@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/projection.js

@@ -1,132 +0,0 @@
-import { computeDocumentContentKeyTargetHash } from "../../../internal/crypto/index.js";
-import { verifyDocumentWriterProjectionAuthorization, } from "../../keyingProjectionVerification/index.js";
-import { throwKeyingVerificationShapeFailure } from "../../keyingProjectionVerification/error.js";
-import { errorMessage } from "../../shared/errorMessage.js";
-import { currentDocumentTargets, deriveDocumentTargetFromProjection, readLinkedContainerIdsFromDocumentManifest, } from "./projectionTargets.js";
-import { assertDocumentManifestBundleConsistent, normalizeDocumentKekTargetResponse, sortDocumentTargets, targetEnvelopeReference, targetKey, uniqueSortedStrings, } from "./readers.js";
-export { unwrapContainerKekPath } from "./containerKekPath.js";
-export { ContainerKekHistoryUnavailableError } from "./containerKekPathHistory.js";
-export { buildRotatedDocumentContentKeyBundle, collectContainerKeksForDocumentSync, DocumentContentKeyUnavailableError, DocumentHistoryUnavailableError, unwrapDocumentContentKeyFromBundle, unwrapDocumentContentKeyFromWriterProjection, unwrapDocumentContentKeyTarget, wrapDocumentContentKeyForCreate, } from "./projectionContentKeys.js";
-export { authorizingContainerPathRefs, authorizingContainerPathRefsForLinkSet, containerPathRefs, currentDocumentTargets, deriveDocumentCreateTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, verifiedDocumentWrapTargets, } from "./projectionTargets.js";
-import { resolveProjectionVerifier } from "./types.js";
-function assertSortedStringsEqual(left, right, message) {
-    if (left.length !== right.length ||
-        left.some((value, index) => value !== right[index])) {
-        throw new Error(message);
-    }
-}
-function assertAuthorizingContainerPathsMatchDocumentTargets(input) {
-    if (input.writerProjection.authorizingContainerPaths.length === 0) {
-        throw new Error("Document writer projection authorization paths missing");
-    }
-    const targetKeys = new Set(input.targets.map(targetKey));
-    for (const [index, projection,] of input.writerProjection.authorizingContainerPaths.entries()) {
-        let projectionTarget;
-        try {
-            projectionTarget = deriveDocumentTargetFromProjection(projection);
-        }
-        catch (error) {
-            throw new Error(`Document writer projection authorization path[${index}] is invalid: ${errorMessage(error)}`);
-        }
-        if (targetKeys.has(targetKey(projectionTarget))) {
-            continue;
-        }
-        // Bind server-supplied KEK paths to committed document targets before
-        // using any unwrapped path KEK for document content-key material.
-        throw new Error(`Document writer projection authorization path[${index}] is not a document target`);
-    }
-}
-function assertDocumentTargetsCoverLinkedContainers(targets, writerProjection) {
-    // One target per linked container: a second epoch for the same container
-    // would let a re-wrap land on a KEK a revoked member still holds.
-    if (new Set(targets.map((target) => target.containerId)).size !== targets.length) {
-        throw new Error("Document writer projection targets name a linked container more than once");
-    }
-    assertSortedStringsEqual(uniqueSortedStrings(targets.map((target) => target.containerId)), readLinkedContainerIdsFromDocumentManifest(writerProjection), "Document writer projection targets do not match linked containers");
-    assertSortedStringsEqual(uniqueSortedStrings(writerProjection.documentKekTargets.linkedContainerManifestHashes), uniqueSortedStrings(targets.map((target) => target.containerManifestHash)), "Document writer projection target manifest summary mismatch");
-    assertSortedStringsEqual(uniqueSortedStrings(writerProjection.documentKekTargets.linkedContainerKeyEpochIds), uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)), "Document writer projection target KEK summary mismatch");
-}
-async function assertProjectionContentKeyBundleConsistent(writerProjection, staleContentKeyBundle) {
-    const { manifestHash } = writerProjection.documentManifest;
-    if (writerProjection.contentKeyBundle.linkSetManifestHash !== manifestHash) {
-        // A stale bundle may lag the link-set head, but it must still descend
-        // from this document's manifest chain.
-        if (!staleContentKeyBundle ||
-            !writerProjection.documentManifestHistory.some((bundle) => bundle.manifestHash ===
-                writerProjection.contentKeyBundle.linkSetManifestHash)) {
-            throw new Error("Document writer projection link manifest mismatch");
-        }
-    }
-    if (!staleContentKeyBundle) {
-        if (writerProjection.documentKekTargets.documentKeyTargetHash !==
-            writerProjection.contentKeyBundle.targetHash) {
-            throw new Error("Document writer projection target hash mismatch");
-        }
-        return;
-    }
-    // The stale bundle cannot match the current targets; pin it to its own
-    // canonical hash instead so a tampered envelope set still fails closed.
-    const staleBundleTargetHash = await computeDocumentContentKeyTargetHash(sortDocumentTargets(writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference)));
-    if (staleBundleTargetHash !== writerProjection.contentKeyBundle.targetHash) {
-        throw new Error("Document writer projection stale bundle target hash is not canonical");
-    }
-}
-async function assertDocumentWriterProjectionConsistentInternal(writerProjection, input) {
-    const resolveProjectionUserKey = resolveProjectionVerifier(input, "Document writer projection");
-    if (input.trustedLocalProjection !== true &&
-        resolveProjectionUserKey !== null) {
-        const authorization = await verifyDocumentWriterProjectionAuthorization({
-            execSql: input.execSql,
-            persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-            principalPolicyCache: input.principalPolicyCache,
-            projection: writerProjection,
-            resolveUserKey: resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            verifiedByHash: input.verifiedByHash,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        input.onVerifiedAuthorization?.(authorization);
-    }
-    const staleContentKeyBundle = writerProjection.contentKeyBundleStale === true;
-    if (staleContentKeyBundle && input.allowStaleContentKeyBundle !== true) {
-        throw new Error("Document writer projection content-key bundle is stale");
-    }
-    const manifestIdentity = await assertDocumentManifestBundleConsistent({
-        bundle: writerProjection.documentManifest,
-        label: "Document writer projection manifest",
-    });
-    const { documentId } = manifestIdentity;
-    if (writerProjection.documentId !== documentId ||
-        writerProjection.documentKekTargets.documentId !== documentId ||
-        writerProjection.contentKeyBundle.documentId !== documentId) {
-        throw new Error("Document writer projection document id mismatch");
-    }
-    if (writerProjection.documentKekTargets.linkSetManifestHash !==
-        writerProjection.documentManifest.manifestHash) {
-        throw new Error("Document writer projection link manifest mismatch");
-    }
-    await assertProjectionContentKeyBundleConsistent(writerProjection, staleContentKeyBundle);
-    const targets = staleContentKeyBundle
-        ? normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets)
-        : currentDocumentTargets(writerProjection);
-    const canonicalTargetHash = await computeDocumentContentKeyTargetHash(targets);
-    if (canonicalTargetHash !==
-        writerProjection.documentKekTargets.documentKeyTargetHash) {
-        throw new Error("Document writer projection target hash is not canonical");
-    }
-    assertDocumentTargetsCoverLinkedContainers(targets, writerProjection);
-    assertAuthorizingContainerPathsMatchDocumentTargets({
-        targets,
-        writerProjection,
-    });
-    return targets;
-}
-export async function assertDocumentWriterProjectionConsistent(...input) {
-    try {
-        return await assertDocumentWriterProjectionConsistentInternal(...input);
-    }
-    catch (error) {
-        throwKeyingVerificationShapeFailure(error);
-    }
-}
-//# sourceMappingURL=projection.js.map

package/data/documents/shared/projection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projection.js","sourceRoot":"","sources":["projection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAGL,2CAA2C,GAC5C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,4CAA4C,EAC5C,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,SAAS,wBAAwB,CAC/B,IAAuB,EACvB,KAAwB,EACxB,OAAe;IAEf,IACE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,mDAAmD,CAAC,KAG5D;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CACT,KAAK,EACL,UAAU,EACX,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,gBAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,gBAAgB,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,iBAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,4BAA4B,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0CAA0C,CACjD,OAA4C,EAC5C,gBAAkD;IAElD,yEAAyE;IACzE,kEAAkE;IAClE,IACE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,wBAAwB,CACtB,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAChE,0CAA0C,CAAC,gBAAgB,CAAC,EAC5D,mEAAmE,CACpE,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,6BAA6B,CAClE,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,EAC1E,6DAA6D,CAC9D,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,0BAA0B,CAC/D,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EACxE,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CACvD,gBAAkD,EAClD,qBAA8B;IAE9B,MAAM,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC3D,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;QAC3E,sEAAsE;QACtE,uCAAuC;QACvC,IACE,CAAC,qBAAqB;YACtB,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAC5C,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY;gBACnB,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,CACxD,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,IACE,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB;YACzD,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CACrE,mBAAmB,CACjB,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CACvE,CACF,CAAC;IACF,IAAI,qBAAqB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gDAAgD,CAC7D,gBAAkD,EAClD,KAgBC;IAED,MAAM,wBAAwB,GAAG,yBAAyB,CACxD,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,IACE,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACrC,wBAAwB,KAAK,IAAI,EACjC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,2CAA2C,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;YACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,wBAAwB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,KAAK,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAC9E,IAAI,qBAAqB,IAAI,KAAK,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,gBAAgB,CAAC,gBAAgB;QACzC,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;IACxC,IACE,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAC1C,gBAAgB,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU;QAC7D,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,KAAK,UAAU,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,gBAAgB,CAAC,kBAAkB,CAAC,mBAAmB;QACvD,gBAAgB,CAAC,gBAAgB,CAAC,YAAY,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,0CAA0C,CAC9C,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IAEF,MAAM,OAAO,GAAG,qBAAqB;QACnC,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QACzE,CAAC,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GACvB,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrD,IACE,mBAAmB;QACnB,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,0CAA0C,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACtE,mDAAmD,CAAC;QAClD,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,GAAG,KAA0E;IAE7E,IAAI,CAAC;QACH,OAAO,MAAM,gDAAgD,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import type {\n  DocumentContentKeyTarget,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { computeDocumentContentKeyTargetHash } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type PrincipalPolicyCache,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { throwKeyingVerificationShapeFailure } from \"../../keyingProjectionVerification/error\";\nimport { errorMessage } from \"../../shared/errorMessage\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"./projectionTargets\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  normalizeDocumentKekTargetResponse,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n  targetKey,\n  uniqueSortedStrings,\n} from \"./readers\";\n\nexport { unwrapContainerKekPath } from \"./containerKekPath\";\nexport { ContainerKekHistoryUnavailableError } from \"./containerKekPathHistory\";\nexport {\n  buildRotatedDocumentContentKeyBundle,\n  collectContainerKeksForDocumentSync,\n  DocumentContentKeyUnavailableError,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n  unwrapDocumentContentKeyFromWriterProjection,\n  unwrapDocumentContentKeyTarget,\n  wrapDocumentContentKeyForCreate,\n} from \"./projectionContentKeys\";\nexport {\n  authorizingContainerPathRefs,\n  authorizingContainerPathRefsForLinkSet,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentCreateTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  verifiedDocumentWrapTargets,\n} from \"./projectionTargets\";\n\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { resolveProjectionVerifier } from \"./types\";\n\nfunction assertSortedStringsEqual(\n  left: readonly string[],\n  right: readonly string[],\n  message: string,\n): void {\n  if (\n    left.length !== right.length ||\n    left.some((value, index) => value !== right[index])\n  ) {\n    throw new Error(message);\n  }\n}\n\nfunction assertAuthorizingContainerPathsMatchDocumentTargets(input: {\n  targets: readonly DocumentContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  if (input.writerProjection.authorizingContainerPaths.length === 0) {\n    throw new Error(\"Document writer projection authorization paths missing\");\n  }\n\n  const targetKeys = new Set(input.targets.map(targetKey));\n  for (const [\n    index,\n    projection,\n  ] of input.writerProjection.authorizingContainerPaths.entries()) {\n    let projectionTarget: DocumentContentKeyTarget;\n    try {\n      projectionTarget = deriveDocumentTargetFromProjection(projection);\n    } catch (error) {\n      throw new Error(\n        `Document writer projection authorization path[${index}] is invalid: ${errorMessage(error)}`,\n      );\n    }\n\n    if (targetKeys.has(targetKey(projectionTarget))) {\n      continue;\n    }\n\n    // Bind server-supplied KEK paths to committed document targets before\n    // using any unwrapped path KEK for document content-key material.\n    throw new Error(\n      `Document writer projection authorization path[${index}] is not a document target`,\n    );\n  }\n}\n\nfunction assertDocumentTargetsCoverLinkedContainers(\n  targets: readonly DocumentContentKeyTarget[],\n  writerProjection: DocumentWriterProjectionResponse,\n): void {\n  // One target per linked container: a second epoch for the same container\n  // would let a re-wrap land on a KEK a revoked member still holds.\n  if (\n    new Set(targets.map((target) => target.containerId)).size !== targets.length\n  ) {\n    throw new Error(\n      \"Document writer projection targets name a linked container more than once\",\n    );\n  }\n  assertSortedStringsEqual(\n    uniqueSortedStrings(targets.map((target) => target.containerId)),\n    readLinkedContainerIdsFromDocumentManifest(writerProjection),\n    \"Document writer projection targets do not match linked containers\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerManifestHashes,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerManifestHash)),\n    \"Document writer projection target manifest summary mismatch\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerKeyEpochIds,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)),\n    \"Document writer projection target KEK summary mismatch\",\n  );\n}\n\nasync function assertProjectionContentKeyBundleConsistent(\n  writerProjection: DocumentWriterProjectionResponse,\n  staleContentKeyBundle: boolean,\n): Promise<void> {\n  const { manifestHash } = writerProjection.documentManifest;\n  if (writerProjection.contentKeyBundle.linkSetManifestHash !== manifestHash) {\n    // A stale bundle may lag the link-set head, but it must still descend\n    // from this document's manifest chain.\n    if (\n      !staleContentKeyBundle ||\n      !writerProjection.documentManifestHistory.some(\n        (bundle) =>\n          bundle.manifestHash ===\n          writerProjection.contentKeyBundle.linkSetManifestHash,\n      )\n    ) {\n      throw new Error(\"Document writer projection link manifest mismatch\");\n    }\n  }\n\n  if (!staleContentKeyBundle) {\n    if (\n      writerProjection.documentKekTargets.documentKeyTargetHash !==\n      writerProjection.contentKeyBundle.targetHash\n    ) {\n      throw new Error(\"Document writer projection target hash mismatch\");\n    }\n    return;\n  }\n\n  // The stale bundle cannot match the current targets; pin it to its own\n  // canonical hash instead so a tampered envelope set still fails closed.\n  const staleBundleTargetHash = await computeDocumentContentKeyTargetHash(\n    sortDocumentTargets(\n      writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference),\n    ),\n  );\n  if (staleBundleTargetHash !== writerProjection.contentKeyBundle.targetHash) {\n    throw new Error(\n      \"Document writer projection stale bundle target hash is not canonical\",\n    );\n  }\n}\n\nasync function assertDocumentWriterProjectionConsistentInternal(\n  writerProjection: DocumentWriterProjectionResponse,\n  input: ProjectionVerificationOptions & {\n    /**\n     * Accept a projection whose content-key bundle is marked stale (wrapped\n     * to superseded KEK targets after e.g. a revoke rotation). Document sync\n     * opts in to heal the bundle. Attachment reads opt in because their DEK\n     * is independent and opens through verified retained container KEKs.\n     */\n    allowStaleContentKeyBundle?: boolean | undefined;\n    execSql?: ExecSql | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    onVerifiedAuthorization?:\n      | ((authorization: DocumentWriterProjectionAuthorization) => void)\n      | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    stillCurrent?: (() => boolean) | undefined;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n  },\n): Promise<DocumentContentKeyTarget[]> {\n  const resolveProjectionUserKey = resolveProjectionVerifier(\n    input,\n    \"Document writer projection\",\n  );\n  if (\n    input.trustedLocalProjection !== true &&\n    resolveProjectionUserKey !== null\n  ) {\n    const authorization = await verifyDocumentWriterProjectionAuthorization({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: writerProjection,\n      resolveUserKey: resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    input.onVerifiedAuthorization?.(authorization);\n  }\n\n  const staleContentKeyBundle = writerProjection.contentKeyBundleStale === true;\n  if (staleContentKeyBundle && input.allowStaleContentKeyBundle !== true) {\n    throw new Error(\"Document writer projection content-key bundle is stale\");\n  }\n\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: writerProjection.documentManifest,\n    label: \"Document writer projection manifest\",\n  });\n  const { documentId } = manifestIdentity;\n  if (\n    writerProjection.documentId !== documentId ||\n    writerProjection.documentKekTargets.documentId !== documentId ||\n    writerProjection.contentKeyBundle.documentId !== documentId\n  ) {\n    throw new Error(\"Document writer projection document id mismatch\");\n  }\n  if (\n    writerProjection.documentKekTargets.linkSetManifestHash !==\n    writerProjection.documentManifest.manifestHash\n  ) {\n    throw new Error(\"Document writer projection link manifest mismatch\");\n  }\n  await assertProjectionContentKeyBundleConsistent(\n    writerProjection,\n    staleContentKeyBundle,\n  );\n\n  const targets = staleContentKeyBundle\n    ? normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets)\n    : currentDocumentTargets(writerProjection);\n  const canonicalTargetHash =\n    await computeDocumentContentKeyTargetHash(targets);\n  if (\n    canonicalTargetHash !==\n    writerProjection.documentKekTargets.documentKeyTargetHash\n  ) {\n    throw new Error(\"Document writer projection target hash is not canonical\");\n  }\n\n  assertDocumentTargetsCoverLinkedContainers(targets, writerProjection);\n  assertAuthorizingContainerPathsMatchDocumentTargets({\n    targets,\n    writerProjection,\n  });\n\n  return targets;\n}\n\nexport async function assertDocumentWriterProjectionConsistent(\n  ...input: Parameters<typeof assertDocumentWriterProjectionConsistentInternal>\n): ReturnType<typeof assertDocumentWriterProjectionConsistentInternal> {\n  try {\n    return await assertDocumentWriterProjectionConsistentInternal(...input);\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}

package/data/documents/shared/projectionContentKeys.d.ts

@@ -1,90 +0,0 @@
-import { type ContentKeyEnvelopeKind, type VerifiedContainerAccessManifest } from "../../../internal/crypto/index.js";
-import type { DocumentContentKeyTargetEnvelope } from "../../../internal/validators/request/index.js";
-import type { ContainerWriterProjectionResponse, DocumentContentKeyBundleResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { PrincipalPolicyCache } from "../../keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../sqlite/sqlSchema.js";
-import type { ProjectionVerificationOptions } from "./types.js";
-export declare function wrapDocumentContentKeyForCreate(input: {
-    contentKey: Uint8Array;
-    contentKeyEpoch: number;
-    documentId: string;
-    execSql?: ExecSql | undefined;
-    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
-    persistVerificationCheckpoints?: boolean | undefined;
-    projection: ContainerWriterProjectionResponse;
-    secretKey: Uint8Array;
-} & ProjectionVerificationOptions): Promise<DocumentContentKeyTargetEnvelope[]>;
-export declare function unwrapContentKeyTargetForKind(input: {
-    containerKek: Uint8Array;
-    /** The content-key epoch of the bundle the envelope was served in. */
-    contentKeyEpoch: number;
-    /** Wraps a decode or decrypt failure with this message. */
-    decryptErrorMessage?: string | undefined;
-    envelope: {
-        containerId: string;
-        containerKeyEpochId: string;
-        wrappedKey: string;
-        wrappingMetadata?: unknown;
-    };
-    kind: ContentKeyEnvelopeKind;
-    /** The document or blob the caller is reading, never read from the bundle. */
-    objectId: string;
-}): Promise<Uint8Array>;
-export declare function unwrapDocumentContentKeyTarget(input: {
-    containerKek: Uint8Array;
-    contentKeyEpoch: number;
-    documentId: string;
-    envelope: DocumentContentKeyTargetEnvelope;
-}): Promise<Uint8Array>;
-interface CollectedContainerKeks {
-    readonly keksByEpochId: ReadonlyMap<string, Uint8Array>;
-    readonly predecessorFailuresByEpochId: ReadonlyMap<string, Error>;
-    readonly unattributedPredecessorFailuresByContainerId: ReadonlyMap<string, Error>;
-}
-export declare class DocumentHistoryUnavailableError extends Error {
-    readonly historyCause: unknown;
-    constructor(historyCause: unknown);
-}
-/** No verified target or predecessor path can supply this content key. */
-export declare class DocumentContentKeyUnavailableError extends Error {
-    constructor();
-}
-export declare function collectContainerKeksForDocumentSync(input: {
-    execSql?: ExecSql | undefined;
-    persistVerificationCheckpoints?: boolean | undefined;
-    principalPolicyCache?: PrincipalPolicyCache | undefined;
-    secretKey: Uint8Array;
-    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;
-    writerProjection: DocumentWriterProjectionResponse;
-} & ProjectionVerificationOptions): Promise<CollectedContainerKeks>;
-export declare function unwrapDocumentContentKeyFromBundle(bundle: DocumentContentKeyBundleResponse, 
-/** The document being read; its wraps must be sealed to it. */
-documentId: string, containerKeksByEpochId: ReadonlyMap<string, Uint8Array>, predecessorFailuresByEpochId?: ReadonlyMap<string, Error>, unattributedPredecessorFailuresByContainerId?: ReadonlyMap<string, Error>): Promise<Uint8Array>;
-export declare function unwrapDocumentContentKeyFromWriterProjection(input: {
-    execSql?: ExecSql | undefined;
-    principalPolicyCache?: PrincipalPolicyCache | undefined;
-    secretKey: Uint8Array;
-    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;
-    writerProjection: DocumentWriterProjectionResponse;
-} & ProjectionVerificationOptions): Promise<Uint8Array>;
-/**
- * Builds the healing bundle for a stale content-key bundle: wraps a FRESH
- * content key to the projection's CURRENT KEK targets at the next
- * content-key epoch. A current reader can recover the stale bundle through
- * the container predecessor chain; the fresh key is still required so a
- * holder revoked by the container rotation cannot decrypt future updates.
- * Recovery re-encrypts a full-history snapshot under that fresh key.
- *
- * Like every content-key rotation (unlink included), this requires the KEK
- * of EVERY linked-container target: all envelopes in a bundle must wrap the
- * same key, so an inaccessible target's envelope can neither be carried
- * forward (it wraps the old key) nor fabricated. A writer authorized through
- * only a subset of a multi-container link set fails here with a named target
- * and leaves the heal to a member who spans all of them.
- */
-export declare function buildRotatedDocumentContentKeyBundle(input: {
-    containerKeksByEpochId: ReadonlyMap<string, Uint8Array>;
-    contentKey: Uint8Array;
-    writerProjection: DocumentWriterProjectionResponse;
-}): Promise<DocumentContentKeyBundleResponse>;
-export {};

package/data/documents/shared/projectionContentKeys.js

@@ -1,262 +0,0 @@
-import { ContentKeyEnvelopeError, computeDocumentContentKeyTargetHash, DOCUMENT_CONTENT_KEY_WRAP_SUITE, decodeContentKeyEnvelope, unwrapContentKey, wrapContentKey, } from "../../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../../internal/encoding/index.js";
-import { documentContainerProjections } from "../../keyingProjectionVerification/documentContainerProjections.js";
-import { throwKeyingVerificationErrorWithContext } from "../../keyingProjectionVerification/error.js";
-import { assertContainerKekPathCurrent, assertDocumentKekPathsCurrent, } from "./containerKekCurrency.js";
-import { unwrapContainerKekPath, unwrapContainerKekPathWithHistoryFailures, } from "./containerKekPath.js";
-import { ContainerKekHistoryUnavailableError } from "./containerKekPathHistory.js";
-import { deriveDocumentCreateTargets, describeProjectionTargetKek, readLinkedContainerIdsFromDocumentManifest, verifiedDocumentWrapTargets, } from "./projectionTargets.js";
-import { assertEqualBytes, describeDocumentTargetKek, normalizeDocumentKekTargetResponse, sortDocumentTargets, targetEnvelopeReference, } from "./readers.js";
-import { projectionVerificationOptions } from "./types.js";
-function getOnlyDocumentCreateTarget(projection) {
-    const target = deriveDocumentCreateTargets(projection)[0];
-    if (!target) {
-        throw new Error("Document create target is unavailable");
-    }
-    return target;
-}
-export async function wrapDocumentContentKeyForCreate(input) {
-    assertContainerKekPathCurrent(input.projection.containerKeks);
-    const keksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        projection: input.projection,
-        secretKey: input.secretKey,
-        ...projectionVerificationOptions(input),
-    });
-    const target = getOnlyDocumentCreateTarget(input.projection);
-    const targetKek = keksByEpochId.get(target.containerKeyEpochId);
-    if (!targetKek) {
-        throw new Error("Document create target KEK could not be unwrapped");
-    }
-    const wrapped = await wrapContentKey(input.contentKey, targetKek, {
-        kind: "Document",
-        objectId: input.documentId,
-        contentKeyEpoch: input.contentKeyEpoch,
-        containerId: target.containerId,
-        containerKeyEpochId: target.containerKeyEpochId,
-    });
-    return [
-        {
-            ...target,
-            wrappedKey: bytesToBase64(wrapped.ciphertext),
-            wrappingMetadata: {
-                suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,
-                iv: bytesToBase64(wrapped.iv),
-            },
-        },
-    ];
-}
-export async function unwrapContentKeyTargetForKind(input) {
-    // Reading, not submitting: the suite still binds the envelope to its object
-    // kind, but an unrecognized extra metadata key is ignored rather than making
-    // an otherwise decryptable envelope permanently unreadable. The AEAD tag is
-    // what authenticates the recovered key, bound to the object, content-key
-    // epoch and target it was sealed for. The KEK stays out of the decoder.
-    try {
-        return await unwrapContentKey(decodeContentKeyEnvelope({
-            envelope: input.envelope,
-            kind: input.kind,
-            origin: "stored",
-        }), input.containerKek, {
-            kind: input.kind,
-            objectId: input.objectId,
-            contentKeyEpoch: input.contentKeyEpoch,
-            containerId: input.envelope.containerId,
-            containerKeyEpochId: input.envelope.containerKeyEpochId,
-        });
-    }
-    catch (error) {
-        if (!input.decryptErrorMessage)
-            throw error;
-        // Keep the structural diagnostic; the wrapper only adds which target it
-        // was, which the decoder cannot know.
-        const detail = error instanceof ContentKeyEnvelopeError ? `: ${error.message}` : "";
-        throw new Error(`${input.decryptErrorMessage}${detail}`, { cause: error });
-    }
-}
-export async function unwrapDocumentContentKeyTarget(input) {
-    return unwrapContentKeyTargetForKind({
-        containerKek: input.containerKek,
-        contentKeyEpoch: input.contentKeyEpoch,
-        decryptErrorMessage: `Document content-key target for container ${input.envelope.containerId} at epoch ${input.envelope.containerKeyEpochId} could not be unwrapped`,
-        envelope: input.envelope,
-        kind: "Document",
-        objectId: input.documentId,
-    });
-}
-export class DocumentHistoryUnavailableError extends Error {
-    historyCause;
-    constructor(historyCause) {
-        super(historyCause instanceof Error
-            ? historyCause.message
-            : "Document history key is unavailable");
-        this.historyCause = historyCause;
-        this.name = "DocumentHistoryUnavailableError";
-    }
-}
-/** No verified target or predecessor path can supply this content key. */
-export class DocumentContentKeyUnavailableError extends Error {
-    constructor() {
-        super("Document content key could not be unwrapped");
-        this.name = "DocumentContentKeyUnavailableError";
-    }
-}
-function preferredPredecessorFailure(failures) {
-    return (failures.find((failure) => !(failure instanceof ContainerKekHistoryUnavailableError)) ?? failures[0]);
-}
-function recordPreferredPredecessorFailure(failures, key, failure) {
-    const existing = failures.get(key);
-    const preferred = preferredPredecessorFailure(existing ? [existing, failure] : [failure]);
-    if (preferred)
-        failures.set(key, preferred);
-}
-export async function collectContainerKeksForDocumentSync(input) {
-    const keksByEpochId = new Map();
-    const predecessorFailuresByEpochId = new Map();
-    const unattributedPredecessorFailuresByContainerId = new Map();
-    for (const projection of documentContainerProjections(input.writerProjection)) {
-        let projectionKeks;
-        try {
-            projectionKeks = await unwrapContainerKekPathWithHistoryFailures({
-                execSql: input.execSql,
-                knownContainerKeks: keksByEpochId,
-                persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-                principalPolicyCache: input.principalPolicyCache,
-                projection,
-                secretKey: input.secretKey,
-                verifiedByHash: input.verifiedByHash,
-                ...projectionVerificationOptions(input),
-            });
-        }
-        catch (error) {
-            throwKeyingVerificationErrorWithContext(error, `Document authorizing container KEK path could not be unwrapped for ${describeProjectionTargetKek(projection)}`);
-        }
-        for (const [containerKeyEpochId, failure,] of projectionKeks.predecessorFailuresByEpochId) {
-            recordPreferredPredecessorFailure(predecessorFailuresByEpochId, containerKeyEpochId, failure);
-        }
-        for (const [containerId, failure,] of projectionKeks.unattributedPredecessorFailuresByContainerId) {
-            recordPreferredPredecessorFailure(unattributedPredecessorFailuresByContainerId, containerId, failure);
-        }
-        for (const [containerKeyEpochId, keyMaterial,] of projectionKeks.keksByEpochId) {
-            const existing = keksByEpochId.get(containerKeyEpochId);
-            if (existing) {
-                assertEqualBytes(existing, keyMaterial, "Document writer projection contains conflicting container KEKs");
-                continue;
-            }
-            keksByEpochId.set(containerKeyEpochId, keyMaterial);
-        }
-    }
-    return {
-        keksByEpochId,
-        predecessorFailuresByEpochId,
-        unattributedPredecessorFailuresByContainerId,
-    };
-}
-export async function unwrapDocumentContentKeyFromBundle(bundle, 
-/** The document being read; its wraps must be sealed to it. */
-documentId, containerKeksByEpochId, predecessorFailuresByEpochId = new Map(), unattributedPredecessorFailuresByContainerId = new Map()) {
-    const canonicalTargetHash = await computeDocumentContentKeyTargetHash(sortDocumentTargets(bundle.targets.map(targetEnvelopeReference)));
-    if (canonicalTargetHash !== bundle.targetHash) {
-        throw new Error("Document content-key bundle target hash is not canonical");
-    }
-    if (bundle.documentId !== documentId) {
-        throw new Error("Document content-key bundle names another document");
-    }
-    let contentKey = null;
-    const predecessorFailures = [];
-    for (const envelope of bundle.targets) {
-        const containerKek = containerKeksByEpochId.get(envelope.containerKeyEpochId);
-        if (!containerKek) {
-            const predecessorFailure = predecessorFailuresByEpochId.get(envelope.containerKeyEpochId) ??
-                unattributedPredecessorFailuresByContainerId.get(envelope.containerId);
-            if (predecessorFailure)
-                predecessorFailures.push(predecessorFailure);
-            continue;
-        }
-        const unwrapped = await unwrapDocumentContentKeyTarget({
-            containerKek,
-            contentKeyEpoch: bundle.contentKeyEpoch,
-            documentId,
-            envelope,
-        });
-        if (contentKey) {
-            assertEqualBytes(contentKey, unwrapped, "Document content-key targets unwrap to conflicting keys");
-            continue;
-        }
-        contentKey = unwrapped;
-    }
-    if (!contentKey) {
-        const predecessorFailure = preferredPredecessorFailure(predecessorFailures);
-        if (predecessorFailure !== undefined) {
-            throw new DocumentHistoryUnavailableError(predecessorFailure);
-        }
-        throw new DocumentContentKeyUnavailableError();
-    }
-    if (contentKey.byteLength !== 32) {
-        throw new Error("Document content key must be 32 bytes");
-    }
-    return contentKey;
-}
-export async function unwrapDocumentContentKeyFromWriterProjection(input) {
-    const collectedKeks = await collectContainerKeksForDocumentSync(input);
-    return unwrapDocumentContentKeyFromBundle(input.writerProjection.contentKeyBundle, input.writerProjection.documentId, collectedKeks.keksByEpochId, collectedKeks.predecessorFailuresByEpochId, collectedKeks.unattributedPredecessorFailuresByContainerId);
-}
-/**
- * Builds the healing bundle for a stale content-key bundle: wraps a FRESH
- * content key to the projection's CURRENT KEK targets at the next
- * content-key epoch. A current reader can recover the stale bundle through
- * the container predecessor chain; the fresh key is still required so a
- * holder revoked by the container rotation cannot decrypt future updates.
- * Recovery re-encrypts a full-history snapshot under that fresh key.
- *
- * Like every content-key rotation (unlink included), this requires the KEK
- * of EVERY linked-container target: all envelopes in a bundle must wrap the
- * same key, so an inaccessible target's envelope can neither be carried
- * forward (it wraps the old key) nor fabricated. A writer authorized through
- * only a subset of a multi-container link set fails here with a named target
- * and leaves the heal to a member who spans all of them.
- */
-export async function buildRotatedDocumentContentKeyBundle(input) {
-    assertDocumentKekPathsCurrent(input.writerProjection);
-    const { contentKeyBundle, documentKekTargets } = input.writerProjection;
-    // The server list names the linked containers; each envelope's epoch comes
-    // from the verified authorizing-path leaf for that container.
-    const targets = verifiedDocumentWrapTargets({
-        linkedContainerIds: readLinkedContainerIdsFromDocumentManifest(input.writerProjection),
-        serverTargets: normalizeDocumentKekTargetResponse(documentKekTargets),
-        writerProjection: input.writerProjection,
-    });
-    const envelopes = [];
-    const contentKeyEpoch = contentKeyBundle.contentKeyEpoch + 1;
-    for (const target of targets) {
-        const containerKek = input.containerKeksByEpochId.get(target.containerKeyEpochId);
-        if (!containerKek) {
-            throw new Error(`Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`);
-        }
-        const wrapped = await wrapContentKey(input.contentKey, containerKek, {
-            kind: "Document",
-            objectId: contentKeyBundle.documentId,
-            contentKeyEpoch,
-            containerId: target.containerId,
-            containerKeyEpochId: target.containerKeyEpochId,
-        });
-        envelopes.push({
-            ...target,
-            wrappedKey: bytesToBase64(wrapped.ciphertext),
-            wrappingMetadata: {
-                suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,
-                iv: bytesToBase64(wrapped.iv),
-            },
-        });
-    }
-    return {
-        contentKeyEpoch,
-        documentId: contentKeyBundle.documentId,
-        linkSetManifestHash: documentKekTargets.linkSetManifestHash,
-        targetHash: documentKekTargets.documentKeyTargetHash,
-        targets: envelopes,
-    };
-}
-//# sourceMappingURL=projectionContentKeys.js.map

package/data/documents/shared/projectionContentKeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projectionContentKeys.js","sourceRoot":"","sources":["projectionContentKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,mCAAmC,EACnC,+BAA+B,EAC/B,wBAAwB,EACxB,gBAAgB,EAEhB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iEAAiE,CAAC;AAC/G,OAAO,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AAEnG,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,yCAAyC,GAC1C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAExD,SAAS,2BAA2B,CAClC,UAA6C;IAE7C,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,6BAA6B,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;QAChE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IAEH,OAAO;QACL;YACE,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAenD;IACC,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAC3B,wBAAwB,CAAC;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,QAAQ;SACjB,CAAC,EACF,KAAK,CAAC,YAAY,EAClB;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;YACvC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;SACxD,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,mBAAmB;YAAE,MAAM,KAAK,CAAC;QAC5C,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,MAAM,GACV,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,mBAAmB,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,OAAO,6BAA6B,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,mBAAmB,EAAE,6CAA6C,KAAK,CAAC,QAAQ,CAAC,WAAW,aAAa,KAAK,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;QACpK,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,YAAqB;QACxC,KAAK,CACH,YAAY,YAAY,KAAK;YAC3B,CAAC,CAAC,YAAY,CAAC,OAAO;YACtB,CAAC,CAAC,qCAAqC,CAC1C,CAAC;QALiB,iBAAY,GAAZ,YAAY,CAAS;QAMxC,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC3D;QACE,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,2BAA2B,CAClC,QAA0B;IAE1B,OAAO,CACL,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,mCAAmC,CAAC,CACvE,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,QAA4B,EAC5B,GAAW,EACX,OAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,2BAA2B,CAC3C,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAC3C,CAAC;IACF,IAAI,SAAS;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAOiC;IAEjC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9D,MAAM,4CAA4C,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE9E,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,cAEH,CAAC;QACF,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,yCAAyC,CAAC;gBAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,aAAa;gBACjC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;gBACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,GAAG,6BAA6B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC,CACrC,KAAK,EACL,sEAAsE,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAChH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,mBAAmB,EACnB,OAAO,EACR,IAAI,cAAc,CAAC,4BAA4B,EAAE,CAAC;YACjD,iCAAiC,CAC/B,4BAA4B,EAC5B,mBAAmB,EACnB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,WAAW,EACX,OAAO,EACR,IAAI,cAAc,CAAC,4CAA4C,EAAE,CAAC;YACjE,iCAAiC,CAC/B,4CAA4C,EAC5C,WAAW,EACX,OAAO,CACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,mBAAmB,EACnB,WAAW,EACZ,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACb,gBAAgB,CACd,QAAQ,EACR,WAAW,EACX,gEAAgE,CACjE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa;QACb,4BAA4B;QAC5B,4CAA4C;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwC;AACxC,+DAA+D;AAC/D,UAAkB,EAClB,sBAAuD,EACvD,+BAA2D,IAAI,GAAG,EAAE,EACpE,+CAGI,IAAI,GAAG,EAAE;IAEb,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CACnE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,mBAAmB,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,GAAsB,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAY,EAAE,CAAC;IAExC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAC7C,QAAQ,CAAC,mBAAmB,CAC7B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,kBAAkB,GACtB,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAC9D,4CAA4C,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,kBAAkB;gBAAE,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,YAAY;YACZ,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,UAAU;YACV,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CACd,UAAU,EACV,SAAS,EACT,yDAAyD,CAC1D,CAAC;YACF,SAAS;QACX,CAAC;QACD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;QAC5E,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAMiC;IAEjC,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAEvE,OAAO,kCAAkC,CACvC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAI1D;IACC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,2BAA2B,CAAC;QAC1C,kBAAkB,EAAE,0CAA0C,CAC5D,KAAK,CAAC,gBAAgB,CACvB;QACD,aAAa,EAAE,kCAAkC,CAAC,kBAAkB,CAAC;QACrE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,SAAS,GAAgD,EAAE,CAAC;IAClE,MAAM,eAAe,GAAG,gBAAgB,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,sBAAsB,CAAC,GAAG,CACnD,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,uDAAuD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE;YACnE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,gBAAgB,CAAC,UAAU;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC;YACb,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,mBAAmB,EAAE,kBAAkB,CAAC,mBAAmB;QAC3D,UAAU,EAAE,kBAAkB,CAAC,qBAAqB;QACpD,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  ContentKeyEnvelopeError,\n  type ContentKeyEnvelopeKind,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  type VerifiedContainerAccessManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentContentKeyBundleResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCache } from \"../../keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../keyingProjectionVerification/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../keyingProjectionVerification/error\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"./containerKekCurrency\";\nimport {\n  unwrapContainerKekPath,\n  unwrapContainerKekPathWithHistoryFailures,\n} from \"./containerKekPath\";\nimport { ContainerKekHistoryUnavailableError } from \"./containerKekPathHistory\";\nimport {\n  deriveDocumentCreateTargets,\n  describeProjectionTargetKek,\n  readLinkedContainerIdsFromDocumentManifest,\n  verifiedDocumentWrapTargets,\n} from \"./projectionTargets\";\nimport {\n  assertEqualBytes,\n  describeDocumentTargetKek,\n  normalizeDocumentKekTargetResponse,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n} from \"./readers\";\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { projectionVerificationOptions } from \"./types\";\n\nfunction getOnlyDocumentCreateTarget(\n  projection: ContainerWriterProjectionResponse,\n) {\n  const target = deriveDocumentCreateTargets(projection)[0];\n  if (!target) {\n    throw new Error(\"Document create target is unavailable\");\n  }\n  return target;\n}\n\nexport async function wrapDocumentContentKeyForCreate(\n  input: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    documentId: string;\n    execSql?: ExecSql | undefined;\n    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    projection: ContainerWriterProjectionResponse;\n    secretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  assertContainerKekPathCurrent(input.projection.containerKeks);\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    projection: input.projection,\n    secretKey: input.secretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const target = getOnlyDocumentCreateTarget(input.projection);\n  const targetKek = keksByEpochId.get(target.containerKeyEpochId);\n  if (!targetKek) {\n    throw new Error(\"Document create target KEK could not be unwrapped\");\n  }\n\n  const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n    kind: \"Document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n\n  return [\n    {\n      ...target,\n      wrappedKey: bytesToBase64(wrapped.ciphertext),\n      wrappingMetadata: {\n        suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n        iv: bytesToBase64(wrapped.iv),\n      },\n    },\n  ];\n}\n\nexport async function unwrapContentKeyTargetForKind(input: {\n  containerKek: Uint8Array;\n  /** The content-key epoch of the bundle the envelope was served in. */\n  contentKeyEpoch: number;\n  /** Wraps a decode or decrypt failure with this message. */\n  decryptErrorMessage?: string | undefined;\n  envelope: {\n    containerId: string;\n    containerKeyEpochId: string;\n    wrappedKey: string;\n    wrappingMetadata?: unknown;\n  };\n  kind: ContentKeyEnvelopeKind;\n  /** The document or blob the caller is reading, never read from the bundle. */\n  objectId: string;\n}): Promise<Uint8Array> {\n  // Reading, not submitting: the suite still binds the envelope to its object\n  // kind, but an unrecognized extra metadata key is ignored rather than making\n  // an otherwise decryptable envelope permanently unreadable. The AEAD tag is\n  // what authenticates the recovered key, bound to the object, content-key\n  // epoch and target it was sealed for. The KEK stays out of the decoder.\n  try {\n    return await unwrapContentKey(\n      decodeContentKeyEnvelope({\n        envelope: input.envelope,\n        kind: input.kind,\n        origin: \"stored\",\n      }),\n      input.containerKek,\n      {\n        kind: input.kind,\n        objectId: input.objectId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: input.envelope.containerId,\n        containerKeyEpochId: input.envelope.containerKeyEpochId,\n      },\n    );\n  } catch (error) {\n    if (!input.decryptErrorMessage) throw error;\n    // Keep the structural diagnostic; the wrapper only adds which target it\n    // was, which the decoder cannot know.\n    const detail =\n      error instanceof ContentKeyEnvelopeError ? `: ${error.message}` : \"\";\n    throw new Error(`${input.decryptErrorMessage}${detail}`, { cause: error });\n  }\n}\n\nexport async function unwrapDocumentContentKeyTarget(input: {\n  containerKek: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  envelope: DocumentContentKeyTargetEnvelope;\n}): Promise<Uint8Array> {\n  return unwrapContentKeyTargetForKind({\n    containerKek: input.containerKek,\n    contentKeyEpoch: input.contentKeyEpoch,\n    decryptErrorMessage: `Document content-key target for container ${input.envelope.containerId} at epoch ${input.envelope.containerKeyEpochId} could not be unwrapped`,\n    envelope: input.envelope,\n    kind: \"Document\",\n    objectId: input.documentId,\n  });\n}\n\ninterface CollectedContainerKeks {\n  readonly keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  readonly predecessorFailuresByEpochId: ReadonlyMap<string, Error>;\n  readonly unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  >;\n}\n\nexport class DocumentHistoryUnavailableError extends Error {\n  constructor(readonly historyCause: unknown) {\n    super(\n      historyCause instanceof Error\n        ? historyCause.message\n        : \"Document history key is unavailable\",\n    );\n    this.name = \"DocumentHistoryUnavailableError\";\n  }\n}\n\n/** No verified target or predecessor path can supply this content key. */\nexport class DocumentContentKeyUnavailableError extends Error {\n  constructor() {\n    super(\"Document content key could not be unwrapped\");\n    this.name = \"DocumentContentKeyUnavailableError\";\n  }\n}\n\nfunction preferredPredecessorFailure(\n  failures: readonly Error[],\n): Error | undefined {\n  return (\n    failures.find(\n      (failure) => !(failure instanceof ContainerKekHistoryUnavailableError),\n    ) ?? failures[0]\n  );\n}\n\nfunction recordPreferredPredecessorFailure(\n  failures: Map<string, Error>,\n  key: string,\n  failure: Error,\n): void {\n  const existing = failures.get(key);\n  const preferred = preferredPredecessorFailure(\n    existing ? [existing, failure] : [failure],\n  );\n  if (preferred) failures.set(key, preferred);\n}\n\nexport async function collectContainerKeksForDocumentSync(\n  input: {\n    execSql?: ExecSql | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    secretKey: Uint8Array;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<CollectedContainerKeks> {\n  const keksByEpochId = new Map<string, Uint8Array>();\n  const predecessorFailuresByEpochId = new Map<string, Error>();\n  const unattributedPredecessorFailuresByContainerId = new Map<string, Error>();\n\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    let projectionKeks: Awaited<\n      ReturnType<typeof unwrapContainerKekPathWithHistoryFailures>\n    >;\n    try {\n      projectionKeks = await unwrapContainerKekPathWithHistoryFailures({\n        execSql: input.execSql,\n        knownContainerKeks: keksByEpochId,\n        persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        secretKey: input.secretKey,\n        verifiedByHash: input.verifiedByHash,\n        ...projectionVerificationOptions(input),\n      });\n    } catch (error) {\n      throwKeyingVerificationErrorWithContext(\n        error,\n        `Document authorizing container KEK path could not be unwrapped for ${describeProjectionTargetKek(projection)}`,\n      );\n    }\n    for (const [\n      containerKeyEpochId,\n      failure,\n    ] of projectionKeks.predecessorFailuresByEpochId) {\n      recordPreferredPredecessorFailure(\n        predecessorFailuresByEpochId,\n        containerKeyEpochId,\n        failure,\n      );\n    }\n    for (const [\n      containerId,\n      failure,\n    ] of projectionKeks.unattributedPredecessorFailuresByContainerId) {\n      recordPreferredPredecessorFailure(\n        unattributedPredecessorFailuresByContainerId,\n        containerId,\n        failure,\n      );\n    }\n    for (const [\n      containerKeyEpochId,\n      keyMaterial,\n    ] of projectionKeks.keksByEpochId) {\n      const existing = keksByEpochId.get(containerKeyEpochId);\n      if (existing) {\n        assertEqualBytes(\n          existing,\n          keyMaterial,\n          \"Document writer projection contains conflicting container KEKs\",\n        );\n        continue;\n      }\n      keksByEpochId.set(containerKeyEpochId, keyMaterial);\n    }\n  }\n\n  return {\n    keksByEpochId,\n    predecessorFailuresByEpochId,\n    unattributedPredecessorFailuresByContainerId,\n  };\n}\n\nexport async function unwrapDocumentContentKeyFromBundle(\n  bundle: DocumentContentKeyBundleResponse,\n  /** The document being read; its wraps must be sealed to it. */\n  documentId: string,\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>,\n  predecessorFailuresByEpochId: ReadonlyMap<string, Error> = new Map(),\n  unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  > = new Map(),\n): Promise<Uint8Array> {\n  const canonicalTargetHash = await computeDocumentContentKeyTargetHash(\n    sortDocumentTargets(bundle.targets.map(targetEnvelopeReference)),\n  );\n  if (canonicalTargetHash !== bundle.targetHash) {\n    throw new Error(\"Document content-key bundle target hash is not canonical\");\n  }\n  if (bundle.documentId !== documentId) {\n    throw new Error(\"Document content-key bundle names another document\");\n  }\n  let contentKey: Uint8Array | null = null;\n  const predecessorFailures: Error[] = [];\n\n  for (const envelope of bundle.targets) {\n    const containerKek = containerKeksByEpochId.get(\n      envelope.containerKeyEpochId,\n    );\n    if (!containerKek) {\n      const predecessorFailure =\n        predecessorFailuresByEpochId.get(envelope.containerKeyEpochId) ??\n        unattributedPredecessorFailuresByContainerId.get(envelope.containerId);\n      if (predecessorFailure) predecessorFailures.push(predecessorFailure);\n      continue;\n    }\n    const unwrapped = await unwrapDocumentContentKeyTarget({\n      containerKek,\n      contentKeyEpoch: bundle.contentKeyEpoch,\n      documentId,\n      envelope,\n    });\n    if (contentKey) {\n      assertEqualBytes(\n        contentKey,\n        unwrapped,\n        \"Document content-key targets unwrap to conflicting keys\",\n      );\n      continue;\n    }\n    contentKey = unwrapped;\n  }\n\n  if (!contentKey) {\n    const predecessorFailure = preferredPredecessorFailure(predecessorFailures);\n    if (predecessorFailure !== undefined) {\n      throw new DocumentHistoryUnavailableError(predecessorFailure);\n    }\n    throw new DocumentContentKeyUnavailableError();\n  }\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n\n  return contentKey;\n}\n\nexport async function unwrapDocumentContentKeyFromWriterProjection(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    secretKey: Uint8Array;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<Uint8Array> {\n  const collectedKeks = await collectContainerKeksForDocumentSync(input);\n\n  return unwrapDocumentContentKeyFromBundle(\n    input.writerProjection.contentKeyBundle,\n    input.writerProjection.documentId,\n    collectedKeks.keksByEpochId,\n    collectedKeks.predecessorFailuresByEpochId,\n    collectedKeks.unattributedPredecessorFailuresByContainerId,\n  );\n}\n\n/**\n * Builds the healing bundle for a stale content-key bundle: wraps a FRESH\n * content key to the projection's CURRENT KEK targets at the next\n * content-key epoch. A current reader can recover the stale bundle through\n * the container predecessor chain; the fresh key is still required so a\n * holder revoked by the container rotation cannot decrypt future updates.\n * Recovery re-encrypts a full-history snapshot under that fresh key.\n *\n * Like every content-key rotation (unlink included), this requires the KEK\n * of EVERY linked-container target: all envelopes in a bundle must wrap the\n * same key, so an inaccessible target's envelope can neither be carried\n * forward (it wraps the old key) nor fabricated. A writer authorized through\n * only a subset of a multi-container link set fails here with a named target\n * and leaves the heal to a member who spans all of them.\n */\nexport async function buildRotatedDocumentContentKeyBundle(input: {\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>;\n  contentKey: Uint8Array;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentContentKeyBundleResponse> {\n  assertDocumentKekPathsCurrent(input.writerProjection);\n  const { contentKeyBundle, documentKekTargets } = input.writerProjection;\n  // The server list names the linked containers; each envelope's epoch comes\n  // from the verified authorizing-path leaf for that container.\n  const targets = verifiedDocumentWrapTargets({\n    linkedContainerIds: readLinkedContainerIdsFromDocumentManifest(\n      input.writerProjection,\n    ),\n    serverTargets: normalizeDocumentKekTargetResponse(documentKekTargets),\n    writerProjection: input.writerProjection,\n  });\n  const envelopes: DocumentContentKeyBundleResponse[\"targets\"] = [];\n  const contentKeyEpoch = contentKeyBundle.contentKeyEpoch + 1;\n\n  for (const target of targets) {\n    const containerKek = input.containerKeksByEpochId.get(\n      target.containerKeyEpochId,\n    );\n    if (!containerKek) {\n      throw new Error(\n        `Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`,\n      );\n    }\n    const wrapped = await wrapContentKey(input.contentKey, containerKek, {\n      kind: \"Document\",\n      objectId: contentKeyBundle.documentId,\n      contentKeyEpoch,\n      containerId: target.containerId,\n      containerKeyEpochId: target.containerKeyEpochId,\n    });\n    envelopes.push({\n      ...target,\n      wrappedKey: bytesToBase64(wrapped.ciphertext),\n      wrappingMetadata: {\n        suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n        iv: bytesToBase64(wrapped.iv),\n      },\n    });\n  }\n\n  return {\n    contentKeyEpoch,\n    documentId: contentKeyBundle.documentId,\n    linkSetManifestHash: documentKekTargets.linkSetManifestHash,\n    targetHash: documentKekTargets.documentKeyTargetHash,\n    targets: envelopes,\n  };\n}\n"]}

package/data/documents/shared/projectionTargets.d.ts

@@ -1,38 +0,0 @@
-import { type DocumentContentKeyTarget } from "../../../internal/crypto/index.js";
-import type { ContainerManifestRef, DocumentContentKeyTargetEnvelope } from "../../../internal/validators/request/index.js";
-import type { ContainerKeyingPathResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { DocumentLinkSetMutationOperation } from "./types.js";
-export declare function deriveDocumentCreateTargets(projection: ContainerKeyingPathResponse): DocumentContentKeyTarget[];
-export declare function mergeTargetEnvelopes(targets: readonly DocumentContentKeyTarget[], envelopes: readonly DocumentContentKeyTargetEnvelope[]): DocumentContentKeyTargetEnvelope[];
-export declare function describeProjectionTargetKek(projection: ContainerKeyingPathResponse): string;
-export declare function deriveDocumentTargetFromProjection(projection: ContainerKeyingPathResponse): DocumentContentKeyTarget;
-export declare function readLinkedContainerIdsFromDocumentManifest(writerProjection: DocumentWriterProjectionResponse): string[];
-/**
- * The targets a content-key (re)wrap may address. The server's KEK target list
- * only says which linked containers the bundle must cover; the epoch each
- * envelope lands on comes from that container's verified authorizing-path
- * leaf, never from the server row. A listed epoch that is not the linked
- * container's verified current head — a predecessor a revoked member still
- * holds, or another container's epoch — therefore fails before any wrap, as
- * does a container listed twice. A linked container with no authorizing path
- * is an availability gap, not tampering: its KEK is simply unavailable here.
- */
-export declare function verifiedDocumentWrapTargets(input: {
-    linkedContainerIds: readonly string[];
-    serverTargets: readonly DocumentContentKeyTarget[];
-    writerProjection: DocumentWriterProjectionResponse;
-}): DocumentContentKeyTarget[];
-export declare function currentDocumentTargets(writerProjection: DocumentWriterProjectionResponse): DocumentContentKeyTarget[];
-/**
- * Reduce a single container path (root→leaf chain) to {containerId,
- * manifestHash} references. The server already stores each manifest and resolves
- * it from its own store, so a write echoes only the hashes instead of
- * re-embedding the full signed bundles it received in the writer projection.
- */
-export declare function containerPathRefs(path: ContainerKeyingPathResponse["path"]): ContainerManifestRef[];
-export declare function authorizingContainerPathRefs(writerProjection: DocumentWriterProjectionResponse): ContainerManifestRef[][];
-export declare function authorizingContainerPathRefsForLinkSet(input: {
-    operation: DocumentLinkSetMutationOperation;
-    targetContainerId: string;
-    writerProjection: DocumentWriterProjectionResponse;
-}): ContainerManifestRef[][];