@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/documents/shared/syncResponses.js

@@ -1,285 +0,0 @@
-import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, verifyWriteHeader, } from "../../../internal/crypto/index.js";
-import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
-import { DOCUMENT_NOT_FOUND_ERROR_CODE, DOCUMENT_SYNC_ERROR_CODES, } from "../../../internal/validators/response/index.js";
-import { parseWalLsn } from "../../../internal/validators/util/index.js";
-import { throwKeyingVerificationShapeFailure } from "../../keyingProjectionVerification/error.js";
-import { readRecordPositiveInteger, readRecordString, readWriteHeader, serializeCanonical, serializedPersistedDocumentState, } from "./readers.js";
-export { submitDocumentSync } from "./syncPagination.js";
-import { documentWriteAuthorizationForHeader } from "./syncResponseAuthorization.js";
-// Remote-primary databases without a portable WAL position use the zero LSN
-// as an explicit "checkpoint not tracked" sentinel. It is accepted only when
-// the response declares that mode, letting a local record carrying a checkpoint
-// from another backend move to that primary without weakening tracked checks.
-// This protects against replica lag, not a server that falsely declares its own
-// consistency capability; the authenticated server remains the source of data.
-const UNTRACKED_COMMIT_LSN = "0/0";
-export class DocumentSyncResponseUpdateContentKeyError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "DocumentSyncResponseUpdateContentKeyError";
-    }
-}
-function assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response) {
-    const expected = plan.request.outgoingUpdates.map((update) => update.id);
-    const accepted = response.acceptedOutgoingUpdateIds;
-    const expectedSorted = [...expected].sort();
-    const acceptedSorted = [...accepted].sort();
-    if (expectedSorted.length !== acceptedSorted.length ||
-        expectedSorted.some((id, index) => id !== acceptedSorted[index])) {
-        throw new Error("Document sync response accepted update mismatch");
-    }
-}
-async function assertDocumentSyncResponseUpdateMatchesPlan(input) {
-    const { plan, update } = input;
-    if (update.documentId !== plan.documentId) {
-        throw new Error("Document sync response update document mismatch");
-    }
-    const header = readWriteHeader(update.writeHeader, "Document sync response write header");
-    await assertDocumentSyncResponseUpdateHashes({ update });
-    const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({
-        contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,
-        header,
-        plan,
-    });
-    assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });
-    await assertDocumentSyncResponseNonceDomain({ header, plan });
-    await assertDocumentSyncResponseWriteHeaderSignature({
-        header,
-        contentKeyBundle,
-        plan,
-        resolveWriterPublicKey: input.resolveWriterPublicKey,
-        update,
-    });
-}
-function assertDocumentSyncResponseUpdateContentKeyBundle(input) {
-    const { header, plan } = input;
-    if (header.contentKeyEpoch > plan.contentKeyEpoch) {
-        throw new DocumentSyncResponseUpdateContentKeyError("Document sync response includes a future content-key epoch");
-    }
-    const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);
-    if (!bundle) {
-        throw new DocumentSyncResponseUpdateContentKeyError("Document sync response content-key bundle missing");
-    }
-    if (bundle.documentId !== plan.documentId ||
-        bundle.contentKeyEpoch !== header.contentKeyEpoch) {
-        throw new Error("Document sync response content-key bundle mismatch");
-    }
-    return bundle;
-}
-async function assertDocumentSyncResponseUpdateHashes(input) {
-    const { update } = input;
-    const ciphertextHash = await computeDocumentContentRecordCiphertextHash(update.encryptedData);
-    if (ciphertextHash !==
-        readRecordString(update.writeHeader, "ciphertextHash", "write header")) {
-        throw new Error("Document sync response ciphertext hash mismatch");
-    }
-    const metadataHash = await computeDocumentContentRecordMetadataHash({
-        ...(update.checkpointKind === undefined
-            ? {}
-            : { checkpointKind: update.checkpointKind }),
-        ...(update.checkpointPayloadKind === undefined
-            ? {}
-            : { checkpointPayloadKind: update.checkpointPayloadKind }),
-        documentId: update.documentId,
-        partialEndVersionVector: update.partialEndVersionVector,
-        partialStartVersionVector: update.partialStartVersionVector,
-        plaintextHash: update.plaintextHash,
-        ...(update.sourceVersionVector === undefined
-            ? {}
-            : { sourceVersionVector: update.sourceVersionVector }),
-        updateId: update.id,
-    });
-    if (metadataHash !==
-        readRecordString(update.writeHeader, "metadataHash", "write header")) {
-        throw new Error("Document sync response metadata hash mismatch");
-    }
-}
-function assertDocumentSyncResponseWriteHeaderFields(input) {
-    const { header, plan, update } = input;
-    const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);
-    if (header.version !== 1 ||
-        header.objectKind !== "document" ||
-        header.objectId !== plan.documentId ||
-        header.organizationId !== plan.organizationId ||
-        header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||
-        header.writerKeyFingerprint !== update.authorFingerprint ||
-        (mustMatchCurrentBoundary &&
-            (header.contentKeyEpoch !== plan.contentKeyEpoch ||
-                header.accessManifestHash !== plan.expectedLinkSetManifestHash ||
-                header.targetHash !== plan.expectedTargetHash))) {
-        throw new Error("Document sync response write header mismatch");
-    }
-}
-function isAcceptedOutgoingSyncUpdate(plan, update) {
-    return plan.request.outgoingUpdates.some((outgoingUpdate) => outgoingUpdate.id === update.id);
-}
-async function assertDocumentSyncResponseNonceDomain(input) {
-    const { header, plan } = input;
-    const nonceDomainHash = await computeContentRecordNonceDomainHash({
-        version: 1,
-        organizationId: plan.organizationId,
-        objectKind: "document",
-        objectId: plan.documentId,
-        contentKeyEpoch: header.contentKeyEpoch,
-        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
-        contentRecordId: header.contentRecordId,
-    });
-    if (nonceDomainHash !== header.nonceDomainHash) {
-        throw new Error("Document sync response nonce domain mismatch");
-    }
-}
-async function assertDocumentSyncResponseWriteHeaderSignature(input) {
-    const { header, plan, update } = input;
-    const writerPublicKey = await input.resolveWriterPublicKey({
-        writerSigningKeyFingerprint: header.writerKeyFingerprint,
-        writerUserId: header.writerUserId,
-    });
-    if (!writerPublicKey) {
-        throw new Error("Document sync response writer public key missing");
-    }
-    const documentAuthorization = await documentWriteAuthorizationForHeader({
-        allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),
-        authorizationTargets: update.authorizationTargets,
-        dependencyManifestHashes: header.dependencyManifestHashes,
-        contentKeyBundle: input.contentKeyBundle,
-        manifestHash: header.accessManifestHash,
-        plan,
-        targetHash: header.targetHash,
-    });
-    const verified = await verifyWriteHeader({
-        authorizationMembership: "referenced",
-        expectedAccessManifestHash: documentAuthorization
-            ? header.accessManifestHash
-            : plan.expectedLinkSetManifestHash,
-        expectedObject: {
-            objectKind: "document",
-            objectId: plan.documentId,
-            organizationId: plan.organizationId,
-        },
-        header,
-        ...(documentAuthorization ? { documentAuthorization } : {}),
-        expectedTargetHash: documentAuthorization
-            ? header.targetHash
-            : plan.expectedTargetHash,
-        writerPublicKey,
-    });
-    if (!verified.ok) {
-        throw verified.error;
-    }
-}
-function assertDocumentSyncCommitCheckpointMatchesPlan(plan, response) {
-    if (response.commitLsnMode === "untracked" &&
-        response.commitLsn !== UNTRACKED_COMMIT_LSN) {
-        throw new Error("Document sync response untracked commit LSN must use the 0/0 sentinel");
-    }
-    if (response.commitLsn === UNTRACKED_COMMIT_LSN &&
-        response.commitLsnMode !== "untracked") {
-        throw new Error("Document sync response 0/0 commit LSN must be declared untracked");
-    }
-    if (response.commitLsn !== null) {
-        parseWalLsn(response.commitLsn, "Document sync response commit LSN");
-    }
-    if (plan.minLsn === undefined) {
-        return;
-    }
-    const minLsn = parseWalLsn(plan.minLsn, "Document sync requested minimum LSN");
-    if (response.commitLsn === null) {
-        throw new Error("Document sync response commit LSN is missing");
-    }
-    if (!(response.commitLsn === UNTRACKED_COMMIT_LSN &&
-        response.commitLsnMode === "untracked") &&
-        parseWalLsn(response.commitLsn, "Document sync response commit LSN") <
-            minLsn) {
-        throw new Error("Document sync response commit LSN is stale");
-    }
-}
-function documentSyncManifestEpoch(plan) {
-    if (!isPlainRecord(plan.documentManifest.state)) {
-        throw new Error("Document sync manifest state is invalid");
-    }
-    return readRecordPositiveInteger(plan.documentManifest.state, "epoch", "Document sync manifest state");
-}
-// The one load-bearing epoch check: no returned update may claim an
-// accessEpoch newer than the current manifest epoch.
-function assertDocumentSyncAccessEpochsNotInFuture(plan, response) {
-    const currentAccessEpoch = documentSyncManifestEpoch(plan);
-    for (const update of response.updates) {
-        if (update.accessEpoch > currentAccessEpoch) {
-            throw new Error("Document sync response includes a future access epoch");
-        }
-    }
-}
-function contentKeyBundleCanonical(bundle) {
-    return serializeCanonical(bundle, "content-key bundle");
-}
-function documentSyncContentKeyBundlesByEpoch(plan, response) {
-    if (contentKeyBundleCanonical(response.contentKeyBundle) !==
-        contentKeyBundleCanonical(plan.sourceContentKeyBundle)) {
-        throw new Error("Document sync response content-key bundle mismatch");
-    }
-    const bundleByEpoch = new Map();
-    const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];
-    for (const bundle of bundles) {
-        if (bundle.documentId !== plan.documentId) {
-            throw new Error("Document sync response content-key bundle document mismatch");
-        }
-        if (!Number.isInteger(bundle.contentKeyEpoch) ||
-            bundle.contentKeyEpoch <= 0) {
-            throw new Error("Document sync response content-key bundle epoch mismatch");
-        }
-        // The current epoch travels only as contentKeyBundle; the array carries
-        // each older epoch once.
-        if (bundleByEpoch.has(bundle.contentKeyEpoch)) {
-            throw new Error("Document sync response repeats a content-key epoch");
-        }
-        bundleByEpoch.set(bundle.contentKeyEpoch, bundle);
-    }
-    return bundleByEpoch;
-}
-async function persistedDocumentSyncStateFromResponseInternal(plan, response, options) {
-    if (response.documentId !== plan.documentId) {
-        throw new Error("Document sync response document id mismatch");
-    }
-    const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(plan, response);
-    if (serializeCanonical(response.documentKekTargets, "KEK targets") !==
-        serializeCanonical(plan.documentKekTargets, "KEK targets")) {
-        throw new Error("Document sync response KEK target mismatch");
-    }
-    assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);
-    assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);
-    assertDocumentSyncAccessEpochsNotInFuture(plan, response);
-    await Promise.all(response.updates.map((update) => assertDocumentSyncResponseUpdateMatchesPlan({
-        contentKeyBundlesByEpoch,
-        plan,
-        resolveWriterPublicKey: options.resolveWriterPublicKey,
-        update,
-    })));
-    return serializedPersistedDocumentState({
-        contentKeyBundle: response.contentKeyBundle,
-        documentId: plan.documentId,
-        documentKekTargets: response.documentKekTargets,
-        documentManifestBundle: plan.documentManifest,
-    });
-}
-export async function persistedDocumentSyncStateFromResponse(plan, response, options) {
-    try {
-        return await persistedDocumentSyncStateFromResponseInternal(plan, response, options);
-    }
-    catch (error) {
-        if (error instanceof DocumentSyncResponseUpdateContentKeyError)
-            throw error;
-        throwKeyingVerificationShapeFailure(error);
-    }
-}
-export function isRetryableDocumentSyncConflict(failure) {
-    return (failure.status === 409 &&
-        failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale);
-}
-// The wipe gate is deliberately strict — coded 404s only, which is the right
-// failure mode for a destructive action. A bare 404 proves nothing about the
-// document: proxy/tunnel error pages, deploy-skew route misses, and
-// container-level lookups all produce one.
-export function isUpstreamDeletedDocumentSyncFailure(failure) {
-    return (failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE);
-}
-//# sourceMappingURL=syncResponses.js.map

package/data/documents/shared/syncResponses.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncResponses.js","sourceRoot":"","sources":["syncResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAQlF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAClE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,wCAAwC,CAC/C,IAAsB,EACtB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IACE,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2CAA2C,CAAC,KAQ1D;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;IACF,MAAM,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;QACxE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM;QACN,IAAI;KACL,CAAC,CAAC;IACH,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,qCAAqC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,8CAA8C,CAAC;QACnD,MAAM;QACN,gBAAgB;QAChB,IAAI;QACJ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gDAAgD,CAAC,KAOzD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,IAAI,yCAAyC,CACjD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yCAAyC,CACjD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACrC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAErD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,YAAY;QACZ,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,2CAA2C,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5E,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;QACnC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC7C,MAAM,CAAC,eAAe,KAAK,+BAA+B;QAC1D,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,iBAAiB;QACxD,CAAC,wBAAwB;YACvB,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC9C,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,2BAA2B;gBAC9D,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,MAA+C;IAE/C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CACtC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qCAAqC,CAAC,KAGpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAC;IACH,IAAI,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAM7D;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;QACzD,2BAA2B,EAAE,MAAM,CAAC,oBAAoB;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,yBAAyB,EAAE,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC;QACrE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,0BAA0B,EAAE,qBAAqB;YAC/C,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,IAAI,CAAC,2BAA2B;QACpC,cAAc,EAAE;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;QACD,MAAM;QACN,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,kBAAkB,EAAE,qBAAqB;YACvC,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,IAAI,CAAC,kBAAkB;QAC3B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,6CAA6C,CACpD,IAAsB,EACtB,QAA8B;IAE9B,IACE,QAAQ,CAAC,aAAa,KAAK,WAAW;QACtC,QAAQ,CAAC,SAAS,KAAK,oBAAoB,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CACxB,IAAI,CAAC,MAAM,EACX,qCAAqC,CACtC,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IACE,CAAC,CACC,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,CACvC;QACD,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAClE,MAAM,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,yBAAyB,CAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAC3B,OAAO,EACP,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,qDAAqD;AACrD,SAAS,yCAAyC,CAChD,IAAsB,EACtB,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,WAAW,GAAG,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgD;IAEhD,OAAO,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oCAAoC,CAC3C,IAAsB,EACtB,QAA8B;IAE9B,IACE,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpD,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,CAAC,eAAe,IAAI,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8CAA8C,CAC3D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,IAAI,EACJ,QAAQ,CACT,CAAC;IACF,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC9D,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,wCAAwC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,6CAA6C,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9D,yCAAyC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,2CAA2C,CAAC;QAC1C,wBAAwB;QACxB,IAAI;QACJ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IAEF,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,8CAA8C,CACzD,IAAI,EACJ,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yCAAyC;YAAE,MAAM,KAAK,CAAC;QAC5E,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,UAAU,CACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,UAAU,oCAAoC,CAClD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,6BAA6B,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  verifyWriteHeader,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  DOCUMENT_SYNC_ERROR_CODES,\n  type DocumentSyncResponse,\n} from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport { throwKeyingVerificationShapeFailure } from \"../../keyingProjectionVerification/error\";\nimport {\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"./readers\";\n\nexport { submitDocumentSync } from \"./syncPagination\";\n\nimport { documentWriteAuthorizationForHeader } from \"./syncResponseAuthorization\";\nimport type {\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n  DocumentWriterPublicKeyResolver,\n  PersistedDocumentSyncState,\n} from \"./types\";\n\n// Remote-primary databases without a portable WAL position use the zero LSN\n// as an explicit \"checkpoint not tracked\" sentinel. It is accepted only when\n// the response declares that mode, letting a local record carrying a checkpoint\n// from another backend move to that primary without weakening tracked checks.\n// This protects against replica lag, not a server that falsely declares its own\n// consistency capability; the authenticated server remains the source of data.\nconst UNTRACKED_COMMIT_LSN = \"0/0\";\n\nexport class DocumentSyncResponseUpdateContentKeyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DocumentSyncResponseUpdateContentKeyError\";\n  }\n}\n\nfunction assertAcceptedOutgoingUpdateIdsMatchPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const expected = plan.request.outgoingUpdates.map((update) => update.id);\n  const accepted = response.acceptedOutgoingUpdateIds;\n  const expectedSorted = [...expected].sort();\n  const acceptedSorted = [...accepted].sort();\n  if (\n    expectedSorted.length !== acceptedSorted.length ||\n    expectedSorted.some((id, index) => id !== acceptedSorted[index])\n  ) {\n    throw new Error(\"Document sync response accepted update mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseUpdateMatchesPlan(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n}): Promise<void> {\n  const { plan, update } = input;\n  if (update.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response update document mismatch\");\n  }\n  const header = readWriteHeader(\n    update.writeHeader,\n    \"Document sync response write header\",\n  );\n  await assertDocumentSyncResponseUpdateHashes({ update });\n  const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({\n    contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,\n    header,\n    plan,\n  });\n  assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });\n  await assertDocumentSyncResponseNonceDomain({ header, plan });\n  await assertDocumentSyncResponseWriteHeaderSignature({\n    header,\n    contentKeyBundle,\n    plan,\n    resolveWriterPublicKey: input.resolveWriterPublicKey,\n    update,\n  });\n}\n\nfunction assertDocumentSyncResponseUpdateContentKeyBundle(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): DocumentSyncResponse[\"contentKeyBundle\"] {\n  const { header, plan } = input;\n  if (header.contentKeyEpoch > plan.contentKeyEpoch) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response includes a future content-key epoch\",\n    );\n  }\n\n  const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);\n  if (!bundle) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response content-key bundle missing\",\n    );\n  }\n  if (\n    bundle.documentId !== plan.documentId ||\n    bundle.contentKeyEpoch !== header.contentKeyEpoch\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n  return bundle;\n}\n\nasync function assertDocumentSyncResponseUpdateHashes(input: {\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { update } = input;\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    update.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response ciphertext hash mismatch\");\n  }\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: update.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    metadataHash !==\n    readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response metadata hash mismatch\");\n  }\n}\n\nfunction assertDocumentSyncResponseWriteHeaderFields(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): void {\n  const { header, plan, update } = input;\n  const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);\n\n  if (\n    header.version !== 1 ||\n    header.objectKind !== \"document\" ||\n    header.objectId !== plan.documentId ||\n    header.organizationId !== plan.organizationId ||\n    header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||\n    header.writerKeyFingerprint !== update.authorFingerprint ||\n    (mustMatchCurrentBoundary &&\n      (header.contentKeyEpoch !== plan.contentKeyEpoch ||\n        header.accessManifestHash !== plan.expectedLinkSetManifestHash ||\n        header.targetHash !== plan.expectedTargetHash))\n  ) {\n    throw new Error(\"Document sync response write header mismatch\");\n  }\n}\n\nfunction isAcceptedOutgoingSyncUpdate(\n  plan: DocumentSyncPlan,\n  update: DocumentSyncResponse[\"updates\"][number],\n): boolean {\n  return plan.request.outgoingUpdates.some(\n    (outgoingUpdate) => outgoingUpdate.id === update.id,\n  );\n}\n\nasync function assertDocumentSyncResponseNonceDomain(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): Promise<void> {\n  const { header, plan } = input;\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: plan.organizationId,\n    objectKind: \"document\",\n    objectId: plan.documentId,\n    contentKeyEpoch: header.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: header.contentRecordId,\n  });\n  if (nonceDomainHash !== header.nonceDomainHash) {\n    throw new Error(\"Document sync response nonce domain mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseWriteHeaderSignature(input: {\n  contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { header, plan, update } = input;\n  const writerPublicKey = await input.resolveWriterPublicKey({\n    writerSigningKeyFingerprint: header.writerKeyFingerprint,\n    writerUserId: header.writerUserId,\n  });\n  if (!writerPublicKey) {\n    throw new Error(\"Document sync response writer public key missing\");\n  }\n\n  const documentAuthorization = await documentWriteAuthorizationForHeader({\n    allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),\n    authorizationTargets: update.authorizationTargets,\n    dependencyManifestHashes: header.dependencyManifestHashes,\n    contentKeyBundle: input.contentKeyBundle,\n    manifestHash: header.accessManifestHash,\n    plan,\n    targetHash: header.targetHash,\n  });\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    expectedAccessManifestHash: documentAuthorization\n      ? header.accessManifestHash\n      : plan.expectedLinkSetManifestHash,\n    expectedObject: {\n      objectKind: \"document\",\n      objectId: plan.documentId,\n      organizationId: plan.organizationId,\n    },\n    header,\n    ...(documentAuthorization ? { documentAuthorization } : {}),\n    expectedTargetHash: documentAuthorization\n      ? header.targetHash\n      : plan.expectedTargetHash,\n    writerPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n\nfunction assertDocumentSyncCommitCheckpointMatchesPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  if (\n    response.commitLsnMode === \"untracked\" &&\n    response.commitLsn !== UNTRACKED_COMMIT_LSN\n  ) {\n    throw new Error(\n      \"Document sync response untracked commit LSN must use the 0/0 sentinel\",\n    );\n  }\n  if (\n    response.commitLsn === UNTRACKED_COMMIT_LSN &&\n    response.commitLsnMode !== \"untracked\"\n  ) {\n    throw new Error(\n      \"Document sync response 0/0 commit LSN must be declared untracked\",\n    );\n  }\n  if (response.commitLsn !== null) {\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\");\n  }\n  if (plan.minLsn === undefined) {\n    return;\n  }\n  const minLsn = parseWalLsn(\n    plan.minLsn,\n    \"Document sync requested minimum LSN\",\n  );\n  if (response.commitLsn === null) {\n    throw new Error(\"Document sync response commit LSN is missing\");\n  }\n  if (\n    !(\n      response.commitLsn === UNTRACKED_COMMIT_LSN &&\n      response.commitLsnMode === \"untracked\"\n    ) &&\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\") <\n      minLsn\n  ) {\n    throw new Error(\"Document sync response commit LSN is stale\");\n  }\n}\n\nfunction documentSyncManifestEpoch(plan: DocumentSyncPlan): number {\n  if (!isPlainRecord(plan.documentManifest.state)) {\n    throw new Error(\"Document sync manifest state is invalid\");\n  }\n\n  return readRecordPositiveInteger(\n    plan.documentManifest.state,\n    \"epoch\",\n    \"Document sync manifest state\",\n  );\n}\n\n// The one load-bearing epoch check: no returned update may claim an\n// accessEpoch newer than the current manifest epoch.\nfunction assertDocumentSyncAccessEpochsNotInFuture(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const currentAccessEpoch = documentSyncManifestEpoch(plan);\n  for (const update of response.updates) {\n    if (update.accessEpoch > currentAccessEpoch) {\n      throw new Error(\"Document sync response includes a future access epoch\");\n    }\n  }\n}\n\nfunction contentKeyBundleCanonical(\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"],\n): string {\n  return serializeCanonical(bundle, \"content-key bundle\");\n}\n\nfunction documentSyncContentKeyBundlesByEpoch(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  if (\n    contentKeyBundleCanonical(response.contentKeyBundle) !==\n    contentKeyBundleCanonical(plan.sourceContentKeyBundle)\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n\n  const bundleByEpoch = new Map<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >();\n  const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];\n\n  for (const bundle of bundles) {\n    if (bundle.documentId !== plan.documentId) {\n      throw new Error(\n        \"Document sync response content-key bundle document mismatch\",\n      );\n    }\n    if (\n      !Number.isInteger(bundle.contentKeyEpoch) ||\n      bundle.contentKeyEpoch <= 0\n    ) {\n      throw new Error(\n        \"Document sync response content-key bundle epoch mismatch\",\n      );\n    }\n\n    // The current epoch travels only as contentKeyBundle; the array carries\n    // each older epoch once.\n    if (bundleByEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    bundleByEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return bundleByEpoch;\n}\n\nasync function persistedDocumentSyncStateFromResponseInternal(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  if (response.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response document id mismatch\");\n  }\n  const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(\n    plan,\n    response,\n  );\n  if (\n    serializeCanonical(response.documentKekTargets, \"KEK targets\") !==\n    serializeCanonical(plan.documentKekTargets, \"KEK targets\")\n  ) {\n    throw new Error(\"Document sync response KEK target mismatch\");\n  }\n  assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);\n  assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);\n  assertDocumentSyncAccessEpochsNotInFuture(plan, response);\n\n  await Promise.all(\n    response.updates.map((update) =>\n      assertDocumentSyncResponseUpdateMatchesPlan({\n        contentKeyBundlesByEpoch,\n        plan,\n        resolveWriterPublicKey: options.resolveWriterPublicKey,\n        update,\n      }),\n    ),\n  );\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: plan.documentId,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: plan.documentManifest,\n  });\n}\n\nexport async function persistedDocumentSyncStateFromResponse(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  try {\n    return await persistedDocumentSyncStateFromResponseInternal(\n      plan,\n      response,\n      options,\n    );\n  } catch (error) {\n    if (error instanceof DocumentSyncResponseUpdateContentKeyError) throw error;\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function isRetryableDocumentSyncConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale\n  );\n}\n\n// The wipe gate is deliberately strict — coded 404s only, which is the right\n// failure mode for a destructive action. A bare 404 proves nothing about the\n// document: proxy/tunnel error pages, deploy-skew route misses, and\n// container-level lookups all produce one.\nexport function isUpstreamDeletedDocumentSyncFailure(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n  );\n}\n"]}

package/data/documents/shared/syncSubmitFailure.d.ts

@@ -1,9 +0,0 @@
-import type { ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
-export interface DocumentSyncSubmitFailure {
-    readonly code?: string | undefined;
-    readonly message: string;
-    readonly ok: false;
-    readonly report: () => void;
-    readonly stalePrincipalHeads?: readonly ReferencedPrincipalStateResponse[] | undefined;
-    readonly status: number | null;
-}

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js

@@ -1,61 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { advanceKeyingCheckpointsAtomically, validateKeyingCheckpointsAtomically, } from "../persistence/keyingCheckpointAdvancePersistence.js";
-function objectKey(manifest) {
-    const { objectKind, organizationId, objectId } = manifest.checkpoint;
-    return JSON.stringify([objectKind, organizationId, objectId]);
-}
-function manifestsByObject(manifests) {
-    const byObject = new Map();
-    for (const manifest of manifests) {
-        const key = objectKey(manifest);
-        let byHash = byObject.get(key);
-        if (!byHash) {
-            byHash = new Map();
-            byObject.set(key, byHash);
-        }
-        byHash.set(manifest.manifestHash, manifest);
-    }
-    return byObject;
-}
-function accessManifestCheckpointAdvances(input) {
-    const evidenceByObject = manifestsByObject(input.verifiedManifests);
-    const headsByObject = manifestsByObject(input.verifiedHeads);
-    const advances = [];
-    for (const [key, headsByHash] of headsByObject) {
-        if (headsByHash.size !== 1) {
-            throw new KeyingVerificationError("equivocation", `projection declares conflicting access manifest heads for ${key}`);
-        }
-        const head = headsByHash.values().next().value;
-        if (!head) {
-            continue;
-        }
-        const predecessors = [
-            ...(evidenceByObject.get(key)?.values() ?? []),
-        ].filter((manifest) => manifest.manifestHash !== head.manifestHash);
-        advances.push({ head, predecessors });
-    }
-    return advances;
-}
-export async function validateAccessManifestCheckpoints(input) {
-    await validateKeyingCheckpointsAtomically({
-        access: accessManifestCheckpointAdvances(input),
-        execSql: input.execSql,
-        policies: input.policies,
-        authorizationPolicies: input.authorizationPolicies,
-        stillCurrent: input.stillCurrent,
-        verifiedBundles: input.verifiedBundles,
-    });
-}
-export async function enforceAccessManifestCheckpoints(input) {
-    await advanceKeyingCheckpointsAtomically({
-        access: accessManifestCheckpointAdvances(input),
-        documentPurgeCheckpoint: input.documentPurgeCheckpoint,
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        policies: input.policies,
-        authorizationPolicies: input.authorizationPolicies,
-        stillCurrent: input.stillCurrent,
-        verifiedBundles: input.verifiedBundles,
-    });
-}
-//# sourceMappingURL=accessManifestCheckpointEnforcement.js.map

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,mDAAmD,CAAC;AAK3D,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAYtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../persistence/keyingCheckpointAdvancePersistence\";\nimport type { VerifiedManifestBundle } from \"../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n"]}

package/data/keyingProjectionVerification/bundleVerification.js

@@ -1,61 +0,0 @@
-import { KeyingVerificationError, verifySignedAccessEvent, } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString, readCanonicalJson, readCanonicalRecord, } from "../keying/canonicalJson.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { readKeyingVerificationShape } from "./error.js";
-import { readAccessEvent, readRecordString, readRequiredRecordValue, } from "./readers.js";
-function canonicalBundleJson(value, label) {
-    return readKeyingVerificationShape(() => canonicalKeyingJsonString(value, label));
-}
-export function assertCanonicalEqual(input) {
-    if (canonicalBundleJson(input.actual, `${input.label} actual`) !==
-        canonicalBundleJson(input.expected, `${input.label} expected`)) {
-        throw new KeyingVerificationError("hash_mismatch", `${input.label} mismatch`);
-    }
-}
-export function addBundleByHash(bundlesByHash, bundle, label) {
-    const existing = bundlesByHash.get(bundle.manifestHash);
-    if (!existing) {
-        bundlesByHash.set(bundle.manifestHash, bundle);
-        return;
-    }
-    if (canonicalBundleJson(existing, `${label} existing`) !==
-        canonicalBundleJson(bundle, `${label} duplicate`)) {
-        throw new KeyingVerificationError("hash_mismatch", `Writer projection has equivocal manifest bundle ${bundle.manifestHash}`);
-    }
-}
-function readStandaloneEventBundle(bundle, label) {
-    return readKeyingVerificationShape(() => {
-        const eventBundle = readCanonicalRecord(bundle, `${label} event bundle`);
-        const eventHash = readRecordString(eventBundle, "eventHash", `${label} event bundle`);
-        const event = readAccessEvent(readRequiredRecordValue(eventBundle, "event", `${label} event bundle`), `${label} signed event`);
-        const body = readCanonicalJson(readRequiredRecordValue(eventBundle, "body", `${label} event bundle`), `${label} event body`);
-        return { eventHash, event, body };
-    });
-}
-export async function verifyStandaloneAccessEventBundle(input) {
-    const { eventHash, event, body } = readStandaloneEventBundle(input.bundle, input.label);
-    const userKey = await input.resolveUserKey(event.signerUserId);
-    if (!userKey) {
-        throw new ProjectionDependencyUnavailableError(`${input.label} signer public key could not be resolved for ${event.signerUserId}`);
-    }
-    const verified = await verifySignedAccessEvent({
-        body,
-        event,
-        signerPublicKey: userKey.signingPublicKey,
-    });
-    if (!verified.ok) {
-        throw verified.error;
-    }
-    if (verified.value.eventHash !== eventHash) {
-        throw new KeyingVerificationError("hash_mismatch", `${input.label} event hash mismatch`);
-    }
-    return verified.value;
-}
-export function verifyAccessEventBundle(input) {
-    return verifyStandaloneAccessEventBundle({
-        bundle: input.bundle.event,
-        label: input.label,
-        resolveUserKey: input.resolveUserKey,
-    });
-}
-//# sourceMappingURL=bundleVerification.js.map

package/data/keyingProjectionVerification/bundleVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundleVerification.js","sourceRoot":"","sources":["bundleVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAGnB,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,OAAO,2BAA2B,CAAC,GAAG,EAAE,CACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IACE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,CAAC;QAC1D,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,WAAW,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,aAA4D,EAC5D,MAAwC,EACxC,KAAa;IAEb,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IACE,mBAAmB,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClD,mBAAmB,CAAC,MAAM,EAAE,GAAG,KAAK,YAAY,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,MAAM,CAAC,YAAY,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAqC,EACrC,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,gBAAgB,CAChC,WAAW,EACX,WAAW,EACX,GAAG,KAAK,eAAe,CACxB,CAAC;QACF,MAAM,KAAK,GAAG,eAAe,CAC3B,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,eAAe,CAAC,EACtE,GAAG,KAAK,eAAe,CACxB,CAAC;QACF,MAAM,IAAI,GAAG,iBAAiB,CAC5B,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,eAAe,CAAC,EACrE,GAAG,KAAK,aAAa,CACtB,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,yBAAyB,CAC1D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,gDAAgD,KAAK,CAAC,YAAY,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,IAAI;QACJ,KAAK;QACL,eAAe,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,CAAC,KAAK,sBAAsB,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,OAAO,iCAAiC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifySignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport type { AccessEventBundleWireResponse } from \"@tearleads/validators/util\";\nimport {\n  canonicalKeyingJsonString,\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../keying/canonicalJson\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { readKeyingVerificationShape } from \"./error\";\nimport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./readers\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nfunction canonicalBundleJson(value: unknown, label: string): string {\n  return readKeyingVerificationShape(() =>\n    canonicalKeyingJsonString(value, label),\n  );\n}\n\nexport function assertCanonicalEqual(input: {\n  readonly actual: unknown;\n  readonly expected: unknown;\n  readonly label: string;\n}): void {\n  if (\n    canonicalBundleJson(input.actual, `${input.label} actual`) !==\n    canonicalBundleJson(input.expected, `${input.label} expected`)\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `${input.label} mismatch`,\n    );\n  }\n}\n\nexport function addBundleByHash(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): void {\n  const existing = bundlesByHash.get(bundle.manifestHash);\n  if (!existing) {\n    bundlesByHash.set(bundle.manifestHash, bundle);\n    return;\n  }\n\n  if (\n    canonicalBundleJson(existing, `${label} existing`) !==\n    canonicalBundleJson(bundle, `${label} duplicate`)\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `Writer projection has equivocal manifest bundle ${bundle.manifestHash}`,\n    );\n  }\n}\n\nfunction readStandaloneEventBundle(\n  bundle: AccessEventBundleWireResponse,\n  label: string,\n) {\n  return readKeyingVerificationShape(() => {\n    const eventBundle = readCanonicalRecord(bundle, `${label} event bundle`);\n    const eventHash = readRecordString(\n      eventBundle,\n      \"eventHash\",\n      `${label} event bundle`,\n    );\n    const event = readAccessEvent(\n      readRequiredRecordValue(eventBundle, \"event\", `${label} event bundle`),\n      `${label} signed event`,\n    );\n    const body = readCanonicalJson(\n      readRequiredRecordValue(eventBundle, \"body\", `${label} event bundle`),\n      `${label} event body`,\n    );\n    return { eventHash, event, body };\n  });\n}\n\nexport async function verifyStandaloneAccessEventBundle(input: {\n  readonly bundle: AccessEventBundleWireResponse;\n  readonly label: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  const { eventHash, event, body } = readStandaloneEventBundle(\n    input.bundle,\n    input.label,\n  );\n  const userKey = await input.resolveUserKey(event.signerUserId);\n  if (!userKey) {\n    throw new ProjectionDependencyUnavailableError(\n      `${input.label} signer public key could not be resolved for ${event.signerUserId}`,\n    );\n  }\n\n  const verified = await verifySignedAccessEvent({\n    body,\n    event,\n    signerPublicKey: userKey.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (verified.value.eventHash !== eventHash) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `${input.label} event hash mismatch`,\n    );\n  }\n\n  return verified.value;\n}\n\nexport function verifyAccessEventBundle(input: {\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly label: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  return verifyStandaloneAccessEventBundle({\n    bundle: input.bundle.event,\n    label: input.label,\n    resolveUserKey: input.resolveUserKey,\n  });\n}\n"]}

package/data/keyingProjectionVerification/checkpointContext.d.ts

@@ -1,45 +0,0 @@
-import { type AccessManifestCheckpoint, type VerifiedAccessManifestCheckpointEvidence, type VerifiedContainerAccessManifest, type VerifiedPrincipalPolicySelection } from "../../internal/crypto/index.js";
-import type { AccessManifestBundleWireResponse } from "../../internal/validators/response/index.js";
-import type { DocumentPurgeCheckpoint } from "../persistence/documentPurgeCheckpointPersistence.js";
-import type { VerifiedManifestBundle } from "../persistence/verifiedManifestBundlePersistence.js";
-import type { PrincipalPolicyCheckpointEvidence } from "../principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../sqlite/sqlSchema.js";
-export interface ProjectionCheckpointContext {
-    readonly heldContainerHeads: VerifiedContainerAccessManifest[];
-    readonly execSql: ExecSql;
-    readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;
-    organizationId?: string | undefined;
-    readonly policies: PrincipalPolicyCheckpointEvidence[];
-    readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];
-    readonly verifiedBundles: VerifiedManifestBundle[];
-    readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];
-    readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];
-}
-export declare function createProjectionCheckpointContext(input: {
-    readonly execSql: ExecSql;
-    readonly organizationId?: string | undefined;
-}): ProjectionCheckpointContext;
-export declare function observeAccessManifestCheckpoints(context: ProjectionCheckpointContext, input: {
-    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];
-    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];
-}): void;
-/**
- * Records each served bundle whose manifest this verification produced, so
- * the transaction finalizing the checkpoints also stores it for later
- * citation. A bundle the projection carried but verification never reached
- * is skipped.
- */
-export declare function observeVerifiedProjectionBundles(context: ProjectionCheckpointContext, bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>, verifiedByHash: ReadonlyMap<string, {
-    readonly checkpoint: AccessManifestCheckpoint;
-}>): void;
-export declare function observePrincipalPolicy(context: ProjectionCheckpointContext, policy: PrincipalPolicyCheckpointEvidence, organizationId?: string | undefined): void;
-export declare function commitProjectionCheckpoints(context: ProjectionCheckpointContext, input?: {
-    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;
-    readonly execSql?: ExecSql | undefined;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<void>;
-export declare function finalizeProjectionCheckpoints(context: ProjectionCheckpointContext, input: {
-    readonly execSql?: ExecSql | undefined;
-    readonly persistVerificationCheckpoints?: boolean | undefined;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<void>;