@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/keyringLogWalk.js

@@ -1,204 +0,0 @@
-import { computeContainerKekMaterialId, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, openContainerKekKeyring, unwrapContainerKekPredecessorBridge, } from "../../../internal/crypto/index.js";
-/**
- * Recovers a predecessor key through one bridge, or null when the link is
- * absent, malformed, undecryptable, or decrypts to material that contradicts
- * the epoch id's commitment. The commitment check lives HERE, before the
- * caller's anchor fallback, so a lying link can never mask a valid anchor.
- */
-async function keyFromBridge(input) {
-    if (input.epoch.bridge === null) {
-        return null;
-    }
-    let key;
-    try {
-        const bridge = normalizeContainerKekPredecessorBridge(input.epoch.bridge);
-        if (bridge.containerId !== input.containerId ||
-            bridge.successorContainerKeyEpochId !== input.epoch.containerKeyEpochId ||
-            bridge.predecessorContainerKeyEpochId !==
-                input.predecessor.containerKeyEpochId) {
-            return null;
-        }
-        key = await unwrapContainerKekPredecessorBridge({
-            bridge,
-            successorContainerKey: input.successorKey,
-        });
-    }
-    catch {
-        return null;
-    }
-    const bridgedId = await computeContainerKekMaterialId({
-        containerId: input.containerId,
-        keyEpoch: input.predecessor.containerKeyEpoch,
-        keyMaterial: key,
-    });
-    return bridgedId === input.predecessor.containerKeyEpochId ? key : null;
-}
-/**
- * Harvests one epoch's served keyring, given that epoch's key, recording every
- * epoch it seals. This is the rung of the recovery ladder that crosses MORE
- * THAN ONE severed bridge: the bridge walk can only step over a gap it holds
- * an anchor for, while a keyring supplies the entire history beneath its epoch
- * in a single decrypt.
- *
- * It is called for each epoch as that epoch BECOMES reachable — from the
- * current key at the head, from a caller-supplied anchor, or from a key the
- * bridge walk itself just recovered — because a keyring sitting below an
- * intact prefix is only openable once the walk has descended to it. A one-shot
- * pre-pass would miss exactly those.
- *
- * Each recovered entry must match the material-id commitment carried by the
- * epoch id it claims, so a forged keyring contributes nothing. Failures are
- * silent: this accelerates recovery, and the bridge walk remains the
- * correctness-bearing path.
- */
-async function harvestServedKeyring(input) {
-    if (input.epoch.keyring === null) {
-        return;
-    }
-    let entries;
-    try {
-        entries = await openContainerKekKeyring({
-            keyEpoch: input.epoch.containerKeyEpoch,
-            keyring: normalizeContainerKekKeyring(input.epoch.keyring),
-            successorContainerKey: input.epochKey,
-        });
-    }
-    catch {
-        return;
-    }
-    for (const entry of entries) {
-        const sealed = input.epochById.get(entry.containerKeyEpochId);
-        if (!sealed || input.recovered.has(entry.containerKeyEpochId)) {
-            continue;
-        }
-        const materialId = await computeContainerKekMaterialId({
-            containerId: input.containerId,
-            keyEpoch: sealed.containerKeyEpoch,
-            keyMaterial: entry.keyMaterial,
-        });
-        if (materialId === entry.containerKeyEpochId) {
-            input.recovered.set(entry.containerKeyEpochId, entry.keyMaterial);
-        }
-    }
-}
-/**
- * The log's epochs in ascending order, once it is established that they are a
- * complete history for this container: same container, rooted at epoch 1, and
- * ending at the caller's current epoch. A rebuild that started mid-history
- * would silently report the epochs below its start as unreachable, so the
- * shape is checked up front rather than inferred from a thin result.
- */
-async function sortedCompleteLogEpochs(input) {
-    if (input.log.containerId !== input.containerId) {
-        throw new Error("Container KEK log container is inconsistent");
-    }
-    const epochs = [...input.log.epochs].sort((left, right) => left.containerKeyEpoch - right.containerKeyEpoch);
-    const genesis = epochs[0];
-    const tail = epochs.at(-1);
-    if (genesis?.containerKeyEpoch !== 1) {
-        throw new Error("Container KEK log does not start at epoch 1");
-    }
-    if (!tail || tail.containerKeyEpochId !== input.currentContainerKeyEpochId) {
-        throw new Error("Container KEK log does not end at the current epoch");
-    }
-    if ((await computeContainerKekMaterialId({
-        containerId: input.containerId,
-        keyEpoch: tail.containerKeyEpoch,
-        keyMaterial: input.currentContainerKey,
-    })) !== input.currentContainerKeyEpochId) {
-        throw new Error("Container KEK log current key material does not match its epoch");
-    }
-    return epochs;
-}
-/**
- * Rebuilds the container's keyring entries from the append-only bridge log —
- * the recovery path when a served keyring fails verification. Each link was
- * written once by the rotator that provably held both keys, so the walk
- * depends only on server-persisted state plus the current KEK; every
- * recovered key is checked against the material-id commitment its epoch id
- * carries.
- *
- * A severed bridge does not abort the walk. Recovery resumes below the gap
- * from any `anchorKeysByEpochId` entry the caller wrap-recovered, so a
- * multi-epoch history with a damaged middle link is rebuilt segment by
- * segment rather than lost wholesale. Unreachable epochs are reported in
- * `missingEpochIds` instead of throwing, because a partial rebuild plus a
- * named gap is strictly more useful to a repair than an exception.
- */
-export async function rebuildKeyringEntriesFromLog(input) {
-    const epochs = await sortedCompleteLogEpochs(input);
-    const anchors = input.anchorKeysByEpochId ?? new Map();
-    const recovered = new Map();
-    const missingEpochIds = [];
-    let successorKey = input.currentContainerKey;
-    const epochById = new Map(epochs.map((epoch) => [epoch.containerKeyEpochId, epoch]));
-    for (let index = epochs.length - 1; index >= 1; index -= 1) {
-        const epoch = epochs[index];
-        const predecessor = epochs[index - 1];
-        if (!epoch ||
-            !predecessor ||
-            epoch.containerKeyEpoch !== predecessor.containerKeyEpoch + 1) {
-            throw new Error("Container KEK log is not contiguous");
-        }
-        // Harvest this epoch's keyring the moment the epoch is reachable — from
-        // the current key at the head, an anchor, or a key the walk just
-        // recovered. Doing it here rather than in a pre-pass is what lets a
-        // keyring BELOW an intact prefix repair severed bridges under itself.
-        const epochKey = successorKey ??
-            recovered.get(epoch.containerKeyEpochId) ??
-            anchors.get(epoch.containerKeyEpochId) ??
-            null;
-        if (epochKey) {
-            await harvestServedKeyring({
-                containerId: input.containerId,
-                epoch,
-                epochById,
-                epochKey,
-                recovered,
-            });
-        }
-        // Severed, poisoned, or lying links all degrade to "no key from the
-        // bridge"; the walk then picks back up from a wrap-recovered anchor if
-        // the caller supplied one, so only truly unreachable epochs are lost.
-        let predecessorKey = epochKey === null
-            ? null
-            : await keyFromBridge({
-                containerId: input.containerId,
-                epoch,
-                predecessor,
-                successorKey: epochKey,
-            });
-        predecessorKey ??= recovered.get(predecessor.containerKeyEpochId) ?? null;
-        predecessorKey ??= anchors.get(predecessor.containerKeyEpochId) ?? null;
-        if (predecessorKey === null) {
-            missingEpochIds.push(predecessor.containerKeyEpochId);
-            successorKey = null;
-            continue;
-        }
-        const expectedId = await computeContainerKekMaterialId({
-            containerId: input.containerId,
-            keyEpoch: predecessor.containerKeyEpoch,
-            keyMaterial: predecessorKey,
-        });
-        if (expectedId !== predecessor.containerKeyEpochId) {
-            // Only reachable when a supplied anchor is itself wrong.
-            missingEpochIds.push(predecessor.containerKeyEpochId);
-            successorKey = null;
-            continue;
-        }
-        recovered.set(predecessor.containerKeyEpochId, predecessorKey);
-        successorKey = predecessorKey;
-    }
-    const entries = [];
-    for (const epoch of epochs.slice(0, -1)) {
-        const keyMaterial = recovered.get(epoch.containerKeyEpochId);
-        if (keyMaterial) {
-            entries.push({
-                containerKeyEpochId: epoch.containerKeyEpochId,
-                keyMaterial,
-            });
-        }
-    }
-    return { entries, missingEpochIds: missingEpochIds.reverse() };
-}
-//# sourceMappingURL=keyringLogWalk.js.map

package/data/documents/shared/keyringRebuild.d.ts

@@ -1,60 +0,0 @@
-import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-import type { ContainerKekLogEpochResponse } from "../../../internal/validators/response/index.js";
-import type { ExecSql } from "../../sqlite/sqlSchema.js";
-/**
- * Raised when the requester holds no envelope they can open for a historical
- * epoch. Distinct from corruption: the log is intact, the caller simply is
- * not an anchor for this epoch.
- */
-export type HistoricalWrapUnavailableReason = 
-/** No envelope at this epoch is addressed to the requester at all. */
-"no-addressed-envelope"
-/** A direct user envelope exists for the requester but did not open. */
- | "corrupt-envelope"
-/** Only principal-addressed envelopes, whose key epoch is unreachable. */
- | "principal-key-unreachable"
-/** Only a parent-container envelope, and the parent KEK was not supplied. */
- | "parent-key-unavailable";
-export declare class HistoricalWrapUnavailableError extends Error {
-    readonly containerKeyEpoch: number;
-    readonly reason: HistoricalWrapUnavailableReason;
-    constructor(containerKeyEpoch: number, reason: HistoricalWrapUnavailableReason, cause?: unknown);
-}
-/**
- * The severed-bridge backstop: recovers one historical epoch's KEK from the
- * requester's own retained recipient envelope served in the kek-log. Wraps
- * are written by that epoch's rotator and never deleted, so this path is
- * independent of every later rotation — it works even when the bridge chain
- * above the epoch is destroyed. The recovered key is verified against the
- * epoch id's material commitment before use.
- *
- * Scope bound: a direct user envelope is recoverable from identity keys
- * alone, so a pristine client anchors on it. A group- or organization-
- * addressed envelope additionally requires the current principal secret key.
- * Principal rotation rematerializes every retained container grant against
- * the new principal head, so a current reader never needs an older principal
- * key to use this recovery path. Unreachable principal keys fail closed with
- * `HistoricalWrapUnavailableError` rather than appearing to be corruption.
- */
-export declare function recoverKeyringEntryFromWraps(input: {
-    containerId: string;
-    epoch: Pick<ContainerKekLogEpochResponse, "containerKeyEpoch" | "containerKeyEpochId" | "wraps">;
-    execSql?: ExecSql | undefined;
-    secretKey: Uint8Array;
-    /**
-     * Parent container KEKs by epoch id. An inherited-only child has no direct
-     * or principal envelope of its own; its anchor is the parent-container
-     * wrap, which opens under the parent epoch's KEK. Recover the parent's
-     * epoch first (recursively, through the parent's own log) and pass it here.
-     */
-    parentKeysByEpochId?: ReadonlyMap<string, Uint8Array> | undefined;
-    /**
-     * The requester's user id. Direct user envelopes are matched against it, so
-     * another member's envelope is never mistaken for an anchor — attempting it
-     * would only produce a misleading failure.
-     */
-    userId: string;
-}): Promise<ContainerKekKeyringEntry>;
-export { fetchContainerKekLog } from "./containerKekLogFetch.js";
-export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "./keyringLogWalk.js";
-export { rebuildKeyringEntriesFromLog } from "./keyringLogWalk.js";

package/data/documents/shared/keyringRebuild.js

@@ -1,242 +0,0 @@
-import { computeContainerKekMaterialId, unwrapContainerKekParentWrap, } from "../../../internal/crypto/index.js";
-import { unwrapKeyEnvelopesWithPrincipalPolicies } from "../../principals/principalPolicyCrypto.js";
-import { normalizeContainerKeyWrap } from "./readers.js";
-/**
- * Splits an epoch's envelopes into the anchor kinds this requester could use:
- * their own direct envelope, principal envelopes their policies may resolve,
- * and parent-container envelopes. Anything else is not an identity anchor and
- * is dropped, so it never produces a misleading failure.
- */
-function partitionAnchorWraps(wraps, containerKeyEpochId, userId) {
-    const forEpoch = wraps
-        .map((wrap) => normalizeContainerKeyWrap(wrap))
-        .filter((wrap) => wrap.containerKeyEpochId === containerKeyEpochId);
-    const directWraps = forEpoch.filter((wrap) => wrap.recipientKind === "user" && wrap.recipientId === userId);
-    const principalWraps = forEpoch.filter((wrap) => wrap.recipientKind === "group");
-    const parentWraps = forEpoch.filter((wrap) => wrap.recipientKind === "container");
-    return {
-        directWraps,
-        epochWraps: [...directWraps, ...principalWraps, ...parentWraps],
-        parentWraps,
-        principalWraps,
-    };
-}
-/**
- * Opens the first parent-container envelope whose parent epoch key the caller
- * supplied. Reports whether any key was available, so a missing parent key is
- * distinguishable from a corrupt envelope.
- */
-async function openParentAnchor(parentWraps, parentKeys) {
-    let failure;
-    let keyWasAvailable = false;
-    for (const wrap of parentWraps) {
-        const parentKey = parentKeys.get(wrap.recipientKeyEpochId);
-        if (!parentKey) {
-            continue;
-        }
-        keyWasAvailable = true;
-        try {
-            return {
-                failure: undefined,
-                key: await unwrapContainerKekParentWrap({
-                    parentContainerId: wrap.recipientId,
-                    parentKeyMaterial: parentKey,
-                    kemCipherText: wrap.kemCipherText,
-                    wrappedKey: wrap.wrappedKey,
-                }),
-                keyWasAvailable,
-            };
-        }
-        catch (error) {
-            failure = error;
-        }
-    }
-    return { failure, key: null, keyWasAvailable };
-}
-/**
- * Every anchor kind was tried; report the most specific reason. A wrap that
- * was actually attempted and failed is corruption; one that could not be
- * attempted names the key that was missing.
- */
-function throwMostSpecificAnchorFailure(input) {
-    if (input.directFailure !== undefined || input.parentFailure !== undefined) {
-        throw new HistoricalWrapUnavailableError(input.containerKeyEpoch, "corrupt-envelope", input.directFailure ?? input.parentFailure);
-    }
-    if (input.principalFailure !== undefined) {
-        throw new HistoricalWrapUnavailableError(input.containerKeyEpoch, "principal-key-unreachable", input.principalFailure);
-    }
-    throw new HistoricalWrapUnavailableError(input.containerKeyEpoch, input.hadParentWraps && !input.parentKeyWasAvailable
-        ? "parent-key-unavailable"
-        : "no-addressed-envelope");
-}
-const HISTORICAL_WRAP_UNAVAILABLE_MESSAGES = {
-    "no-addressed-envelope": (epoch) => `Container KEK log has no envelope addressed to this requester at epoch ${epoch}`,
-    "corrupt-envelope": (epoch) => `Container KEK log envelope for this requester at epoch ${epoch} could not be opened`,
-    "principal-key-unreachable": (epoch) => `Container KEK log envelope at epoch ${epoch} is addressed to a principal key epoch this client cannot resolve`,
-    "parent-key-unavailable": (epoch) => `Container KEK log envelope at epoch ${epoch} is inherited from a parent container whose KEK was not supplied`,
-};
-export class HistoricalWrapUnavailableError extends Error {
-    containerKeyEpoch;
-    reason;
-    constructor(containerKeyEpoch, reason, cause) {
-        super(HISTORICAL_WRAP_UNAVAILABLE_MESSAGES[reason](containerKeyEpoch), cause === undefined ? undefined : { cause });
-        this.containerKeyEpoch = containerKeyEpoch;
-        this.reason = reason;
-        this.name = "HistoricalWrapUnavailableError";
-    }
-}
-/**
- * The first candidate envelope that both decrypts AND matches the epoch's
- * material-id commitment.
- *
- * Candidates are tried ONE AT A TIME. An envelope can be AEAD-valid and still
- * carry the WRONG key — a stale or misaddressed wrap — so decrypting a batch
- * together would let that one envelope answer for the whole group and mask a
- * later envelope that would have opened the epoch. The reported failure is the
- * first real decrypt failure, since a commitment mismatch is a wrong envelope
- * rather than an unreachable one.
- */
-async function firstCommittedAnchor(input) {
-    let firstFailure;
-    for (const candidate of input.candidates) {
-        const result = await input.attempt([candidate]);
-        if (result.key === null) {
-            firstFailure ??= result.failure;
-            continue;
-        }
-        const materialId = await computeContainerKekMaterialId({
-            containerId: input.containerId,
-            keyEpoch: input.containerKeyEpoch,
-            keyMaterial: result.key,
-        });
-        if (materialId === input.containerKeyEpochId) {
-            return result;
-        }
-        // An envelope that decrypts to the WRONG key is a misaddressed or stale
-        // envelope, not an unreachable principal. Recording it keeps the reported
-        // reason `corrupt-envelope`; dropping it silently would let the epoch
-        // report as unaddressed, which points a repair at the wrong problem.
-        //
-        // Only reachable when the server files a wrap under an epoch id its
-        // material does not hash to — the addressing filter already rejects a
-        // wrap whose epoch id simply differs.
-        firstFailure ??= new Error(`Container KEK envelope decrypts to material that is not epoch ${input.containerKeyEpochId}`);
-    }
-    return { failure: firstFailure, key: null };
-}
-/**
- * Opens one group of envelopes with the requester's CURRENT policies, folding
- * failure into a value rather than throwing.
- *
- * The caller tries several groups in order, and a failure in one is not the
- * end of the search — so the failure has to travel back alongside the miss
- * instead of unwinding the whole recovery.
- */
-async function unwrapWrapsWithCurrentPolicies(input) {
-    if (input.wraps.length === 0) {
-        return { failure: undefined, key: null };
-    }
-    try {
-        return {
-            failure: undefined,
-            key: await unwrapKeyEnvelopesWithPrincipalPolicies({
-                envelopes: input.wraps.map((wrap) => ({
-                    keyFingerprint: wrap.recipientKeyFingerprint,
-                    kemCipherText: wrap.kemCipherText,
-                    wrappedKey: wrap.wrappedKey,
-                })),
-                execSql: input.execSql,
-                secretKey: input.secretKey,
-            }),
-        };
-    }
-    catch (error) {
-        return { failure: error, key: null };
-    }
-}
-/**
- * The severed-bridge backstop: recovers one historical epoch's KEK from the
- * requester's own retained recipient envelope served in the kek-log. Wraps
- * are written by that epoch's rotator and never deleted, so this path is
- * independent of every later rotation — it works even when the bridge chain
- * above the epoch is destroyed. The recovered key is verified against the
- * epoch id's material commitment before use.
- *
- * Scope bound: a direct user envelope is recoverable from identity keys
- * alone, so a pristine client anchors on it. A group- or organization-
- * addressed envelope additionally requires the current principal secret key.
- * Principal rotation rematerializes every retained container grant against
- * the new principal head, so a current reader never needs an older principal
- * key to use this recovery path. Unreachable principal keys fail closed with
- * `HistoricalWrapUnavailableError` rather than appearing to be corruption.
- */
-export async function recoverKeyringEntryFromWraps(input) {
-    const { directWraps, epochWraps, parentWraps, principalWraps } = partitionAnchorWraps(input.epoch.wraps, input.epoch.containerKeyEpochId, input.userId);
-    if (epochWraps.length === 0) {
-        throw new HistoricalWrapUnavailableError(input.epoch.containerKeyEpoch, "no-addressed-envelope");
-    }
-    const attempt = (wraps) => unwrapWrapsWithCurrentPolicies({
-        execSql: input.execSql,
-        secretKey: input.secretKey,
-        wraps,
-    });
-    // A direct envelope is decryptable from identity keys alone, so its failure
-    // means corruption — not an unreachable principal key. Neither failure ends
-    // the search: a parent-container wrap may still anchor this epoch.
-    //
-    // Candidates are tried ONE AT A TIME, and each must match the epoch's
-    // material-id commitment rather than merely decrypt. An envelope can be
-    // AEAD-valid and still carry the WRONG key — a stale or misaddressed wrap —
-    // so batching would let that one envelope answer for the whole group and
-    // mask a later envelope that would have opened the epoch.
-    const attemptCommitted = (candidates) => firstCommittedAnchor({
-        attempt,
-        candidates,
-        containerId: input.containerId,
-        containerKeyEpoch: input.epoch.containerKeyEpoch,
-        containerKeyEpochId: input.epoch.containerKeyEpochId,
-    });
-    const direct = await attemptCommitted(directWraps);
-    let keyMaterial = direct.key;
-    const directFailure = direct.failure;
-    let principalFailure;
-    if (keyMaterial === null) {
-        const principal = await attemptCommitted(principalWraps);
-        keyMaterial = principal.key;
-        // Preserve the current-policy failure in case no inherited anchor opens.
-        principalFailure = principal.failure;
-    }
-    // The inherited-only path: a parent-container envelope opens under the
-    // parent epoch's KEK, which the caller recovers from the parent's own log.
-    const parent = keyMaterial === null
-        ? await openParentAnchor(parentWraps, input.parentKeysByEpochId ?? new Map())
-        : { failure: undefined, key: null, keyWasAvailable: false };
-    keyMaterial ??= parent.key;
-    const parentFailure = parent.failure;
-    const parentKeyWasAvailable = parent.keyWasAvailable;
-    if (keyMaterial === null) {
-        throwMostSpecificAnchorFailure({
-            containerKeyEpoch: input.epoch.containerKeyEpoch,
-            directFailure,
-            hadParentWraps: parentWraps.length > 0,
-            parentFailure,
-            parentKeyWasAvailable,
-            principalFailure,
-        });
-    }
-    const expectedId = await computeContainerKekMaterialId({
-        containerId: input.containerId,
-        keyEpoch: input.epoch.containerKeyEpoch,
-        keyMaterial,
-    });
-    if (expectedId !== input.epoch.containerKeyEpochId) {
-        throw new Error(`Container KEK log wrap does not match its committed epoch id at epoch ${input.epoch.containerKeyEpoch}`);
-    }
-    return {
-        containerKeyEpochId: input.epoch.containerKeyEpochId,
-        keyMaterial,
-    };
-}
-export { fetchContainerKekLog } from "./containerKekLogFetch.js";
-export { rebuildKeyringEntriesFromLog } from "./keyringLogWalk.js";
-//# sourceMappingURL=keyringRebuild.js.map

package/data/documents/shared/keyringRebuild.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyringRebuild.js","sourceRoot":"","sources":["keyringRebuild.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AAEjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAyC,EACzC,mBAA2B,EAC3B,MAAc;IAOd,MAAM,QAAQ,GAAG,KAAK;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CACvE,CAAC;IACF,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CACzC,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAC7C,CAAC;IACF,OAAO;QACL,WAAW;QACX,UAAU,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC;QAC/D,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAwC,EACxC,UAA2C;IAM3C,IAAI,OAAgB,CAAC;IACrB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,4BAA4B,CAAC;oBACtC,iBAAiB,EAAE,IAAI,CAAC,WAAW;oBACnC,iBAAiB,EAAE,SAAS;oBAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC;gBACF,eAAe;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,KAOvC;IACC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3E,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,kBAAkB,EAClB,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,2BAA2B,EAC3B,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAClD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,uBAAuB,CAC5B,CAAC;AACJ,CAAC;AAiBD,MAAM,oCAAoC,GAGtC;IACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,0EAA0E,KAAK,EAAE;IACnF,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,0DAA0D,KAAK,sBAAsB;IACvF,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,uCAAuC,KAAK,mEAAmE;IACjH,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,uCAAuC,KAAK,kEAAkE;CACjH,CAAC;AAEF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE5C;IACA;IAFX,YACW,iBAAyB,EACzB,MAAuC,EAChD,KAAe;QAEf,KAAK,CACH,oCAAoC,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,EAC/D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAC5C,CAAC;QAPO,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,WAAM,GAAN,MAAM,CAAiC;QAOhD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,IAAI,YAAqB,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;YACrD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,iBAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,GAAG;SACxB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,sCAAsC;QACtC,YAAY,KAAK,IAAI,KAAK,CACxB,iEAAiE,KAAK,CAAC,mBAAmB,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,MAAM,uCAAuC,CAAC;gBACjD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,cAAc,EAAE,IAAI,CAAC,uBAAuB;oBAC5C,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAqBlD;IACC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,GAC5D,oBAAoB,CAClB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAC/B,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAC7B,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC3C,8BAA8B,CAAC;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;KACN,CAAC,CAAC;IAEL,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,CAAC,UAA8B,EAAE,EAAE,CAC1D,oBAAoB,CAAC;QACnB,OAAO;QACP,UAAU;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;KACrD,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,IAAI,gBAAyB,CAAC;IAC9B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACzD,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC;QAC5B,yEAAyE;QACzE,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GACV,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,gBAAgB,CACpB,WAAW,EACX,KAAK,CAAC,mBAAmB,IAAI,IAAI,GAAG,EAAE,CACvC;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAChE,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC,eAAe,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,8BAA8B,CAAC;YAC7B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAChD,aAAa;YACb,cAAc,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;YACtC,aAAa;YACb,qBAAqB;YACrB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QACvC,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,yEAAyE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;QACpD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["import type {\n  ContainerKekKeyringEntry,\n  ContainerKeyWrap,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekMaterialId,\n  unwrapContainerKekParentWrap,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekLogEpochResponse } from \"@tearleads/validators/response\";\nimport { unwrapKeyEnvelopesWithPrincipalPolicies } from \"../../principals/principalPolicyCrypto\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { normalizeContainerKeyWrap } from \"./readers\";\n\n/**\n * Splits an epoch's envelopes into the anchor kinds this requester could use:\n * their own direct envelope, principal envelopes their policies may resolve,\n * and parent-container envelopes. Anything else is not an identity anchor and\n * is dropped, so it never produces a misleading failure.\n */\nfunction partitionAnchorWraps(\n  wraps: readonly Record<string, unknown>[],\n  containerKeyEpochId: string,\n  userId: string,\n): {\n  directWraps: ContainerKeyWrap[];\n  epochWraps: ContainerKeyWrap[];\n  parentWraps: ContainerKeyWrap[];\n  principalWraps: ContainerKeyWrap[];\n} {\n  const forEpoch = wraps\n    .map((wrap) => normalizeContainerKeyWrap(wrap))\n    .filter((wrap) => wrap.containerKeyEpochId === containerKeyEpochId);\n  const directWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"user\" && wrap.recipientId === userId,\n  );\n  const principalWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"group\",\n  );\n  const parentWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"container\",\n  );\n  return {\n    directWraps,\n    epochWraps: [...directWraps, ...principalWraps, ...parentWraps],\n    parentWraps,\n    principalWraps,\n  };\n}\n\n/**\n * Opens the first parent-container envelope whose parent epoch key the caller\n * supplied. Reports whether any key was available, so a missing parent key is\n * distinguishable from a corrupt envelope.\n */\nasync function openParentAnchor(\n  parentWraps: readonly ContainerKeyWrap[],\n  parentKeys: ReadonlyMap<string, Uint8Array>,\n): Promise<{\n  failure: unknown;\n  key: Uint8Array | null;\n  keyWasAvailable: boolean;\n}> {\n  let failure: unknown;\n  let keyWasAvailable = false;\n  for (const wrap of parentWraps) {\n    const parentKey = parentKeys.get(wrap.recipientKeyEpochId);\n    if (!parentKey) {\n      continue;\n    }\n    keyWasAvailable = true;\n    try {\n      return {\n        failure: undefined,\n        key: await unwrapContainerKekParentWrap({\n          parentContainerId: wrap.recipientId,\n          parentKeyMaterial: parentKey,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        }),\n        keyWasAvailable,\n      };\n    } catch (error) {\n      failure = error;\n    }\n  }\n  return { failure, key: null, keyWasAvailable };\n}\n\n/**\n * Every anchor kind was tried; report the most specific reason. A wrap that\n * was actually attempted and failed is corruption; one that could not be\n * attempted names the key that was missing.\n */\nfunction throwMostSpecificAnchorFailure(input: {\n  containerKeyEpoch: number;\n  directFailure: unknown;\n  hadParentWraps: boolean;\n  parentFailure: unknown;\n  parentKeyWasAvailable: boolean;\n  principalFailure: unknown;\n}): never {\n  if (input.directFailure !== undefined || input.parentFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"corrupt-envelope\",\n      input.directFailure ?? input.parentFailure,\n    );\n  }\n  if (input.principalFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"principal-key-unreachable\",\n      input.principalFailure,\n    );\n  }\n  throw new HistoricalWrapUnavailableError(\n    input.containerKeyEpoch,\n    input.hadParentWraps && !input.parentKeyWasAvailable\n      ? \"parent-key-unavailable\"\n      : \"no-addressed-envelope\",\n  );\n}\n\n/**\n * Raised when the requester holds no envelope they can open for a historical\n * epoch. Distinct from corruption: the log is intact, the caller simply is\n * not an anchor for this epoch.\n */\nexport type HistoricalWrapUnavailableReason =\n  /** No envelope at this epoch is addressed to the requester at all. */\n  | \"no-addressed-envelope\"\n  /** A direct user envelope exists for the requester but did not open. */\n  | \"corrupt-envelope\"\n  /** Only principal-addressed envelopes, whose key epoch is unreachable. */\n  | \"principal-key-unreachable\"\n  /** Only a parent-container envelope, and the parent KEK was not supplied. */\n  | \"parent-key-unavailable\";\n\nconst HISTORICAL_WRAP_UNAVAILABLE_MESSAGES: Record<\n  HistoricalWrapUnavailableReason,\n  (epoch: number) => string\n> = {\n  \"no-addressed-envelope\": (epoch) =>\n    `Container KEK log has no envelope addressed to this requester at epoch ${epoch}`,\n  \"corrupt-envelope\": (epoch) =>\n    `Container KEK log envelope for this requester at epoch ${epoch} could not be opened`,\n  \"principal-key-unreachable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is addressed to a principal key epoch this client cannot resolve`,\n  \"parent-key-unavailable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is inherited from a parent container whose KEK was not supplied`,\n};\n\nexport class HistoricalWrapUnavailableError extends Error {\n  constructor(\n    readonly containerKeyEpoch: number,\n    readonly reason: HistoricalWrapUnavailableReason,\n    cause?: unknown,\n  ) {\n    super(\n      HISTORICAL_WRAP_UNAVAILABLE_MESSAGES[reason](containerKeyEpoch),\n      cause === undefined ? undefined : { cause },\n    );\n    this.name = \"HistoricalWrapUnavailableError\";\n  }\n}\n\n/**\n * The first candidate envelope that both decrypts AND matches the epoch's\n * material-id commitment.\n *\n * Candidates are tried ONE AT A TIME. An envelope can be AEAD-valid and still\n * carry the WRONG key — a stale or misaddressed wrap — so decrypting a batch\n * together would let that one envelope answer for the whole group and mask a\n * later envelope that would have opened the epoch. The reported failure is the\n * first real decrypt failure, since a commitment mismatch is a wrong envelope\n * rather than an unreachable one.\n */\nasync function firstCommittedAnchor(input: {\n  attempt: (\n    wraps: ContainerKeyWrap[],\n  ) => Promise<{ failure: unknown; key: Uint8Array | null }>;\n  candidates: ContainerKeyWrap[];\n  containerId: string;\n  containerKeyEpoch: number;\n  containerKeyEpochId: string;\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  let firstFailure: unknown;\n  for (const candidate of input.candidates) {\n    const result = await input.attempt([candidate]);\n    if (result.key === null) {\n      firstFailure ??= result.failure;\n      continue;\n    }\n    const materialId = await computeContainerKekMaterialId({\n      containerId: input.containerId,\n      keyEpoch: input.containerKeyEpoch,\n      keyMaterial: result.key,\n    });\n    if (materialId === input.containerKeyEpochId) {\n      return result;\n    }\n    // An envelope that decrypts to the WRONG key is a misaddressed or stale\n    // envelope, not an unreachable principal. Recording it keeps the reported\n    // reason `corrupt-envelope`; dropping it silently would let the epoch\n    // report as unaddressed, which points a repair at the wrong problem.\n    //\n    // Only reachable when the server files a wrap under an epoch id its\n    // material does not hash to — the addressing filter already rejects a\n    // wrap whose epoch id simply differs.\n    firstFailure ??= new Error(\n      `Container KEK envelope decrypts to material that is not epoch ${input.containerKeyEpochId}`,\n    );\n  }\n  return { failure: firstFailure, key: null };\n}\n\n/**\n * Opens one group of envelopes with the requester's CURRENT policies, folding\n * failure into a value rather than throwing.\n *\n * The caller tries several groups in order, and a failure in one is not the\n * end of the search — so the failure has to travel back alongside the miss\n * instead of unwinding the whole recovery.\n */\nasync function unwrapWrapsWithCurrentPolicies(input: {\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  if (input.wraps.length === 0) {\n    return { failure: undefined, key: null };\n  }\n  try {\n    return {\n      failure: undefined,\n      key: await unwrapKeyEnvelopesWithPrincipalPolicies({\n        envelopes: input.wraps.map((wrap) => ({\n          keyFingerprint: wrap.recipientKeyFingerprint,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        })),\n        execSql: input.execSql,\n        secretKey: input.secretKey,\n      }),\n    };\n  } catch (error) {\n    return { failure: error, key: null };\n  }\n}\n\n/**\n * The severed-bridge backstop: recovers one historical epoch's KEK from the\n * requester's own retained recipient envelope served in the kek-log. Wraps\n * are written by that epoch's rotator and never deleted, so this path is\n * independent of every later rotation — it works even when the bridge chain\n * above the epoch is destroyed. The recovered key is verified against the\n * epoch id's material commitment before use.\n *\n * Scope bound: a direct user envelope is recoverable from identity keys\n * alone, so a pristine client anchors on it. A group- or organization-\n * addressed envelope additionally requires the current principal secret key.\n * Principal rotation rematerializes every retained container grant against\n * the new principal head, so a current reader never needs an older principal\n * key to use this recovery path. Unreachable principal keys fail closed with\n * `HistoricalWrapUnavailableError` rather than appearing to be corruption.\n */\nexport async function recoverKeyringEntryFromWraps(input: {\n  containerId: string;\n  epoch: Pick<\n    ContainerKekLogEpochResponse,\n    \"containerKeyEpoch\" | \"containerKeyEpochId\" | \"wraps\"\n  >;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  /**\n   * Parent container KEKs by epoch id. An inherited-only child has no direct\n   * or principal envelope of its own; its anchor is the parent-container\n   * wrap, which opens under the parent epoch's KEK. Recover the parent's\n   * epoch first (recursively, through the parent's own log) and pass it here.\n   */\n  parentKeysByEpochId?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * The requester's user id. Direct user envelopes are matched against it, so\n   * another member's envelope is never mistaken for an anchor — attempting it\n   * would only produce a misleading failure.\n   */\n  userId: string;\n}): Promise<ContainerKekKeyringEntry> {\n  const { directWraps, epochWraps, parentWraps, principalWraps } =\n    partitionAnchorWraps(\n      input.epoch.wraps,\n      input.epoch.containerKeyEpochId,\n      input.userId,\n    );\n  if (epochWraps.length === 0) {\n    throw new HistoricalWrapUnavailableError(\n      input.epoch.containerKeyEpoch,\n      \"no-addressed-envelope\",\n    );\n  }\n\n  const attempt = (wraps: typeof epochWraps) =>\n    unwrapWrapsWithCurrentPolicies({\n      execSql: input.execSql,\n      secretKey: input.secretKey,\n      wraps,\n    });\n\n  // A direct envelope is decryptable from identity keys alone, so its failure\n  // means corruption — not an unreachable principal key. Neither failure ends\n  // the search: a parent-container wrap may still anchor this epoch.\n  //\n  // Candidates are tried ONE AT A TIME, and each must match the epoch's\n  // material-id commitment rather than merely decrypt. An envelope can be\n  // AEAD-valid and still carry the WRONG key — a stale or misaddressed wrap —\n  // so batching would let that one envelope answer for the whole group and\n  // mask a later envelope that would have opened the epoch.\n  const attemptCommitted = (candidates: ContainerKeyWrap[]) =>\n    firstCommittedAnchor({\n      attempt,\n      candidates,\n      containerId: input.containerId,\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      containerKeyEpochId: input.epoch.containerKeyEpochId,\n    });\n\n  const direct = await attemptCommitted(directWraps);\n  let keyMaterial = direct.key;\n  const directFailure = direct.failure;\n  let principalFailure: unknown;\n  if (keyMaterial === null) {\n    const principal = await attemptCommitted(principalWraps);\n    keyMaterial = principal.key;\n    // Preserve the current-policy failure in case no inherited anchor opens.\n    principalFailure = principal.failure;\n  }\n  // The inherited-only path: a parent-container envelope opens under the\n  // parent epoch's KEK, which the caller recovers from the parent's own log.\n  const parent =\n    keyMaterial === null\n      ? await openParentAnchor(\n          parentWraps,\n          input.parentKeysByEpochId ?? new Map(),\n        )\n      : { failure: undefined, key: null, keyWasAvailable: false };\n  keyMaterial ??= parent.key;\n  const parentFailure = parent.failure;\n  const parentKeyWasAvailable = parent.keyWasAvailable;\n  if (keyMaterial === null) {\n    throwMostSpecificAnchorFailure({\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      directFailure,\n      hadParentWraps: parentWraps.length > 0,\n      parentFailure,\n      parentKeyWasAvailable,\n      principalFailure,\n    });\n  }\n  const expectedId = await computeContainerKekMaterialId({\n    containerId: input.containerId,\n    keyEpoch: input.epoch.containerKeyEpoch,\n    keyMaterial,\n  });\n  if (expectedId !== input.epoch.containerKeyEpochId) {\n    throw new Error(\n      `Container KEK log wrap does not match its committed epoch id at epoch ${input.epoch.containerKeyEpoch}`,\n    );\n  }\n  return {\n    containerKeyEpochId: input.epoch.containerKeyEpochId,\n    keyMaterial,\n  };\n}\n\nexport { fetchContainerKekLog } from \"./containerKekLogFetch\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"./keyringLogWalk\";\nexport { rebuildKeyringEntriesFromLog } from \"./keyringLogWalk\";\n"]}

package/data/documents/shared/mutationAcknowledgement.js

@@ -1,10 +0,0 @@
-import { advanceLocallyAcknowledgedAccessManifestHeadsAtomically, locallyAuthoredAccessManifestHead, } from "../../persistence/locallyAcknowledgedCheckpointPersistence.js";
-/** Advances a document head only after its response was matched to this plan. */
-export async function acknowledgeDocumentMutation(input) {
-    await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({
-        execSql: input.execSql,
-        heads: [locallyAuthoredAccessManifestHead(input.plan)],
-        stillCurrent: input.stillCurrent,
-    });
-}
-//# sourceMappingURL=mutationAcknowledgement.js.map

package/data/documents/shared/mutationAcknowledgement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutationAcknowledgement.js","sourceRoot":"","sources":["mutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,4DAA4D,CAAC;AAGpE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/** Advances a document head only after its response was matched to this plan. */\nexport async function acknowledgeDocumentMutation(input: {\n  readonly execSql: ExecSql;\n  readonly plan: Parameters<typeof locallyAuthoredAccessManifestHead>[0];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [locallyAuthoredAccessManifestHead(input.plan)],\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/documents/shared/projection.d.ts

@@ -1,25 +0,0 @@
-import type { DocumentContentKeyTarget, VerifiedContainerAccessManifest } from "../../../internal/crypto/index.js";
-import type { DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import { type DocumentWriterProjectionAuthorization, type PrincipalPolicyCache } from "../../keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../sqlite/sqlSchema.js";
-export { unwrapContainerKekPath } from "./containerKekPath.js";
-export { ContainerKekHistoryUnavailableError } from "./containerKekPathHistory.js";
-export { buildRotatedDocumentContentKeyBundle, collectContainerKeksForDocumentSync, DocumentContentKeyUnavailableError, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, unwrapDocumentContentKeyFromWriterProjection, unwrapDocumentContentKeyTarget, wrapDocumentContentKeyForCreate, } from "./projectionContentKeys.js";
-export { authorizingContainerPathRefs, authorizingContainerPathRefsForLinkSet, containerPathRefs, currentDocumentTargets, deriveDocumentCreateTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, verifiedDocumentWrapTargets, } from "./projectionTargets.js";
-import type { ProjectionVerificationOptions } from "./types.js";
-declare function assertDocumentWriterProjectionConsistentInternal(writerProjection: DocumentWriterProjectionResponse, input: ProjectionVerificationOptions & {
-    /**
-     * Accept a projection whose content-key bundle is marked stale (wrapped
-     * to superseded KEK targets after e.g. a revoke rotation). Document sync
-     * opts in to heal the bundle. Attachment reads opt in because their DEK
-     * is independent and opens through verified retained container KEKs.
-     */
-    allowStaleContentKeyBundle?: boolean | undefined;
-    execSql?: ExecSql | undefined;
-    persistVerificationCheckpoints?: boolean | undefined;
-    onVerifiedAuthorization?: ((authorization: DocumentWriterProjectionAuthorization) => void) | undefined;
-    principalPolicyCache?: PrincipalPolicyCache | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;
-}): Promise<DocumentContentKeyTarget[]>;
-export declare function assertDocumentWriterProjectionConsistent(...input: Parameters<typeof assertDocumentWriterProjectionConsistentInternal>): ReturnType<typeof assertDocumentWriterProjectionConsistentInternal>;