||\n    encrypted.nonceDomainHash !==\n      readRecordString(update.writeHeader, \"nonceDomainHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update nonce domain mismatch\");\n  }\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    input.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update ciphertext hash mismatch\");\n  }\n}\n\nasync function verifiedEncryptedSyncUpdate(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<ParsedDocumentEncryptedUpdate> {\n  try {\n    const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);\n    await assertDocumentEncryptedUpdateMatchesHeader({\n      encrypted,\n      encryptedData: input.update.encryptedData,\n      ...input,\n    });\n    return encrypted;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"encrypted_record\",\n      updateId: input.update.id,\n    });\n  }\n}\n\n/** Verifies the encrypted record's structure and every binding to its header. */\nexport async function assertDocumentSyncUpdateEncryptedRecord(\n  update: SyncResponseUpdate,\n): Promise<void> {\n  let contentKeyEpoch: number;\n  let documentId: string;\n  let organizationId: string;\n  try {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (header.objectKind !== \"document\") {\n      throw new Error(\"Document sync response write header kind mismatch\");\n    }\n    contentKeyEpoch = header.contentKeyEpoch;\n    documentId = header.objectId;\n    organizationId = header.organizationId;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: update,\n      stage: \"write_header\",\n      updateId: update.id,\n    });\n  }\n  await verifiedEncryptedSyncUpdate({\n    contentKeyEpoch,\n    documentId,\n    organizationId,\n    update,\n  });\n}\n\nasync function decryptPayload(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<{ plaintextHashKey: CryptoKey; updateData: Uint8Array }> {\n  try {\n    const keyInput = {\n      contentKeyMaterial: input.contentKeyMaterial,\n      contentKeyEpoch: input.contentKeyEpoch,\n      contentRecordId: input.encrypted.contentRecordId,\n      documentId: input.documentId,\n      organizationId: input.organizationId,\n    };\n    const [recordKey, plaintextHashKey] = await Promise.all([\n      deriveDocumentContentRecordKey({ ...keyInput, usage: \"decrypt\" }),\n      deriveDocumentPlaintextHashKey(keyInput),\n    ]);\n    const updateData = new Uint8Array(\n      await crypto.subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: asWebCryptoBytes(input.encrypted.iv),\n          additionalData: contentRecordAdditionalDataBytes({\n            contentKeyEpoch: input.contentKeyEpoch,\n            contentRecordId: input.encrypted.contentRecordId,\n            documentId: input.documentId,\n            metadataHash: input.encrypted.metadataHash,\n            nonceDomainHash: input.encrypted.nonceDomainHash,\n            organizationId: input.organizationId,\n          }),\n        },\n        recordKey,\n        asWebCryptoBytes(input.encrypted.ciphertext),\n      ),\n    );\n    return { plaintextHashKey, updateData };\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"decrypt\",\n      updateId: input.update.id,\n    });\n  }\n}\n\nexport async function decryptDocumentSyncUpdate(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<DecryptedDocumentSyncUpdate> {\n  const encrypted = await verifiedEncryptedSyncUpdate(input);\n  const { plaintextHashKey, updateData } = await decryptPayload({\n    ...input,\n    encrypted,\n  });\n  try {\n    await assertDocumentUpdatePlaintextHash(\n      updateData,\n      input.update.plaintextHash,\n      plaintextHashKey,\n    );\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"plaintext_integrity\",\n      updateId: input.update.id,\n    });\n  }\n  try {\n    assertDecryptedDocumentUpdateMetadata(updateData, input.update);\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"loro_metadata\",\n      updateId: input.update.id,\n    });\n  }\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    updateData,\n  };\n}\n"]}

package/data/documents/shared/documentSyncUpdateIsolation.d.ts

@@ -1,55 +0,0 @@
-import { createDocument } from "../../../internal/loro/index.js";
-import type { DocumentSyncResponse } from "../../../internal/validators/response/index.js";
-import type { DecryptedDocumentSyncUpdate, SyncRemoteDocumentResult } from "./types.js";
-type DocumentSyncUpdateIsolationStage = "content_key" | "decrypt" | "encrypted_record" | "loro_import" | "loro_metadata" | "plaintext_integrity" | "write_header";
-type SyncResponseUpdate = DocumentSyncResponse["updates"][number];
-type SyncDocument = Awaited<ReturnType<typeof createDocument>>;
-export type IncomingDocumentSyncUpdateValidator = (result: Pick<SyncRemoteDocumentResult, "decryptedUpdates" | "response">) => void | Promise<void>;
-export declare class DocumentSyncUpdateIsolationError extends Error {
-    readonly attribution: "batch" | "update";
-    readonly authorFingerprint: string | null;
-    readonly batchUpdateIds: readonly string[];
-    readonly checkpointKind: "rotate_baseline" | null;
-    readonly ciphertextHash: string | null;
-    readonly contentKeyEpoch: number | null;
-    readonly documentId: string | null;
-    readonly metadataHash: string | null;
-    readonly stage: DocumentSyncUpdateIsolationStage;
-    readonly updateId: string | null;
-    readonly writerUserId: string | null;
-    constructor(input: {
-        batchUpdateIds?: readonly string[] | undefined;
-        cause: unknown;
-        responseUpdate?: SyncResponseUpdate | undefined;
-        stage: DocumentSyncUpdateIsolationStage;
-        updateId: string | null;
-    });
-}
-export declare function isolateDocumentSyncBatchError(input: {
-    cause: unknown;
-    stage: DocumentSyncUpdateIsolationStage;
-    updateIds: readonly string[];
-}): DocumentSyncUpdateIsolationError;
-export declare function isolateDocumentSyncUpdateError(input: {
-    cause: unknown;
-    responseUpdate?: SyncResponseUpdate | undefined;
-    stage: DocumentSyncUpdateIsolationStage;
-    updateId: string;
-}): DocumentSyncUpdateIsolationError;
-export declare function isDocumentSyncUpdateIsolationError(error: unknown): error is DocumentSyncUpdateIsolationError;
-/** Applies checkpoints with the snapshot API before batching ordinary deltas. */
-export declare function importDecryptedDocumentSyncUpdates(document: SyncDocument, updates: readonly DecryptedDocumentSyncUpdate[]): void;
-/** @internal Exported only to exercise the bounded exact-attribution policy. */
-export declare function findUniqueRepairingCandidate<T>(candidates: readonly T[], repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>): Promise<T | null>;
-/**
- * Proves that a decrypted response can be imported before the live document or
- * any durable sync frontier is mutated. On failure, retries the page without
- * each candidate so valid sibling dependencies remain in the same batch while
- * the update whose removal repairs the batch is attributed exactly.
- */
-export declare function validateDocumentSyncUpdateImports(input: {
-    currentDocument: Awaited<ReturnType<typeof createDocument>>;
-    decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];
-    responseUpdates?: readonly SyncResponseUpdate[] | undefined;
-}): Promise<void>;
-export {};

package/data/documents/shared/documentSyncUpdateIsolation.js

@@ -1,298 +0,0 @@
-import { createDocument, exportFullHistorySnapshot, importSnapshot, importUpdates, LoroImportUnresolvedDependenciesError, updateMatchesDocumentHistory, } from "../../../internal/loro/index.js";
-const MAX_EXACT_ISOLATION_CANDIDATES = 8;
-const MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function optionalHeaderField(update, field) {
-    const header = update?.writeHeader;
-    return header && typeof header === "object"
-        ? Reflect.get(header, field)
-        : undefined;
-}
-function optionalHeaderString(update, field) {
-    const value = optionalHeaderField(update, field);
-    return typeof value === "string" ? value : null;
-}
-function optionalHeaderEpoch(update) {
-    const value = optionalHeaderField(update, "contentKeyEpoch");
-    return typeof value === "number" && Number.isSafeInteger(value)
-        ? value
-        : null;
-}
-export class DocumentSyncUpdateIsolationError extends Error {
-    attribution;
-    authorFingerprint;
-    batchUpdateIds;
-    checkpointKind;
-    ciphertextHash;
-    contentKeyEpoch;
-    documentId;
-    metadataHash;
-    stage;
-    updateId;
-    writerUserId;
-    constructor(input) {
-        const causeMessage = errorMessage(input.cause);
-        const writerUserId = optionalHeaderString(input.responseUpdate, "writerUserId");
-        const author = writerUserId ?? input.responseUpdate?.authorFingerprint ?? "unknown";
-        const fingerprint = input.responseUpdate?.authorFingerprint ?? "unknown";
-        const epoch = optionalHeaderEpoch(input.responseUpdate) ?? "unknown";
-        const batchUpdateIds = input.updateId === null ? (input.batchUpdateIds ?? []) : [];
-        const subject = input.updateId === null
-            ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`
-            : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;
-        super(`Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`, { cause: input.cause });
-        this.name = "DocumentSyncUpdateIsolationError";
-        this.attribution = input.updateId === null ? "batch" : "update";
-        this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;
-        this.batchUpdateIds = [...batchUpdateIds];
-        this.checkpointKind =
-            input.responseUpdate?.checkpointKind === "rotate_baseline"
-                ? "rotate_baseline"
-                : null;
-        this.ciphertextHash = optionalHeaderString(input.responseUpdate, "ciphertextHash");
-        this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);
-        this.documentId = input.responseUpdate?.documentId ?? null;
-        this.metadataHash = optionalHeaderString(input.responseUpdate, "metadataHash");
-        this.stage = input.stage;
-        this.updateId = input.updateId;
-        this.writerUserId = writerUserId;
-    }
-}
-export function isolateDocumentSyncBatchError(input) {
-    return new DocumentSyncUpdateIsolationError({
-        batchUpdateIds: input.updateIds,
-        cause: input.cause,
-        stage: input.stage,
-        updateId: null,
-    });
-}
-export function isolateDocumentSyncUpdateError(input) {
-    return input.cause instanceof DocumentSyncUpdateIsolationError
-        ? input.cause
-        : new DocumentSyncUpdateIsolationError(input);
-}
-export function isDocumentSyncUpdateIsolationError(error) {
-    return error instanceof DocumentSyncUpdateIsolationError;
-}
-function responseUpdatesById(updates) {
-    return new Map((updates ?? []).map((update) => [update.id, update]));
-}
-function firstDuplicateUpdateId(updates) {
-    const seen = new Set();
-    for (const update of updates) {
-        if (seen.has(update.id))
-            return update.id;
-        seen.add(update.id);
-    }
-    return null;
-}
-function assertImportedUpdatesMatchValidatedHistory(input) {
-    const collisions = input.updates.filter((update) => !updateMatchesDocumentHistory(input.document, update.updateData));
-    if (collisions.length === 0)
-        return;
-    const cause = new Error("incoming Loro update reuses an already-covered frontier with different operations");
-    const [collision] = collisions;
-    if (input.updates.length === 1 && collision) {
-        throw isolateDocumentSyncUpdateError({
-            cause,
-            responseUpdate: input.responseById.get(collision.id),
-            stage: "loro_import",
-            updateId: collision.id,
-        });
-    }
-    throw isolateDocumentSyncBatchError({
-        cause,
-        stage: "loro_import",
-        updateIds: input.updates.map((update) => update.id),
-    });
-}
-async function createValidationDocument(snapshot) {
-    const document = await createDocument(crypto.randomUUID());
-    try {
-        importSnapshot(document, snapshot);
-        return document;
-    }
-    catch (error) {
-        document.free();
-        throw error;
-    }
-}
-function splitDocumentSyncUpdates(updates) {
-    const checkpoints = [];
-    const ordinaryUpdates = [];
-    for (const update of updates) {
-        if (update.checkpointKind === "rotate_baseline" &&
-            update.checkpointPayloadKind === "full_history_snapshot") {
-            checkpoints.push(update);
-        }
-        else {
-            ordinaryUpdates.push(update);
-        }
-    }
-    return { checkpoints, ordinaryUpdates };
-}
-/** Applies checkpoints with the snapshot API before batching ordinary deltas. */
-export function importDecryptedDocumentSyncUpdates(document, updates) {
-    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);
-    for (const checkpoint of checkpoints) {
-        importSnapshot(document, checkpoint.updateData);
-    }
-    if (ordinaryUpdates.length > 0) {
-        importUpdates(document, ordinaryUpdates.map((update) => update.updateData));
-    }
-}
-async function validateDecryptedUpdateBatch(input) {
-    const document = await createValidationDocument(input.currentSnapshot);
-    try {
-        const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(input.updates);
-        for (const checkpoint of checkpoints) {
-            importSnapshot(document, checkpoint.updateData);
-        }
-        if (ordinaryUpdates.length > 0) {
-            importUpdates(document, ordinaryUpdates.map((update) => update.updateData));
-        }
-        if (input.responseById) {
-            // Validate against the completed scratch history, not only the live
-            // pre-page frontier. If two updates in this page reuse one peer/counter
-            // with different operations, Loro accepts one and treats the other as a
-            // no-op; only the accepted history can match both when they are equal.
-            assertImportedUpdatesMatchValidatedHistory({
-                document,
-                responseById: input.responseById,
-                updates: input.updates,
-            });
-        }
-    }
-    finally {
-        document.free();
-    }
-}
-function exactIsolationRetryExceedsBudget(input) {
-    if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES)
-        return true;
-    let retryBytes = 0;
-    for (const candidateIndex of input.candidates.keys()) {
-        if (input.currentSnapshot.byteLength >
-            MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes) {
-            return true;
-        }
-        retryBytes += input.currentSnapshot.byteLength;
-        for (const [updateIndex, update] of input.candidates.entries()) {
-            if (updateIndex === candidateIndex)
-                continue;
-            if (update.updateData.byteLength >
-                MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes) {
-                return true;
-            }
-            retryBytes += update.updateData.byteLength;
-        }
-    }
-    return false;
-}
-/** @internal Exported only to exercise the bounded exact-attribution policy. */
-export async function findUniqueRepairingCandidate(candidates, repairsBatch) {
-    let repairingCandidate = null;
-    let repairingCandidateCount = 0;
-    for (const [candidateIndex, candidate] of candidates.entries()) {
-        if (await repairsBatch(candidate, candidateIndex)) {
-            repairingCandidate = candidate;
-            repairingCandidateCount += 1;
-        }
-    }
-    return repairingCandidateCount === 1 ? repairingCandidate : null;
-}
-/**
- * Proves that a decrypted response can be imported before the live document or
- * any durable sync frontier is mutated. On failure, retries the page without
- * each candidate so valid sibling dependencies remain in the same batch while
- * the update whose removal repairs the batch is attributed exactly.
- */
-export async function validateDocumentSyncUpdateImports(input) {
-    if (input.decryptedUpdates.length === 0)
-        return;
-    const duplicateUpdateId = firstDuplicateUpdateId(input.decryptedUpdates) ??
-        firstDuplicateUpdateId(input.responseUpdates ?? []);
-    if (duplicateUpdateId !== null) {
-        throw isolateDocumentSyncBatchError({
-            cause: new Error(`Document sync response update id is duplicated: ${duplicateUpdateId}`),
-            stage: "encrypted_record",
-            updateIds: (input.responseUpdates ?? input.decryptedUpdates).map((update) => update.id),
-        });
-    }
-    const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);
-    const responseById = responseUpdatesById(input.responseUpdates);
-    let batchError;
-    try {
-        await validateDecryptedUpdateBatch({
-            currentSnapshot,
-            responseById,
-            updates: input.decryptedUpdates,
-        });
-        return;
-    }
-    catch (error) {
-        if (isDocumentSyncUpdateIsolationError(error))
-            throw error;
-        batchError = error;
-    }
-    // A delta can be valid but depend on a parent omitted from this response
-    // page. Removing that delta would make an empty retry succeed and falsely
-    // identify its authenticated writer as poison, so dependency gaps remain
-    // anonymous at batch scope.
-    if (batchError instanceof LoroImportUnresolvedDependenciesError) {
-        throw isolateDocumentSyncBatchError({
-            cause: batchError,
-            stage: "loro_import",
-            updateIds: input.decryptedUpdates.map((update) => update.id),
-        });
-    }
-    if (exactIsolationRetryExceedsBudget({
-        candidates: input.decryptedUpdates,
-        currentSnapshot,
-    })) {
-        throw isolateDocumentSyncBatchError({
-            cause: batchError,
-            stage: "loro_import",
-            updateIds: input.decryptedUpdates.map((update) => update.id),
-        });
-    }
-    // Rebuild from the same immutable snapshot for every candidate: a failed
-    // import may partially mutate its scratch document. Checkpoints participate
-    // alongside ordinary updates so an incompatibility between the two kinds
-    // cannot falsely blame the ordinary writer. Keeping every other update in
-    // one batch also preserves out-of-order sibling dependencies.
-    const isolatedUpdate = await findUniqueRepairingCandidate(input.decryptedUpdates, async (_update, candidateIndex) => {
-        const withoutCandidate = input.decryptedUpdates.filter((_, updateIndex) => updateIndex !== candidateIndex);
-        try {
-            await validateDecryptedUpdateBatch({
-                currentSnapshot,
-                updates: withoutCandidate,
-            });
-            return true;
-        }
-        catch {
-            // This candidate is either valid and required by a sibling, or another
-            // poison update remains. Continue without attributing it.
-            return false;
-        }
-    });
-    if (isolatedUpdate) {
-        throw isolateDocumentSyncUpdateError({
-            cause: batchError,
-            responseUpdate: responseById.get(isolatedUpdate.id),
-            stage: "loro_import",
-            updateId: isolatedUpdate.id,
-        });
-    }
-    // Multiple bad updates or a batch-level incompatibility may have zero or
-    // multiple removals that repair the page. Fail closed without falsely naming
-    // a valid writer; no live or durable state has changed.
-    throw isolateDocumentSyncBatchError({
-        cause: batchError,
-        stage: "loro_import",
-        updateIds: input.decryptedUpdates.map((update) => update.id),
-    });
-}
-//# sourceMappingURL=documentSyncUpdateIsolation.js.map

package/data/documents/shared/documentSyncUpdateIsolation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentSyncUpdateIsolation.js","sourceRoot":"","sources":["documentSyncUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAMxD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsC,EACtC,KAAa;IAEb,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC;IAEtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,WAAW,CAAqB;IAChC,iBAAiB,CAAgB;IACjC,cAAc,CAAoB;IAClC,cAAc,CAA2B;IACzC,cAAc,CAAgB;IAC9B,eAAe,CAAgB;IAC/B,UAAU,CAAgB;IAC1B,YAAY,CAAgB;IAC5B,KAAK,CAAmC;IACxC,QAAQ,CAAgB;IACxB,YAAY,CAAgB;IAErC,YAAY,KAMX;QACC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,oBAAoB,CACvC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,MAAM,MAAM,GACV,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,6BAA6B,cAAc,CAAC,MAAM,2CAA2C;YAC/F,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,gBAAgB,MAAM,iBAAiB,WAAW,WAAW,KAAK,GAAG,CAAC;QACpG,KAAK,CACH,6BAA6B,OAAO,WAAW,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc;YACjB,KAAK,CAAC,cAAc,EAAE,cAAc,KAAK,iBAAiB;gBACxD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc,GAAG,oBAAoB,CACxC,KAAK,CAAC,cAAc,EACpB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,oBAAoB,CACtC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,IAAI,gCAAgC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,OAAO,KAAK,CAAC,KAAK,YAAY,gCAAgC;QAC5D,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,OAAO,KAAK,YAAY,gCAAgC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkD;IAElD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CACnE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mFAAmF,CACpF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,8BAA8B,CAAC;YACnC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA+C;IAK/C,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC3C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB,EACxD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAAsB,EACtB,OAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAC/D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,0CAA0C,CAAC;gBACzC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,IACE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChC,+BAA+B,GAAG,UAAU,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,WAAW,KAAK,cAAc;gBAAE,SAAS;YAC7C,IACE,MAAM,CAAC,UAAU,CAAC,UAAU;gBAC5B,+BAA+B,GAAG,UAAU,EAC5C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwB,EACxB,YAAwE;IAExE,IAAI,kBAAkB,GAAa,IAAI,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;YAClD,kBAAkB,GAAG,SAAS,CAAC;YAC/B,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhD,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C,sBAAsB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CACd,mDAAmD,iBAAiB,EAAE,CACvE;YACD,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,eAAe;YACf,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,gBAAgB;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kCAAkC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,UAAU,YAAY,qCAAqC,EAAE,CAAC;QAChE,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IACE,gCAAgC,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,eAAe;KAChB,CAAC,EACF,CAAC;QACD,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,KAAK,CAAC,gBAAgB,EACtB,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc,CACnD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,4BAA4B,CAAC;gBACjC,eAAe;gBACf,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,cAAc,CAAC,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createDocument,\n  exportFullHistorySnapshot,\n  importSnapshot,\n  importUpdates,\n  LoroImportUnresolvedDependenciesError,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type {\n  DecryptedDocumentSyncUpdate,\n  SyncRemoteDocumentResult,\n} from \"./types\";\n\ntype DocumentSyncUpdateIsolationStage =\n  | \"content_key\"\n  | \"decrypt\"\n  | \"encrypted_record\"\n  | \"loro_import\"\n  | \"loro_metadata\"\n  | \"plaintext_integrity\"\n  | \"write_header\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype SyncDocument = Awaited<ReturnType<typeof createDocument>>;\n\nconst MAX_EXACT_ISOLATION_CANDIDATES = 8;\nconst MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;\n\nexport type IncomingDocumentSyncUpdateValidator = (\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n) => void | Promise<void>;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction optionalHeaderField(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): unknown {\n  const header = update?.writeHeader;\n  return header && typeof header === \"object\"\n    ? Reflect.get(header, field)\n    : undefined;\n}\n\nfunction optionalHeaderString(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): string | null {\n  const value = optionalHeaderField(update, field);\n  return typeof value === \"string\" ? value : null;\n}\n\nfunction optionalHeaderEpoch(\n  update: SyncResponseUpdate | undefined,\n): number | null {\n  const value = optionalHeaderField(update, \"contentKeyEpoch\");\n  return typeof value === \"number\" && Number.isSafeInteger(value)\n    ? value\n    : null;\n}\n\nexport class DocumentSyncUpdateIsolationError extends Error {\n  readonly attribution: \"batch\" | \"update\";\n  readonly authorFingerprint: string | null;\n  readonly batchUpdateIds: readonly string[];\n  readonly checkpointKind: \"rotate_baseline\" | null;\n  readonly ciphertextHash: string | null;\n  readonly contentKeyEpoch: number | null;\n  readonly documentId: string | null;\n  readonly metadataHash: string | null;\n  readonly stage: DocumentSyncUpdateIsolationStage;\n  readonly updateId: string | null;\n  readonly writerUserId: string | null;\n\n  constructor(input: {\n    batchUpdateIds?: readonly string[] | undefined;\n    cause: unknown;\n    responseUpdate?: SyncResponseUpdate | undefined;\n    stage: DocumentSyncUpdateIsolationStage;\n    updateId: string | null;\n  }) {\n    const causeMessage = errorMessage(input.cause);\n    const writerUserId = optionalHeaderString(\n      input.responseUpdate,\n      \"writerUserId\",\n    );\n    const author =\n      writerUserId ?? input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const fingerprint = input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const epoch = optionalHeaderEpoch(input.responseUpdate) ?? \"unknown\";\n    const batchUpdateIds =\n      input.updateId === null ? (input.batchUpdateIds ?? []) : [];\n    const subject =\n      input.updateId === null\n        ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`\n        : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;\n    super(\n      `Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`,\n      { cause: input.cause },\n    );\n    this.name = \"DocumentSyncUpdateIsolationError\";\n    this.attribution = input.updateId === null ? \"batch\" : \"update\";\n    this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;\n    this.batchUpdateIds = [...batchUpdateIds];\n    this.checkpointKind =\n      input.responseUpdate?.checkpointKind === \"rotate_baseline\"\n        ? \"rotate_baseline\"\n        : null;\n    this.ciphertextHash = optionalHeaderString(\n      input.responseUpdate,\n      \"ciphertextHash\",\n    );\n    this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);\n    this.documentId = input.responseUpdate?.documentId ?? null;\n    this.metadataHash = optionalHeaderString(\n      input.responseUpdate,\n      \"metadataHash\",\n    );\n    this.stage = input.stage;\n    this.updateId = input.updateId;\n    this.writerUserId = writerUserId;\n  }\n}\n\nexport function isolateDocumentSyncBatchError(input: {\n  cause: unknown;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateIds: readonly string[];\n}): DocumentSyncUpdateIsolationError {\n  return new DocumentSyncUpdateIsolationError({\n    batchUpdateIds: input.updateIds,\n    cause: input.cause,\n    stage: input.stage,\n    updateId: null,\n  });\n}\n\nexport function isolateDocumentSyncUpdateError(input: {\n  cause: unknown;\n  responseUpdate?: SyncResponseUpdate | undefined;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateId: string;\n}): DocumentSyncUpdateIsolationError {\n  return input.cause instanceof DocumentSyncUpdateIsolationError\n    ? input.cause\n    : new DocumentSyncUpdateIsolationError(input);\n}\n\nexport function isDocumentSyncUpdateIsolationError(\n  error: unknown,\n): error is DocumentSyncUpdateIsolationError {\n  return error instanceof DocumentSyncUpdateIsolationError;\n}\n\nfunction responseUpdatesById(\n  updates: readonly SyncResponseUpdate[] | undefined,\n): ReadonlyMap<string, SyncResponseUpdate> {\n  return new Map((updates ?? []).map((update) => [update.id, update]));\n}\n\nfunction firstDuplicateUpdateId(\n  updates: readonly { readonly id: string }[],\n): string | null {\n  const seen = new Set<string>();\n  for (const update of updates) {\n    if (seen.has(update.id)) return update.id;\n    seen.add(update.id);\n  }\n  return null;\n}\n\nfunction assertImportedUpdatesMatchValidatedHistory(input: {\n  document: SyncDocument;\n  responseById: ReadonlyMap<string, SyncResponseUpdate>;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): void {\n  const collisions = input.updates.filter(\n    (update) =>\n      !updateMatchesDocumentHistory(input.document, update.updateData),\n  );\n  if (collisions.length === 0) return;\n  const cause = new Error(\n    \"incoming Loro update reuses an already-covered frontier with different operations\",\n  );\n  const [collision] = collisions;\n  if (input.updates.length === 1 && collision) {\n    throw isolateDocumentSyncUpdateError({\n      cause,\n      responseUpdate: input.responseById.get(collision.id),\n      stage: \"loro_import\",\n      updateId: collision.id,\n    });\n  }\n  throw isolateDocumentSyncBatchError({\n    cause,\n    stage: \"loro_import\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nasync function createValidationDocument(snapshot: Uint8Array) {\n  const document = await createDocument(crypto.randomUUID());\n  try {\n    importSnapshot(document, snapshot);\n    return document;\n  } catch (error) {\n    document.free();\n    throw error;\n  }\n}\n\nfunction splitDocumentSyncUpdates(\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): {\n  checkpoints: DecryptedDocumentSyncUpdate[];\n  ordinaryUpdates: DecryptedDocumentSyncUpdate[];\n} {\n  const checkpoints: DecryptedDocumentSyncUpdate[] = [];\n  const ordinaryUpdates: DecryptedDocumentSyncUpdate[] = [];\n  for (const update of updates) {\n    if (\n      update.checkpointKind === \"rotate_baseline\" &&\n      update.checkpointPayloadKind === \"full_history_snapshot\"\n    ) {\n      checkpoints.push(update);\n    } else {\n      ordinaryUpdates.push(update);\n    }\n  }\n  return { checkpoints, ordinaryUpdates };\n}\n\n/** Applies checkpoints with the snapshot API before batching ordinary deltas. */\nexport function importDecryptedDocumentSyncUpdates(\n  document: SyncDocument,\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): void {\n  const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);\n  for (const checkpoint of checkpoints) {\n    importSnapshot(document, checkpoint.updateData);\n  }\n  if (ordinaryUpdates.length > 0) {\n    importUpdates(\n      document,\n      ordinaryUpdates.map((update) => update.updateData),\n    );\n  }\n}\n\nasync function validateDecryptedUpdateBatch(input: {\n  currentSnapshot: Uint8Array;\n  responseById?: ReadonlyMap<string, SyncResponseUpdate> | undefined;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): Promise<void> {\n  const document = await createValidationDocument(input.currentSnapshot);\n  try {\n    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(\n      input.updates,\n    );\n    for (const checkpoint of checkpoints) {\n      importSnapshot(document, checkpoint.updateData);\n    }\n    if (ordinaryUpdates.length > 0) {\n      importUpdates(\n        document,\n        ordinaryUpdates.map((update) => update.updateData),\n      );\n    }\n    if (input.responseById) {\n      // Validate against the completed scratch history, not only the live\n      // pre-page frontier. If two updates in this page reuse one peer/counter\n      // with different operations, Loro accepts one and treats the other as a\n      // no-op; only the accepted history can match both when they are equal.\n      assertImportedUpdatesMatchValidatedHistory({\n        document,\n        responseById: input.responseById,\n        updates: input.updates,\n      });\n    }\n  } finally {\n    document.free();\n  }\n}\n\nfunction exactIsolationRetryExceedsBudget(input: {\n  candidates: readonly DecryptedDocumentSyncUpdate[];\n  currentSnapshot: Uint8Array;\n}): boolean {\n  if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES) return true;\n\n  let retryBytes = 0;\n  for (const candidateIndex of input.candidates.keys()) {\n    if (\n      input.currentSnapshot.byteLength >\n      MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n    ) {\n      return true;\n    }\n    retryBytes += input.currentSnapshot.byteLength;\n    for (const [updateIndex, update] of input.candidates.entries()) {\n      if (updateIndex === candidateIndex) continue;\n      if (\n        update.updateData.byteLength >\n        MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n      ) {\n        return true;\n      }\n      retryBytes += update.updateData.byteLength;\n    }\n  }\n  return false;\n}\n\n/** @internal Exported only to exercise the bounded exact-attribution policy. */\nexport async function findUniqueRepairingCandidate<T>(\n  candidates: readonly T[],\n  repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>,\n): Promise<T | null> {\n  let repairingCandidate: T | null = null;\n  let repairingCandidateCount = 0;\n  for (const [candidateIndex, candidate] of candidates.entries()) {\n    if (await repairsBatch(candidate, candidateIndex)) {\n      repairingCandidate = candidate;\n      repairingCandidateCount += 1;\n    }\n  }\n  return repairingCandidateCount === 1 ? repairingCandidate : null;\n}\n\n/**\n * Proves that a decrypted response can be imported before the live document or\n * any durable sync frontier is mutated. On failure, retries the page without\n * each candidate so valid sibling dependencies remain in the same batch while\n * the update whose removal repairs the batch is attributed exactly.\n */\nexport async function validateDocumentSyncUpdateImports(input: {\n  currentDocument: Awaited<ReturnType<typeof createDocument>>;\n  decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];\n  responseUpdates?: readonly SyncResponseUpdate[] | undefined;\n}): Promise<void> {\n  if (input.decryptedUpdates.length === 0) return;\n\n  const duplicateUpdateId =\n    firstDuplicateUpdateId(input.decryptedUpdates) ??\n    firstDuplicateUpdateId(input.responseUpdates ?? []);\n  if (duplicateUpdateId !== null) {\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\n        `Document sync response update id is duplicated: ${duplicateUpdateId}`,\n      ),\n      stage: \"encrypted_record\",\n      updateIds: (input.responseUpdates ?? input.decryptedUpdates).map(\n        (update) => update.id,\n      ),\n    });\n  }\n\n  const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);\n  const responseById = responseUpdatesById(input.responseUpdates);\n  let batchError: unknown;\n  try {\n    await validateDecryptedUpdateBatch({\n      currentSnapshot,\n      responseById,\n      updates: input.decryptedUpdates,\n    });\n    return;\n  } catch (error) {\n    if (isDocumentSyncUpdateIsolationError(error)) throw error;\n    batchError = error;\n  }\n\n  // A delta can be valid but depend on a parent omitted from this response\n  // page. Removing that delta would make an empty retry succeed and falsely\n  // identify its authenticated writer as poison, so dependency gaps remain\n  // anonymous at batch scope.\n  if (batchError instanceof LoroImportUnresolvedDependenciesError) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  if (\n    exactIsolationRetryExceedsBudget({\n      candidates: input.decryptedUpdates,\n      currentSnapshot,\n    })\n  ) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  // Rebuild from the same immutable snapshot for every candidate: a failed\n  // import may partially mutate its scratch document. Checkpoints participate\n  // alongside ordinary updates so an incompatibility between the two kinds\n  // cannot falsely blame the ordinary writer. Keeping every other update in\n  // one batch also preserves out-of-order sibling dependencies.\n  const isolatedUpdate = await findUniqueRepairingCandidate(\n    input.decryptedUpdates,\n    async (_update, candidateIndex) => {\n      const withoutCandidate = input.decryptedUpdates.filter(\n        (_, updateIndex) => updateIndex !== candidateIndex,\n      );\n      try {\n        await validateDecryptedUpdateBatch({\n          currentSnapshot,\n          updates: withoutCandidate,\n        });\n        return true;\n      } catch {\n        // This candidate is either valid and required by a sibling, or another\n        // poison update remains. Continue without attributing it.\n        return false;\n      }\n    },\n  );\n  if (isolatedUpdate) {\n    throw isolateDocumentSyncUpdateError({\n      cause: batchError,\n      responseUpdate: responseById.get(isolatedUpdate.id),\n      stage: \"loro_import\",\n      updateId: isolatedUpdate.id,\n    });\n  }\n\n  // Multiple bad updates or a batch-level incompatibility may have zero or\n  // multiple removals that repair the page. Fail closed without falsely naming\n  // a valid writer; no live or durable state has changed.\n  throw isolateDocumentSyncBatchError({\n    cause: batchError,\n    stage: \"loro_import\",\n    updateIds: input.decryptedUpdates.map((update) => update.id),\n  });\n}\n"]}

package/data/documents/shared/keyringLogWalk.d.ts

@@ -1,45 +0,0 @@
-import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-import type { ContainerKekLogEpochResponse } from "../../../internal/validators/response/index.js";
-/**
- * A whole rotation log assembled from pages. Distinct from the wire type,
- * which describes ONE bounded page and rejects more epochs than a page may
- * carry — an aggregate legitimately exceeds that.
- */
-export interface AggregatedContainerKekLog {
-    readonly containerId: string;
-    readonly epochs: ContainerKekLogEpochResponse[];
-}
-export interface KeyringRebuildResult {
-    /** Recovered entries in ascending epoch order, gaps omitted. */
-    readonly entries: ContainerKekKeyringEntry[];
-    /**
-     * Epoch ids the log could not reach — a severed bridge below them with no
-     * anchor supplied. A repair is only complete when this is empty; each id
-     * here is recoverable through `recoverKeyringEntryFromWraps` and can be
-     * fed back as an anchor.
-     */
-    readonly missingEpochIds: string[];
-}
-/**
- * Rebuilds the container's keyring entries from the append-only bridge log —
- * the recovery path when a served keyring fails verification. Each link was
- * written once by the rotator that provably held both keys, so the walk
- * depends only on server-persisted state plus the current KEK; every
- * recovered key is checked against the material-id commitment its epoch id
- * carries.
- *
- * A severed bridge does not abort the walk. Recovery resumes below the gap
- * from any `anchorKeysByEpochId` entry the caller wrap-recovered, so a
- * multi-epoch history with a damaged middle link is rebuilt segment by
- * segment rather than lost wholesale. Unreachable epochs are reported in
- * `missingEpochIds` instead of throwing, because a partial rebuild plus a
- * named gap is strictly more useful to a repair than an exception.
- */
-export declare function rebuildKeyringEntriesFromLog(input: {
-    /** Wrap-recovered keys that re-anchor the walk below a severed bridge. */
-    anchorKeysByEpochId?: ReadonlyMap<string, Uint8Array> | undefined;
-    containerId: string;
-    currentContainerKey: Uint8Array;
-    currentContainerKeyEpochId: string;
-    log: AggregatedContainerKekLog;
-}): Promise<KeyringRebuildResult>;