@tearleads/client-sdk 0.1.64 → 0.1.65

package/data/documents/shared/documentSyncUpdateIsolation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentSyncUpdateIsolation.js","sourceRoot":"","sources":["documentSyncUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAMxD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsC,EACtC,KAAa;IAEb,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC;IAEtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,WAAW,CAAqB;IAChC,iBAAiB,CAAgB;IACjC,cAAc,CAAoB;IAClC,cAAc,CAA2B;IACzC,cAAc,CAAgB;IAC9B,eAAe,CAAgB;IAC/B,UAAU,CAAgB;IAC1B,YAAY,CAAgB;IAC5B,KAAK,CAAmC;IACxC,QAAQ,CAAgB;IACxB,YAAY,CAAgB;IAErC,YAAY,KAMX;QACC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,oBAAoB,CACvC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,MAAM,MAAM,GACV,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,6BAA6B,cAAc,CAAC,MAAM,2CAA2C;YAC/F,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,gBAAgB,MAAM,iBAAiB,WAAW,WAAW,KAAK,GAAG,CAAC;QACpG,KAAK,CACH,6BAA6B,OAAO,WAAW,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc;YACjB,KAAK,CAAC,cAAc,EAAE,cAAc,KAAK,iBAAiB;gBACxD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc,GAAG,oBAAoB,CACxC,KAAK,CAAC,cAAc,EACpB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,oBAAoB,CACtC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,IAAI,gCAAgC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,OAAO,KAAK,CAAC,KAAK,YAAY,gCAAgC;QAC5D,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,OAAO,KAAK,YAAY,gCAAgC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkD;IAElD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CACnE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mFAAmF,CACpF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,8BAA8B,CAAC;YACnC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA+C;IAK/C,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC3C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB,EACxD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAAsB,EACtB,OAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAC/D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,0CAA0C,CAAC;gBACzC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,IACE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChC,+BAA+B,GAAG,UAAU,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,WAAW,KAAK,cAAc;gBAAE,SAAS;YAC7C,IACE,MAAM,CAAC,UAAU,CAAC,UAAU;gBAC5B,+BAA+B,GAAG,UAAU,EAC5C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwB,EACxB,YAAwE;IAExE,IAAI,kBAAkB,GAAa,IAAI,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;YAClD,kBAAkB,GAAG,SAAS,CAAC;YAC/B,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhD,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C,sBAAsB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CACd,mDAAmD,iBAAiB,EAAE,CACvE;YACD,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,eAAe;YACf,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,gBAAgB;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kCAAkC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,UAAU,YAAY,qCAAqC,EAAE,CAAC;QAChE,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IACE,gCAAgC,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,eAAe;KAChB,CAAC,EACF,CAAC;QACD,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,KAAK,CAAC,gBAAgB,EACtB,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc,CACnD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,4BAA4B,CAAC;gBACjC,eAAe;gBACf,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,cAAc,CAAC,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createDocument,\n  exportFullHistorySnapshot,\n  importSnapshot,\n  importUpdates,\n  LoroImportUnresolvedDependenciesError,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type {\n  DecryptedDocumentSyncUpdate,\n  SyncRemoteDocumentResult,\n} from \"./types\";\n\ntype DocumentSyncUpdateIsolationStage =\n  | \"content_key\"\n  | \"decrypt\"\n  | \"encrypted_record\"\n  | \"loro_import\"\n  | \"loro_metadata\"\n  | \"plaintext_integrity\"\n  | \"write_header\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype SyncDocument = Awaited<ReturnType<typeof createDocument>>;\n\nconst MAX_EXACT_ISOLATION_CANDIDATES = 8;\nconst MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;\n\nexport type IncomingDocumentSyncUpdateValidator = (\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n) => void | Promise<void>;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction optionalHeaderField(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): unknown {\n  const header = update?.writeHeader;\n  return header && typeof header === \"object\"\n    ? Reflect.get(header, field)\n    : undefined;\n}\n\nfunction optionalHeaderString(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): string | null {\n  const value = optionalHeaderField(update, field);\n  return typeof value === \"string\" ? value : null;\n}\n\nfunction optionalHeaderEpoch(\n  update: SyncResponseUpdate | undefined,\n): number | null {\n  const value = optionalHeaderField(update, \"contentKeyEpoch\");\n  return typeof value === \"number\" && Number.isSafeInteger(value)\n    ? value\n    : null;\n}\n\nexport class DocumentSyncUpdateIsolationError extends Error {\n  readonly attribution: \"batch\" | \"update\";\n  readonly authorFingerprint: string | null;\n  readonly batchUpdateIds: readonly string[];\n  readonly checkpointKind: \"rotate_baseline\" | null;\n  readonly ciphertextHash: string | null;\n  readonly contentKeyEpoch: number | null;\n  readonly documentId: string | null;\n  readonly metadataHash: string | null;\n  readonly stage: DocumentSyncUpdateIsolationStage;\n  readonly updateId: string | null;\n  readonly writerUserId: string | null;\n\n  constructor(input: {\n    batchUpdateIds?: readonly string[] | undefined;\n    cause: unknown;\n    responseUpdate?: SyncResponseUpdate | undefined;\n    stage: DocumentSyncUpdateIsolationStage;\n    updateId: string | null;\n  }) {\n    const causeMessage = errorMessage(input.cause);\n    const writerUserId = optionalHeaderString(\n      input.responseUpdate,\n      \"writerUserId\",\n    );\n    const author =\n      writerUserId ?? input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const fingerprint = input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const epoch = optionalHeaderEpoch(input.responseUpdate) ?? \"unknown\";\n    const batchUpdateIds =\n      input.updateId === null ? (input.batchUpdateIds ?? []) : [];\n    const subject =\n      input.updateId === null\n        ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`\n        : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;\n    super(\n      `Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`,\n      { cause: input.cause },\n    );\n    this.name = \"DocumentSyncUpdateIsolationError\";\n    this.attribution = input.updateId === null ? \"batch\" : \"update\";\n    this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;\n    this.batchUpdateIds = [...batchUpdateIds];\n    this.checkpointKind =\n      input.responseUpdate?.checkpointKind === \"rotate_baseline\"\n        ? \"rotate_baseline\"\n        : null;\n    this.ciphertextHash = optionalHeaderString(\n      input.responseUpdate,\n      \"ciphertextHash\",\n    );\n    this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);\n    this.documentId = input.responseUpdate?.documentId ?? null;\n    this.metadataHash = optionalHeaderString(\n      input.responseUpdate,\n      \"metadataHash\",\n    );\n    this.stage = input.stage;\n    this.updateId = input.updateId;\n    this.writerUserId = writerUserId;\n  }\n}\n\nexport function isolateDocumentSyncBatchError(input: {\n  cause: unknown;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateIds: readonly string[];\n}): DocumentSyncUpdateIsolationError {\n  return new DocumentSyncUpdateIsolationError({\n    batchUpdateIds: input.updateIds,\n    cause: input.cause,\n    stage: input.stage,\n    updateId: null,\n  });\n}\n\nexport function isolateDocumentSyncUpdateError(input: {\n  cause: unknown;\n  responseUpdate?: SyncResponseUpdate | undefined;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateId: string;\n}): DocumentSyncUpdateIsolationError {\n  return input.cause instanceof DocumentSyncUpdateIsolationError\n    ? input.cause\n    : new DocumentSyncUpdateIsolationError(input);\n}\n\nexport function isDocumentSyncUpdateIsolationError(\n  error: unknown,\n): error is DocumentSyncUpdateIsolationError {\n  return error instanceof DocumentSyncUpdateIsolationError;\n}\n\nfunction responseUpdatesById(\n  updates: readonly SyncResponseUpdate[] | undefined,\n): ReadonlyMap<string, SyncResponseUpdate> {\n  return new Map((updates ?? []).map((update) => [update.id, update]));\n}\n\nfunction firstDuplicateUpdateId(\n  updates: readonly { readonly id: string }[],\n): string | null {\n  const seen = new Set<string>();\n  for (const update of updates) {\n    if (seen.has(update.id)) return update.id;\n    seen.add(update.id);\n  }\n  return null;\n}\n\nfunction assertImportedUpdatesMatchValidatedHistory(input: {\n  document: SyncDocument;\n  responseById: ReadonlyMap<string, SyncResponseUpdate>;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): void {\n  const collisions = input.updates.filter(\n    (update) =>\n      !updateMatchesDocumentHistory(input.document, update.updateData),\n  );\n  if (collisions.length === 0) return;\n  const cause = new Error(\n    \"incoming Loro update reuses an already-covered frontier with different operations\",\n  );\n  const [collision] = collisions;\n  if (input.updates.length === 1 && collision) {\n    throw isolateDocumentSyncUpdateError({\n      cause,\n      responseUpdate: input.responseById.get(collision.id),\n      stage: \"loro_import\",\n      updateId: collision.id,\n    });\n  }\n  throw isolateDocumentSyncBatchError({\n    cause,\n    stage: \"loro_import\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nasync function createValidationDocument(snapshot: Uint8Array) {\n  const document = await createDocument(crypto.randomUUID());\n  try {\n    importSnapshot(document, snapshot);\n    return document;\n  } catch (error) {\n    document.free();\n    throw error;\n  }\n}\n\nfunction splitDocumentSyncUpdates(\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): {\n  checkpoints: DecryptedDocumentSyncUpdate[];\n  ordinaryUpdates: DecryptedDocumentSyncUpdate[];\n} {\n  const checkpoints: DecryptedDocumentSyncUpdate[] = [];\n  const ordinaryUpdates: DecryptedDocumentSyncUpdate[] = [];\n  for (const update of updates) {\n    if (\n      update.checkpointKind === \"rotate_baseline\" &&\n      update.checkpointPayloadKind === \"full_history_snapshot\"\n    ) {\n      checkpoints.push(update);\n    } else {\n      ordinaryUpdates.push(update);\n    }\n  }\n  return { checkpoints, ordinaryUpdates };\n}\n\n/** Applies checkpoints with the snapshot API before batching ordinary deltas. */\nexport function importDecryptedDocumentSyncUpdates(\n  document: SyncDocument,\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): void {\n  const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);\n  for (const checkpoint of checkpoints) {\n    importSnapshot(document, checkpoint.updateData);\n  }\n  if (ordinaryUpdates.length > 0) {\n    importUpdates(\n      document,\n      ordinaryUpdates.map((update) => update.updateData),\n    );\n  }\n}\n\nasync function validateDecryptedUpdateBatch(input: {\n  currentSnapshot: Uint8Array;\n  responseById?: ReadonlyMap<string, SyncResponseUpdate> | undefined;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): Promise<void> {\n  const document = await createValidationDocument(input.currentSnapshot);\n  try {\n    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(\n      input.updates,\n    );\n    for (const checkpoint of checkpoints) {\n      importSnapshot(document, checkpoint.updateData);\n    }\n    if (ordinaryUpdates.length > 0) {\n      importUpdates(\n        document,\n        ordinaryUpdates.map((update) => update.updateData),\n      );\n    }\n    if (input.responseById) {\n      // Validate against the completed scratch history, not only the live\n      // pre-page frontier. If two updates in this page reuse one peer/counter\n      // with different operations, Loro accepts one and treats the other as a\n      // no-op; only the accepted history can match both when they are equal.\n      assertImportedUpdatesMatchValidatedHistory({\n        document,\n        responseById: input.responseById,\n        updates: input.updates,\n      });\n    }\n  } finally {\n    document.free();\n  }\n}\n\nfunction exactIsolationRetryExceedsBudget(input: {\n  candidates: readonly DecryptedDocumentSyncUpdate[];\n  currentSnapshot: Uint8Array;\n}): boolean {\n  if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES) return true;\n\n  let retryBytes = 0;\n  for (const candidateIndex of input.candidates.keys()) {\n    if (\n      input.currentSnapshot.byteLength >\n      MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n    ) {\n      return true;\n    }\n    retryBytes += input.currentSnapshot.byteLength;\n    for (const [updateIndex, update] of input.candidates.entries()) {\n      if (updateIndex === candidateIndex) continue;\n      if (\n        update.updateData.byteLength >\n        MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n      ) {\n        return true;\n      }\n      retryBytes += update.updateData.byteLength;\n    }\n  }\n  return false;\n}\n\n/** @internal Exported only to exercise the bounded exact-attribution policy. */\nexport async function findUniqueRepairingCandidate<T>(\n  candidates: readonly T[],\n  repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>,\n): Promise<T | null> {\n  let repairingCandidate: T | null = null;\n  let repairingCandidateCount = 0;\n  for (const [candidateIndex, candidate] of candidates.entries()) {\n    if (await repairsBatch(candidate, candidateIndex)) {\n      repairingCandidate = candidate;\n      repairingCandidateCount += 1;\n    }\n  }\n  return repairingCandidateCount === 1 ? repairingCandidate : null;\n}\n\n/**\n * Proves that a decrypted response can be imported before the live document or\n * any durable sync frontier is mutated. On failure, retries the page without\n * each candidate so valid sibling dependencies remain in the same batch while\n * the update whose removal repairs the batch is attributed exactly.\n */\nexport async function validateDocumentSyncUpdateImports(input: {\n  currentDocument: Awaited<ReturnType<typeof createDocument>>;\n  decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];\n  responseUpdates?: readonly SyncResponseUpdate[] | undefined;\n}): Promise<void> {\n  if (input.decryptedUpdates.length === 0) return;\n\n  const duplicateUpdateId =\n    firstDuplicateUpdateId(input.decryptedUpdates) ??\n    firstDuplicateUpdateId(input.responseUpdates ?? []);\n  if (duplicateUpdateId !== null) {\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\n        `Document sync response update id is duplicated: ${duplicateUpdateId}`,\n      ),\n      stage: \"encrypted_record\",\n      updateIds: (input.responseUpdates ?? input.decryptedUpdates).map(\n        (update) => update.id,\n      ),\n    });\n  }\n\n  const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);\n  const responseById = responseUpdatesById(input.responseUpdates);\n  let batchError: unknown;\n  try {\n    await validateDecryptedUpdateBatch({\n      currentSnapshot,\n      responseById,\n      updates: input.decryptedUpdates,\n    });\n    return;\n  } catch (error) {\n    if (isDocumentSyncUpdateIsolationError(error)) throw error;\n    batchError = error;\n  }\n\n  // A delta can be valid but depend on a parent omitted from this response\n  // page. Removing that delta would make an empty retry succeed and falsely\n  // identify its authenticated writer as poison, so dependency gaps remain\n  // anonymous at batch scope.\n  if (batchError instanceof LoroImportUnresolvedDependenciesError) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  if (\n    exactIsolationRetryExceedsBudget({\n      candidates: input.decryptedUpdates,\n      currentSnapshot,\n    })\n  ) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  // Rebuild from the same immutable snapshot for every candidate: a failed\n  // import may partially mutate its scratch document. Checkpoints participate\n  // alongside ordinary updates so an incompatibility between the two kinds\n  // cannot falsely blame the ordinary writer. Keeping every other update in\n  // one batch also preserves out-of-order sibling dependencies.\n  const isolatedUpdate = await findUniqueRepairingCandidate(\n    input.decryptedUpdates,\n    async (_update, candidateIndex) => {\n      const withoutCandidate = input.decryptedUpdates.filter(\n        (_, updateIndex) => updateIndex !== candidateIndex,\n      );\n      try {\n        await validateDecryptedUpdateBatch({\n          currentSnapshot,\n          updates: withoutCandidate,\n        });\n        return true;\n      } catch {\n        // This candidate is either valid and required by a sibling, or another\n        // poison update remains. Continue without attributing it.\n        return false;\n      }\n    },\n  );\n  if (isolatedUpdate) {\n    throw isolateDocumentSyncUpdateError({\n      cause: batchError,\n      responseUpdate: responseById.get(isolatedUpdate.id),\n      stage: \"loro_import\",\n      updateId: isolatedUpdate.id,\n    });\n  }\n\n  // Multiple bad updates or a batch-level incompatibility may have zero or\n  // multiple removals that repair the page. Fail closed without falsely naming\n  // a valid writer; no live or durable state has changed.\n  throw isolateDocumentSyncBatchError({\n    cause: batchError,\n    stage: \"loro_import\",\n    updateIds: input.decryptedUpdates.map((update) => update.id),\n  });\n}\n"]}

package/data/documents/shared/keyringRebuild.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyringRebuild.js","sourceRoot":"","sources":["keyringRebuild.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AAEjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAyC,EACzC,mBAA2B,EAC3B,MAAc;IAOd,MAAM,QAAQ,GAAG,KAAK;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CACvE,CAAC;IACF,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CACzC,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAC7C,CAAC;IACF,OAAO;QACL,WAAW;QACX,UAAU,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC;QAC/D,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAwC,EACxC,UAA2C;IAM3C,IAAI,OAAgB,CAAC;IACrB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,4BAA4B,CAAC;oBACtC,iBAAiB,EAAE,IAAI,CAAC,WAAW;oBACnC,iBAAiB,EAAE,SAAS;oBAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC;gBACF,eAAe;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,KAOvC;IACC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3E,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,kBAAkB,EAClB,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,2BAA2B,EAC3B,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAClD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,uBAAuB,CAC5B,CAAC;AACJ,CAAC;AAiBD,MAAM,oCAAoC,GAGtC;IACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,0EAA0E,KAAK,EAAE;IACnF,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,0DAA0D,KAAK,sBAAsB;IACvF,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,uCAAuC,KAAK,mEAAmE;IACjH,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,uCAAuC,KAAK,kEAAkE;CACjH,CAAC;AAEF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE5C;IACA;IAFX,YACW,iBAAyB,EACzB,MAAuC,EAChD,KAAe;QAEf,KAAK,CACH,oCAAoC,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,EAC/D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAC5C,CAAC;QAPO,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,WAAM,GAAN,MAAM,CAAiC;QAOhD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,IAAI,YAAqB,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;YACrD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,iBAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,GAAG;SACxB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,sCAAsC;QACtC,YAAY,KAAK,IAAI,KAAK,CACxB,iEAAiE,KAAK,CAAC,mBAAmB,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,MAAM,uCAAuC,CAAC;gBACjD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,cAAc,EAAE,IAAI,CAAC,uBAAuB;oBAC5C,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAqBlD;IACC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,GAC5D,oBAAoB,CAClB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAC/B,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAC7B,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC3C,8BAA8B,CAAC;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;KACN,CAAC,CAAC;IAEL,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,CAAC,UAA8B,EAAE,EAAE,CAC1D,oBAAoB,CAAC;QACnB,OAAO;QACP,UAAU;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;KACrD,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,IAAI,gBAAyB,CAAC;IAC9B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACzD,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC;QAC5B,yEAAyE;QACzE,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GACV,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,gBAAgB,CACpB,WAAW,EACX,KAAK,CAAC,mBAAmB,IAAI,IAAI,GAAG,EAAE,CACvC;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAChE,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC,eAAe,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,8BAA8B,CAAC;YAC7B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAChD,aAAa;YACb,cAAc,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;YACtC,aAAa;YACb,qBAAqB;YACrB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QACvC,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,yEAAyE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;QACpD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["import type {\n  ContainerKekKeyringEntry,\n  ContainerKeyWrap,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekMaterialId,\n  unwrapContainerKekParentWrap,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekLogEpochResponse } from \"@tearleads/validators/response\";\nimport { unwrapKeyEnvelopesWithPrincipalPolicies } from \"../../principals/principalPolicyCrypto\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { normalizeContainerKeyWrap } from \"./readers\";\n\n/**\n * Splits an epoch's envelopes into the anchor kinds this requester could use:\n * their own direct envelope, principal envelopes their policies may resolve,\n * and parent-container envelopes. Anything else is not an identity anchor and\n * is dropped, so it never produces a misleading failure.\n */\nfunction partitionAnchorWraps(\n  wraps: readonly Record<string, unknown>[],\n  containerKeyEpochId: string,\n  userId: string,\n): {\n  directWraps: ContainerKeyWrap[];\n  epochWraps: ContainerKeyWrap[];\n  parentWraps: ContainerKeyWrap[];\n  principalWraps: ContainerKeyWrap[];\n} {\n  const forEpoch = wraps\n    .map((wrap) => normalizeContainerKeyWrap(wrap))\n    .filter((wrap) => wrap.containerKeyEpochId === containerKeyEpochId);\n  const directWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"user\" && wrap.recipientId === userId,\n  );\n  const principalWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"group\",\n  );\n  const parentWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"container\",\n  );\n  return {\n    directWraps,\n    epochWraps: [...directWraps, ...principalWraps, ...parentWraps],\n    parentWraps,\n    principalWraps,\n  };\n}\n\n/**\n * Opens the first parent-container envelope whose parent epoch key the caller\n * supplied. Reports whether any key was available, so a missing parent key is\n * distinguishable from a corrupt envelope.\n */\nasync function openParentAnchor(\n  parentWraps: readonly ContainerKeyWrap[],\n  parentKeys: ReadonlyMap<string, Uint8Array>,\n): Promise<{\n  failure: unknown;\n  key: Uint8Array | null;\n  keyWasAvailable: boolean;\n}> {\n  let failure: unknown;\n  let keyWasAvailable = false;\n  for (const wrap of parentWraps) {\n    const parentKey = parentKeys.get(wrap.recipientKeyEpochId);\n    if (!parentKey) {\n      continue;\n    }\n    keyWasAvailable = true;\n    try {\n      return {\n        failure: undefined,\n        key: await unwrapContainerKekParentWrap({\n          parentContainerId: wrap.recipientId,\n          parentKeyMaterial: parentKey,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        }),\n        keyWasAvailable,\n      };\n    } catch (error) {\n      failure = error;\n    }\n  }\n  return { failure, key: null, keyWasAvailable };\n}\n\n/**\n * Every anchor kind was tried; report the most specific reason. A wrap that\n * was actually attempted and failed is corruption; one that could not be\n * attempted names the key that was missing.\n */\nfunction throwMostSpecificAnchorFailure(input: {\n  containerKeyEpoch: number;\n  directFailure: unknown;\n  hadParentWraps: boolean;\n  parentFailure: unknown;\n  parentKeyWasAvailable: boolean;\n  principalFailure: unknown;\n}): never {\n  if (input.directFailure !== undefined || input.parentFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"corrupt-envelope\",\n      input.directFailure ?? input.parentFailure,\n    );\n  }\n  if (input.principalFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"principal-key-unreachable\",\n      input.principalFailure,\n    );\n  }\n  throw new HistoricalWrapUnavailableError(\n    input.containerKeyEpoch,\n    input.hadParentWraps && !input.parentKeyWasAvailable\n      ? \"parent-key-unavailable\"\n      : \"no-addressed-envelope\",\n  );\n}\n\n/**\n * Raised when the requester holds no envelope they can open for a historical\n * epoch. Distinct from corruption: the log is intact, the caller simply is\n * not an anchor for this epoch.\n */\nexport type HistoricalWrapUnavailableReason =\n  /** No envelope at this epoch is addressed to the requester at all. */\n  | \"no-addressed-envelope\"\n  /** A direct user envelope exists for the requester but did not open. */\n  | \"corrupt-envelope\"\n  /** Only principal-addressed envelopes, whose key epoch is unreachable. */\n  | \"principal-key-unreachable\"\n  /** Only a parent-container envelope, and the parent KEK was not supplied. */\n  | \"parent-key-unavailable\";\n\nconst HISTORICAL_WRAP_UNAVAILABLE_MESSAGES: Record<\n  HistoricalWrapUnavailableReason,\n  (epoch: number) => string\n> = {\n  \"no-addressed-envelope\": (epoch) =>\n    `Container KEK log has no envelope addressed to this requester at epoch ${epoch}`,\n  \"corrupt-envelope\": (epoch) =>\n    `Container KEK log envelope for this requester at epoch ${epoch} could not be opened`,\n  \"principal-key-unreachable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is addressed to a principal key epoch this client cannot resolve`,\n  \"parent-key-unavailable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is inherited from a parent container whose KEK was not supplied`,\n};\n\nexport class HistoricalWrapUnavailableError extends Error {\n  constructor(\n    readonly containerKeyEpoch: number,\n    readonly reason: HistoricalWrapUnavailableReason,\n    cause?: unknown,\n  ) {\n    super(\n      HISTORICAL_WRAP_UNAVAILABLE_MESSAGES[reason](containerKeyEpoch),\n      cause === undefined ? undefined : { cause },\n    );\n    this.name = \"HistoricalWrapUnavailableError\";\n  }\n}\n\n/**\n * The first candidate envelope that both decrypts AND matches the epoch's\n * material-id commitment.\n *\n * Candidates are tried ONE AT A TIME. An envelope can be AEAD-valid and still\n * carry the WRONG key — a stale or misaddressed wrap — so decrypting a batch\n * together would let that one envelope answer for the whole group and mask a\n * later envelope that would have opened the epoch. The reported failure is the\n * first real decrypt failure, since a commitment mismatch is a wrong envelope\n * rather than an unreachable one.\n */\nasync function firstCommittedAnchor(input: {\n  attempt: (\n    wraps: ContainerKeyWrap[],\n  ) => Promise<{ failure: unknown; key: Uint8Array | null }>;\n  candidates: ContainerKeyWrap[];\n  containerId: string;\n  containerKeyEpoch: number;\n  containerKeyEpochId: string;\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  let firstFailure: unknown;\n  for (const candidate of input.candidates) {\n    const result = await input.attempt([candidate]);\n    if (result.key === null) {\n      firstFailure ??= result.failure;\n      continue;\n    }\n    const materialId = await computeContainerKekMaterialId({\n      containerId: input.containerId,\n      keyEpoch: input.containerKeyEpoch,\n      keyMaterial: result.key,\n    });\n    if (materialId === input.containerKeyEpochId) {\n      return result;\n    }\n    // An envelope that decrypts to the WRONG key is a misaddressed or stale\n    // envelope, not an unreachable principal. Recording it keeps the reported\n    // reason `corrupt-envelope`; dropping it silently would let the epoch\n    // report as unaddressed, which points a repair at the wrong problem.\n    //\n    // Only reachable when the server files a wrap under an epoch id its\n    // material does not hash to — the addressing filter already rejects a\n    // wrap whose epoch id simply differs.\n    firstFailure ??= new Error(\n      `Container KEK envelope decrypts to material that is not epoch ${input.containerKeyEpochId}`,\n    );\n  }\n  return { failure: firstFailure, key: null };\n}\n\n/**\n * Opens one group of envelopes with the requester's CURRENT policies, folding\n * failure into a value rather than throwing.\n *\n * The caller tries several groups in order, and a failure in one is not the\n * end of the search — so the failure has to travel back alongside the miss\n * instead of unwinding the whole recovery.\n */\nasync function unwrapWrapsWithCurrentPolicies(input: {\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  if (input.wraps.length === 0) {\n    return { failure: undefined, key: null };\n  }\n  try {\n    return {\n      failure: undefined,\n      key: await unwrapKeyEnvelopesWithPrincipalPolicies({\n        envelopes: input.wraps.map((wrap) => ({\n          keyFingerprint: wrap.recipientKeyFingerprint,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        })),\n        execSql: input.execSql,\n        secretKey: input.secretKey,\n      }),\n    };\n  } catch (error) {\n    return { failure: error, key: null };\n  }\n}\n\n/**\n * The severed-bridge backstop: recovers one historical epoch's KEK from the\n * requester's own retained recipient envelope served in the kek-log. Wraps\n * are written by that epoch's rotator and never deleted, so this path is\n * independent of every later rotation — it works even when the bridge chain\n * above the epoch is destroyed. The recovered key is verified against the\n * epoch id's material commitment before use.\n *\n * Scope bound: a direct user envelope is recoverable from identity keys\n * alone, so a pristine client anchors on it. A group- or organization-\n * addressed envelope additionally requires the current principal secret key.\n * Principal rotation rematerializes every retained container grant against\n * the new principal head, so a current reader never needs an older principal\n * key to use this recovery path. Unreachable principal keys fail closed with\n * `HistoricalWrapUnavailableError` rather than appearing to be corruption.\n */\nexport async function recoverKeyringEntryFromWraps(input: {\n  containerId: string;\n  epoch: Pick<\n    ContainerKekLogEpochResponse,\n    \"containerKeyEpoch\" | \"containerKeyEpochId\" | \"wraps\"\n  >;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  /**\n   * Parent container KEKs by epoch id. An inherited-only child has no direct\n   * or principal envelope of its own; its anchor is the parent-container\n   * wrap, which opens under the parent epoch's KEK. Recover the parent's\n   * epoch first (recursively, through the parent's own log) and pass it here.\n   */\n  parentKeysByEpochId?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * The requester's user id. Direct user envelopes are matched against it, so\n   * another member's envelope is never mistaken for an anchor — attempting it\n   * would only produce a misleading failure.\n   */\n  userId: string;\n}): Promise<ContainerKekKeyringEntry> {\n  const { directWraps, epochWraps, parentWraps, principalWraps } =\n    partitionAnchorWraps(\n      input.epoch.wraps,\n      input.epoch.containerKeyEpochId,\n      input.userId,\n    );\n  if (epochWraps.length === 0) {\n    throw new HistoricalWrapUnavailableError(\n      input.epoch.containerKeyEpoch,\n      \"no-addressed-envelope\",\n    );\n  }\n\n  const attempt = (wraps: typeof epochWraps) =>\n    unwrapWrapsWithCurrentPolicies({\n      execSql: input.execSql,\n      secretKey: input.secretKey,\n      wraps,\n    });\n\n  // A direct envelope is decryptable from identity keys alone, so its failure\n  // means corruption — not an unreachable principal key. Neither failure ends\n  // the search: a parent-container wrap may still anchor this epoch.\n  //\n  // Candidates are tried ONE AT A TIME, and each must match the epoch's\n  // material-id commitment rather than merely decrypt. An envelope can be\n  // AEAD-valid and still carry the WRONG key — a stale or misaddressed wrap —\n  // so batching would let that one envelope answer for the whole group and\n  // mask a later envelope that would have opened the epoch.\n  const attemptCommitted = (candidates: ContainerKeyWrap[]) =>\n    firstCommittedAnchor({\n      attempt,\n      candidates,\n      containerId: input.containerId,\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      containerKeyEpochId: input.epoch.containerKeyEpochId,\n    });\n\n  const direct = await attemptCommitted(directWraps);\n  let keyMaterial = direct.key;\n  const directFailure = direct.failure;\n  let principalFailure: unknown;\n  if (keyMaterial === null) {\n    const principal = await attemptCommitted(principalWraps);\n    keyMaterial = principal.key;\n    // Preserve the current-policy failure in case no inherited anchor opens.\n    principalFailure = principal.failure;\n  }\n  // The inherited-only path: a parent-container envelope opens under the\n  // parent epoch's KEK, which the caller recovers from the parent's own log.\n  const parent =\n    keyMaterial === null\n      ? await openParentAnchor(\n          parentWraps,\n          input.parentKeysByEpochId ?? new Map(),\n        )\n      : { failure: undefined, key: null, keyWasAvailable: false };\n  keyMaterial ??= parent.key;\n  const parentFailure = parent.failure;\n  const parentKeyWasAvailable = parent.keyWasAvailable;\n  if (keyMaterial === null) {\n    throwMostSpecificAnchorFailure({\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      directFailure,\n      hadParentWraps: parentWraps.length > 0,\n      parentFailure,\n      parentKeyWasAvailable,\n      principalFailure,\n    });\n  }\n  const expectedId = await computeContainerKekMaterialId({\n    containerId: input.containerId,\n    keyEpoch: input.epoch.containerKeyEpoch,\n    keyMaterial,\n  });\n  if (expectedId !== input.epoch.containerKeyEpochId) {\n    throw new Error(\n      `Container KEK log wrap does not match its committed epoch id at epoch ${input.epoch.containerKeyEpoch}`,\n    );\n  }\n  return {\n    containerKeyEpochId: input.epoch.containerKeyEpochId,\n    keyMaterial,\n  };\n}\n\nexport { fetchContainerKekLog } from \"./containerKekLogFetch\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"./keyringLogWalk\";\nexport { rebuildKeyringEntriesFromLog } from \"./keyringLogWalk\";\n"]}

package/data/documents/shared/mutationAcknowledgement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutationAcknowledgement.js","sourceRoot":"","sources":["mutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,4DAA4D,CAAC;AAGpE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/** Advances a document head only after its response was matched to this plan. */\nexport async function acknowledgeDocumentMutation(input: {\n  readonly execSql: ExecSql;\n  readonly plan: Parameters<typeof locallyAuthoredAccessManifestHead>[0];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [locallyAuthoredAccessManifestHead(input.plan)],\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/documents/shared/projection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projection.js","sourceRoot":"","sources":["projection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAGL,2CAA2C,GAC5C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,4CAA4C,EAC5C,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,SAAS,wBAAwB,CAC/B,IAAuB,EACvB,KAAwB,EACxB,OAAe;IAEf,IACE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,mDAAmD,CAAC,KAG5D;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CACT,KAAK,EACL,UAAU,EACX,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,gBAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,gBAAgB,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,iBAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,4BAA4B,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0CAA0C,CACjD,OAA4C,EAC5C,gBAAkD;IAElD,yEAAyE;IACzE,kEAAkE;IAClE,IACE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,wBAAwB,CACtB,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAChE,0CAA0C,CAAC,gBAAgB,CAAC,EAC5D,mEAAmE,CACpE,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,6BAA6B,CAClE,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,EAC1E,6DAA6D,CAC9D,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,0BAA0B,CAC/D,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EACxE,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CACvD,gBAAkD,EAClD,qBAA8B;IAE9B,MAAM,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC3D,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;QAC3E,sEAAsE;QACtE,uCAAuC;QACvC,IACE,CAAC,qBAAqB;YACtB,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAC5C,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY;gBACnB,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,CACxD,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,IACE,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB;YACzD,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CACrE,mBAAmB,CACjB,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CACvE,CACF,CAAC;IACF,IAAI,qBAAqB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gDAAgD,CAC7D,gBAAkD,EAClD,KAgBC;IAED,MAAM,wBAAwB,GAAG,yBAAyB,CACxD,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,IACE,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACrC,wBAAwB,KAAK,IAAI,EACjC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,2CAA2C,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;YACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,wBAAwB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,KAAK,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAC9E,IAAI,qBAAqB,IAAI,KAAK,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,gBAAgB,CAAC,gBAAgB;QACzC,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;IACxC,IACE,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAC1C,gBAAgB,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU;QAC7D,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,KAAK,UAAU,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,gBAAgB,CAAC,kBAAkB,CAAC,mBAAmB;QACvD,gBAAgB,CAAC,gBAAgB,CAAC,YAAY,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,0CAA0C,CAC9C,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IAEF,MAAM,OAAO,GAAG,qBAAqB;QACnC,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QACzE,CAAC,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GACvB,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrD,IACE,mBAAmB;QACnB,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,0CAA0C,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACtE,mDAAmD,CAAC;QAClD,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,GAAG,KAA0E;IAE7E,IAAI,CAAC;QACH,OAAO,MAAM,gDAAgD,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import type {\n  DocumentContentKeyTarget,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { computeDocumentContentKeyTargetHash } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type PrincipalPolicyCache,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { throwKeyingVerificationShapeFailure } from \"../../keyingProjectionVerification/error\";\nimport { errorMessage } from \"../../shared/errorMessage\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"./projectionTargets\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  normalizeDocumentKekTargetResponse,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n  targetKey,\n  uniqueSortedStrings,\n} from \"./readers\";\n\nexport { unwrapContainerKekPath } from \"./containerKekPath\";\nexport { ContainerKekHistoryUnavailableError } from \"./containerKekPathHistory\";\nexport {\n  buildRotatedDocumentContentKeyBundle,\n  collectContainerKeksForDocumentSync,\n  DocumentContentKeyUnavailableError,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n  unwrapDocumentContentKeyFromWriterProjection,\n  unwrapDocumentContentKeyTarget,\n  wrapDocumentContentKeyForCreate,\n} from \"./projectionContentKeys\";\nexport {\n  authorizingContainerPathRefs,\n  authorizingContainerPathRefsForLinkSet,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentCreateTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  verifiedDocumentWrapTargets,\n} from \"./projectionTargets\";\n\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { resolveProjectionVerifier } from \"./types\";\n\nfunction assertSortedStringsEqual(\n  left: readonly string[],\n  right: readonly string[],\n  message: string,\n): void {\n  if (\n    left.length !== right.length ||\n    left.some((value, index) => value !== right[index])\n  ) {\n    throw new Error(message);\n  }\n}\n\nfunction assertAuthorizingContainerPathsMatchDocumentTargets(input: {\n  targets: readonly DocumentContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  if (input.writerProjection.authorizingContainerPaths.length === 0) {\n    throw new Error(\"Document writer projection authorization paths missing\");\n  }\n\n  const targetKeys = new Set(input.targets.map(targetKey));\n  for (const [\n    index,\n    projection,\n  ] of input.writerProjection.authorizingContainerPaths.entries()) {\n    let projectionTarget: DocumentContentKeyTarget;\n    try {\n      projectionTarget = deriveDocumentTargetFromProjection(projection);\n    } catch (error) {\n      throw new Error(\n        `Document writer projection authorization path[${index}] is invalid: ${errorMessage(error)}`,\n      );\n    }\n\n    if (targetKeys.has(targetKey(projectionTarget))) {\n      continue;\n    }\n\n    // Bind server-supplied KEK paths to committed document targets before\n    // using any unwrapped path KEK for document content-key material.\n    throw new Error(\n      `Document writer projection authorization path[${index}] is not a document target`,\n    );\n  }\n}\n\nfunction assertDocumentTargetsCoverLinkedContainers(\n  targets: readonly DocumentContentKeyTarget[],\n  writerProjection: DocumentWriterProjectionResponse,\n): void {\n  // One target per linked container: a second epoch for the same container\n  // would let a re-wrap land on a KEK a revoked member still holds.\n  if (\n    new Set(targets.map((target) => target.containerId)).size !== targets.length\n  ) {\n    throw new Error(\n      \"Document writer projection targets name a linked container more than once\",\n    );\n  }\n  assertSortedStringsEqual(\n    uniqueSortedStrings(targets.map((target) => target.containerId)),\n    readLinkedContainerIdsFromDocumentManifest(writerProjection),\n    \"Document writer projection targets do not match linked containers\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerManifestHashes,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerManifestHash)),\n    \"Document writer projection target manifest summary mismatch\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerKeyEpochIds,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)),\n    \"Document writer projection target KEK summary mismatch\",\n  );\n}\n\nasync function assertProjectionContentKeyBundleConsistent(\n  writerProjection: DocumentWriterProjectionResponse,\n  staleContentKeyBundle: boolean,\n): Promise<void> {\n  const { manifestHash } = writerProjection.documentManifest;\n  if (writerProjection.contentKeyBundle.linkSetManifestHash !== manifestHash) {\n    // A stale bundle may lag the link-set head, but it must still descend\n    // from this document's manifest chain.\n    if (\n      !staleContentKeyBundle ||\n      !writerProjection.documentManifestHistory.some(\n        (bundle) =>\n          bundle.manifestHash ===\n          writerProjection.contentKeyBundle.linkSetManifestHash,\n      )\n    ) {\n      throw new Error(\"Document writer projection link manifest mismatch\");\n    }\n  }\n\n  if (!staleContentKeyBundle) {\n    if (\n      writerProjection.documentKekTargets.documentKeyTargetHash !==\n      writerProjection.contentKeyBundle.targetHash\n    ) {\n      throw new Error(\"Document writer projection target hash mismatch\");\n    }\n    return;\n  }\n\n  // The stale bundle cannot match the current targets; pin it to its own\n  // canonical hash instead so a tampered envelope set still fails closed.\n  const staleBundleTargetHash = await computeDocumentContentKeyTargetHash(\n    sortDocumentTargets(\n      writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference),\n    ),\n  );\n  if (staleBundleTargetHash !== writerProjection.contentKeyBundle.targetHash) {\n    throw new Error(\n      \"Document writer projection stale bundle target hash is not canonical\",\n    );\n  }\n}\n\nasync function assertDocumentWriterProjectionConsistentInternal(\n  writerProjection: DocumentWriterProjectionResponse,\n  input: ProjectionVerificationOptions & {\n    /**\n     * Accept a projection whose content-key bundle is marked stale (wrapped\n     * to superseded KEK targets after e.g. a revoke rotation). Document sync\n     * opts in to heal the bundle. Attachment reads opt in because their DEK\n     * is independent and opens through verified retained container KEKs.\n     */\n    allowStaleContentKeyBundle?: boolean | undefined;\n    execSql?: ExecSql | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    onVerifiedAuthorization?:\n      | ((authorization: DocumentWriterProjectionAuthorization) => void)\n      | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    stillCurrent?: (() => boolean) | undefined;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n  },\n): Promise<DocumentContentKeyTarget[]> {\n  const resolveProjectionUserKey = resolveProjectionVerifier(\n    input,\n    \"Document writer projection\",\n  );\n  if (\n    input.trustedLocalProjection !== true &&\n    resolveProjectionUserKey !== null\n  ) {\n    const authorization = await verifyDocumentWriterProjectionAuthorization({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: writerProjection,\n      resolveUserKey: resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    input.onVerifiedAuthorization?.(authorization);\n  }\n\n  const staleContentKeyBundle = writerProjection.contentKeyBundleStale === true;\n  if (staleContentKeyBundle && input.allowStaleContentKeyBundle !== true) {\n    throw new Error(\"Document writer projection content-key bundle is stale\");\n  }\n\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: writerProjection.documentManifest,\n    label: \"Document writer projection manifest\",\n  });\n  const { documentId } = manifestIdentity;\n  if (\n    writerProjection.documentId !== documentId ||\n    writerProjection.documentKekTargets.documentId !== documentId ||\n    writerProjection.contentKeyBundle.documentId !== documentId\n  ) {\n    throw new Error(\"Document writer projection document id mismatch\");\n  }\n  if (\n    writerProjection.documentKekTargets.linkSetManifestHash !==\n    writerProjection.documentManifest.manifestHash\n  ) {\n    throw new Error(\"Document writer projection link manifest mismatch\");\n  }\n  await assertProjectionContentKeyBundleConsistent(\n    writerProjection,\n    staleContentKeyBundle,\n  );\n\n  const targets = staleContentKeyBundle\n    ? normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets)\n    : currentDocumentTargets(writerProjection);\n  const canonicalTargetHash =\n    await computeDocumentContentKeyTargetHash(targets);\n  if (\n    canonicalTargetHash !==\n    writerProjection.documentKekTargets.documentKeyTargetHash\n  ) {\n    throw new Error(\"Document writer projection target hash is not canonical\");\n  }\n\n  assertDocumentTargetsCoverLinkedContainers(targets, writerProjection);\n  assertAuthorizingContainerPathsMatchDocumentTargets({\n    targets,\n    writerProjection,\n  });\n\n  return targets;\n}\n\nexport async function assertDocumentWriterProjectionConsistent(\n  ...input: Parameters<typeof assertDocumentWriterProjectionConsistentInternal>\n): ReturnType<typeof assertDocumentWriterProjectionConsistentInternal> {\n  try {\n    return await assertDocumentWriterProjectionConsistentInternal(...input);\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}

package/data/documents/shared/projectionContentKeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projectionContentKeys.js","sourceRoot":"","sources":["projectionContentKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,mCAAmC,EACnC,+BAA+B,EAC/B,wBAAwB,EACxB,gBAAgB,EAEhB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AAEnG,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,yCAAyC,GAC1C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAExD,SAAS,2BAA2B,CAClC,UAA6C;IAE7C,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,6BAA6B,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;QAChE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IAEH,OAAO;QACL;YACE,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAenD;IACC,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAC3B,wBAAwB,CAAC;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,QAAQ;SACjB,CAAC,EACF,KAAK,CAAC,YAAY,EAClB;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;YACvC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;SACxD,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,mBAAmB;YAAE,MAAM,KAAK,CAAC;QAC5C,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,MAAM,GACV,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,mBAAmB,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,OAAO,6BAA6B,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,mBAAmB,EAAE,6CAA6C,KAAK,CAAC,QAAQ,CAAC,WAAW,aAAa,KAAK,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;QACpK,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,YAAqB;QACxC,KAAK,CACH,YAAY,YAAY,KAAK;YAC3B,CAAC,CAAC,YAAY,CAAC,OAAO;YACtB,CAAC,CAAC,qCAAqC,CAC1C,CAAC;QALiB,iBAAY,GAAZ,YAAY,CAAS;QAMxC,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC3D;QACE,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,2BAA2B,CAClC,QAA0B;IAE1B,OAAO,CACL,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,mCAAmC,CAAC,CACvE,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,QAA4B,EAC5B,GAAW,EACX,OAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,2BAA2B,CAC3C,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAC3C,CAAC;IACF,IAAI,SAAS;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAOiC;IAEjC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9D,MAAM,4CAA4C,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE9E,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,cAEH,CAAC;QACF,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,yCAAyC,CAAC;gBAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,aAAa;gBACjC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;gBACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,GAAG,6BAA6B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC,CACrC,KAAK,EACL,sEAAsE,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAChH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,mBAAmB,EACnB,OAAO,EACR,IAAI,cAAc,CAAC,4BAA4B,EAAE,CAAC;YACjD,iCAAiC,CAC/B,4BAA4B,EAC5B,mBAAmB,EACnB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,WAAW,EACX,OAAO,EACR,IAAI,cAAc,CAAC,4CAA4C,EAAE,CAAC;YACjE,iCAAiC,CAC/B,4CAA4C,EAC5C,WAAW,EACX,OAAO,CACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,mBAAmB,EACnB,WAAW,EACZ,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACb,gBAAgB,CACd,QAAQ,EACR,WAAW,EACX,gEAAgE,CACjE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa;QACb,4BAA4B;QAC5B,4CAA4C;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwC;AACxC,+DAA+D;AAC/D,UAAkB,EAClB,sBAAuD,EACvD,+BAA2D,IAAI,GAAG,EAAE,EACpE,+CAGI,IAAI,GAAG,EAAE;IAEb,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CACnE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,mBAAmB,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,GAAsB,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAY,EAAE,CAAC;IAExC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAC7C,QAAQ,CAAC,mBAAmB,CAC7B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,kBAAkB,GACtB,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAC9D,4CAA4C,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,kBAAkB;gBAAE,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,YAAY;YACZ,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,UAAU;YACV,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CACd,UAAU,EACV,SAAS,EACT,yDAAyD,CAC1D,CAAC;YACF,SAAS;QACX,CAAC;QACD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;QAC5E,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAMiC;IAEjC,MAAM,aAAa,GAAG,MAAM,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAEvE,OAAO,kCAAkC,CACvC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EACvC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EACjC,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,4CAA4C,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAI1D;IACC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,2BAA2B,CAAC;QAC1C,kBAAkB,EAAE,0CAA0C,CAC5D,KAAK,CAAC,gBAAgB,CACvB;QACD,aAAa,EAAE,kCAAkC,CAAC,kBAAkB,CAAC;QACrE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,SAAS,GAAgD,EAAE,CAAC;IAClE,MAAM,eAAe,GAAG,gBAAgB,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,sBAAsB,CAAC,GAAG,CACnD,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,uDAAuD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE;YACnE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,gBAAgB,CAAC,UAAU;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC;YACb,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,mBAAmB,EAAE,kBAAkB,CAAC,mBAAmB;QAC3D,UAAU,EAAE,kBAAkB,CAAC,qBAAqB;QACpD,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  ContentKeyEnvelopeError,\n  type ContentKeyEnvelopeKind,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  type VerifiedContainerAccessManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentContentKeyBundleResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCache } from \"../../keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../keyingProjectionVerification/document/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../keyingProjectionVerification/error\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"./containerKekCurrency\";\nimport {\n  unwrapContainerKekPath,\n  unwrapContainerKekPathWithHistoryFailures,\n} from \"./containerKekPath\";\nimport { ContainerKekHistoryUnavailableError } from \"./containerKekPathHistory\";\nimport {\n  deriveDocumentCreateTargets,\n  describeProjectionTargetKek,\n  readLinkedContainerIdsFromDocumentManifest,\n  verifiedDocumentWrapTargets,\n} from \"./projectionTargets\";\nimport {\n  assertEqualBytes,\n  describeDocumentTargetKek,\n  normalizeDocumentKekTargetResponse,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n} from \"./readers\";\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { projectionVerificationOptions } from \"./types\";\n\nfunction getOnlyDocumentCreateTarget(\n  projection: ContainerWriterProjectionResponse,\n) {\n  const target = deriveDocumentCreateTargets(projection)[0];\n  if (!target) {\n    throw new Error(\"Document create target is unavailable\");\n  }\n  return target;\n}\n\nexport async function wrapDocumentContentKeyForCreate(\n  input: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    documentId: string;\n    execSql?: ExecSql | undefined;\n    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    projection: ContainerWriterProjectionResponse;\n    secretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  assertContainerKekPathCurrent(input.projection.containerKeks);\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    projection: input.projection,\n    secretKey: input.secretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const target = getOnlyDocumentCreateTarget(input.projection);\n  const targetKek = keksByEpochId.get(target.containerKeyEpochId);\n  if (!targetKek) {\n    throw new Error(\"Document create target KEK could not be unwrapped\");\n  }\n\n  const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n    kind: \"Document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n\n  return [\n    {\n      ...target,\n      wrappedKey: bytesToBase64(wrapped.ciphertext),\n      wrappingMetadata: {\n        suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n        iv: bytesToBase64(wrapped.iv),\n      },\n    },\n  ];\n}\n\nexport async function unwrapContentKeyTargetForKind(input: {\n  containerKek: Uint8Array;\n  /** The content-key epoch of the bundle the envelope was served in. */\n  contentKeyEpoch: number;\n  /** Wraps a decode or decrypt failure with this message. */\n  decryptErrorMessage?: string | undefined;\n  envelope: {\n    containerId: string;\n    containerKeyEpochId: string;\n    wrappedKey: string;\n    wrappingMetadata?: unknown;\n  };\n  kind: ContentKeyEnvelopeKind;\n  /** The document or blob the caller is reading, never read from the bundle. */\n  objectId: string;\n}): Promise<Uint8Array> {\n  // Reading, not submitting: the suite still binds the envelope to its object\n  // kind, but an unrecognized extra metadata key is ignored rather than making\n  // an otherwise decryptable envelope permanently unreadable. The AEAD tag is\n  // what authenticates the recovered key, bound to the object, content-key\n  // epoch and target it was sealed for. The KEK stays out of the decoder.\n  try {\n    return await unwrapContentKey(\n      decodeContentKeyEnvelope({\n        envelope: input.envelope,\n        kind: input.kind,\n        origin: \"stored\",\n      }),\n      input.containerKek,\n      {\n        kind: input.kind,\n        objectId: input.objectId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: input.envelope.containerId,\n        containerKeyEpochId: input.envelope.containerKeyEpochId,\n      },\n    );\n  } catch (error) {\n    if (!input.decryptErrorMessage) throw error;\n    // Keep the structural diagnostic; the wrapper only adds which target it\n    // was, which the decoder cannot know.\n    const detail =\n      error instanceof ContentKeyEnvelopeError ? `: ${error.message}` : \"\";\n    throw new Error(`${input.decryptErrorMessage}${detail}`, { cause: error });\n  }\n}\n\nexport async function unwrapDocumentContentKeyTarget(input: {\n  containerKek: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  envelope: DocumentContentKeyTargetEnvelope;\n}): Promise<Uint8Array> {\n  return unwrapContentKeyTargetForKind({\n    containerKek: input.containerKek,\n    contentKeyEpoch: input.contentKeyEpoch,\n    decryptErrorMessage: `Document content-key target for container ${input.envelope.containerId} at epoch ${input.envelope.containerKeyEpochId} could not be unwrapped`,\n    envelope: input.envelope,\n    kind: \"Document\",\n    objectId: input.documentId,\n  });\n}\n\ninterface CollectedContainerKeks {\n  readonly keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  readonly predecessorFailuresByEpochId: ReadonlyMap<string, Error>;\n  readonly unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  >;\n}\n\nexport class DocumentHistoryUnavailableError extends Error {\n  constructor(readonly historyCause: unknown) {\n    super(\n      historyCause instanceof Error\n        ? historyCause.message\n        : \"Document history key is unavailable\",\n    );\n    this.name = \"DocumentHistoryUnavailableError\";\n  }\n}\n\n/** No verified target or predecessor path can supply this content key. */\nexport class DocumentContentKeyUnavailableError extends Error {\n  constructor() {\n    super(\"Document content key could not be unwrapped\");\n    this.name = \"DocumentContentKeyUnavailableError\";\n  }\n}\n\nfunction preferredPredecessorFailure(\n  failures: readonly Error[],\n): Error | undefined {\n  return (\n    failures.find(\n      (failure) => !(failure instanceof ContainerKekHistoryUnavailableError),\n    ) ?? failures[0]\n  );\n}\n\nfunction recordPreferredPredecessorFailure(\n  failures: Map<string, Error>,\n  key: string,\n  failure: Error,\n): void {\n  const existing = failures.get(key);\n  const preferred = preferredPredecessorFailure(\n    existing ? [existing, failure] : [failure],\n  );\n  if (preferred) failures.set(key, preferred);\n}\n\nexport async function collectContainerKeksForDocumentSync(\n  input: {\n    execSql?: ExecSql | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    secretKey: Uint8Array;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<CollectedContainerKeks> {\n  const keksByEpochId = new Map<string, Uint8Array>();\n  const predecessorFailuresByEpochId = new Map<string, Error>();\n  const unattributedPredecessorFailuresByContainerId = new Map<string, Error>();\n\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    let projectionKeks: Awaited<\n      ReturnType<typeof unwrapContainerKekPathWithHistoryFailures>\n    >;\n    try {\n      projectionKeks = await unwrapContainerKekPathWithHistoryFailures({\n        execSql: input.execSql,\n        knownContainerKeks: keksByEpochId,\n        persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        secretKey: input.secretKey,\n        verifiedByHash: input.verifiedByHash,\n        ...projectionVerificationOptions(input),\n      });\n    } catch (error) {\n      throwKeyingVerificationErrorWithContext(\n        error,\n        `Document authorizing container KEK path could not be unwrapped for ${describeProjectionTargetKek(projection)}`,\n      );\n    }\n    for (const [\n      containerKeyEpochId,\n      failure,\n    ] of projectionKeks.predecessorFailuresByEpochId) {\n      recordPreferredPredecessorFailure(\n        predecessorFailuresByEpochId,\n        containerKeyEpochId,\n        failure,\n      );\n    }\n    for (const [\n      containerId,\n      failure,\n    ] of projectionKeks.unattributedPredecessorFailuresByContainerId) {\n      recordPreferredPredecessorFailure(\n        unattributedPredecessorFailuresByContainerId,\n        containerId,\n        failure,\n      );\n    }\n    for (const [\n      containerKeyEpochId,\n      keyMaterial,\n    ] of projectionKeks.keksByEpochId) {\n      const existing = keksByEpochId.get(containerKeyEpochId);\n      if (existing) {\n        assertEqualBytes(\n          existing,\n          keyMaterial,\n          \"Document writer projection contains conflicting container KEKs\",\n        );\n        continue;\n      }\n      keksByEpochId.set(containerKeyEpochId, keyMaterial);\n    }\n  }\n\n  return {\n    keksByEpochId,\n    predecessorFailuresByEpochId,\n    unattributedPredecessorFailuresByContainerId,\n  };\n}\n\nexport async function unwrapDocumentContentKeyFromBundle(\n  bundle: DocumentContentKeyBundleResponse,\n  /** The document being read; its wraps must be sealed to it. */\n  documentId: string,\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>,\n  predecessorFailuresByEpochId: ReadonlyMap<string, Error> = new Map(),\n  unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  > = new Map(),\n): Promise<Uint8Array> {\n  const canonicalTargetHash = await computeDocumentContentKeyTargetHash(\n    sortDocumentTargets(bundle.targets.map(targetEnvelopeReference)),\n  );\n  if (canonicalTargetHash !== bundle.targetHash) {\n    throw new Error(\"Document content-key bundle target hash is not canonical\");\n  }\n  if (bundle.documentId !== documentId) {\n    throw new Error(\"Document content-key bundle names another document\");\n  }\n  let contentKey: Uint8Array | null = null;\n  const predecessorFailures: Error[] = [];\n\n  for (const envelope of bundle.targets) {\n    const containerKek = containerKeksByEpochId.get(\n      envelope.containerKeyEpochId,\n    );\n    if (!containerKek) {\n      const predecessorFailure =\n        predecessorFailuresByEpochId.get(envelope.containerKeyEpochId) ??\n        unattributedPredecessorFailuresByContainerId.get(envelope.containerId);\n      if (predecessorFailure) predecessorFailures.push(predecessorFailure);\n      continue;\n    }\n    const unwrapped = await unwrapDocumentContentKeyTarget({\n      containerKek,\n      contentKeyEpoch: bundle.contentKeyEpoch,\n      documentId,\n      envelope,\n    });\n    if (contentKey) {\n      assertEqualBytes(\n        contentKey,\n        unwrapped,\n        \"Document content-key targets unwrap to conflicting keys\",\n      );\n      continue;\n    }\n    contentKey = unwrapped;\n  }\n\n  if (!contentKey) {\n    const predecessorFailure = preferredPredecessorFailure(predecessorFailures);\n    if (predecessorFailure !== undefined) {\n      throw new DocumentHistoryUnavailableError(predecessorFailure);\n    }\n    throw new DocumentContentKeyUnavailableError();\n  }\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n\n  return contentKey;\n}\n\nexport async function unwrapDocumentContentKeyFromWriterProjection(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    secretKey: Uint8Array;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<Uint8Array> {\n  const collectedKeks = await collectContainerKeksForDocumentSync(input);\n\n  return unwrapDocumentContentKeyFromBundle(\n    input.writerProjection.contentKeyBundle,\n    input.writerProjection.documentId,\n    collectedKeks.keksByEpochId,\n    collectedKeks.predecessorFailuresByEpochId,\n    collectedKeks.unattributedPredecessorFailuresByContainerId,\n  );\n}\n\n/**\n * Builds the healing bundle for a stale content-key bundle: wraps a FRESH\n * content key to the projection's CURRENT KEK targets at the next\n * content-key epoch. A current reader can recover the stale bundle through\n * the container predecessor chain; the fresh key is still required so a\n * holder revoked by the container rotation cannot decrypt future updates.\n * Recovery re-encrypts a full-history snapshot under that fresh key.\n *\n * Like every content-key rotation (unlink included), this requires the KEK\n * of EVERY linked-container target: all envelopes in a bundle must wrap the\n * same key, so an inaccessible target's envelope can neither be carried\n * forward (it wraps the old key) nor fabricated. A writer authorized through\n * only a subset of a multi-container link set fails here with a named target\n * and leaves the heal to a member who spans all of them.\n */\nexport async function buildRotatedDocumentContentKeyBundle(input: {\n  containerKeksByEpochId: ReadonlyMap<string, Uint8Array>;\n  contentKey: Uint8Array;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentContentKeyBundleResponse> {\n  assertDocumentKekPathsCurrent(input.writerProjection);\n  const { contentKeyBundle, documentKekTargets } = input.writerProjection;\n  // The server list names the linked containers; each envelope's epoch comes\n  // from the verified authorizing-path leaf for that container.\n  const targets = verifiedDocumentWrapTargets({\n    linkedContainerIds: readLinkedContainerIdsFromDocumentManifest(\n      input.writerProjection,\n    ),\n    serverTargets: normalizeDocumentKekTargetResponse(documentKekTargets),\n    writerProjection: input.writerProjection,\n  });\n  const envelopes: DocumentContentKeyBundleResponse[\"targets\"] = [];\n  const contentKeyEpoch = contentKeyBundle.contentKeyEpoch + 1;\n\n  for (const target of targets) {\n    const containerKek = input.containerKeksByEpochId.get(\n      target.containerKeyEpochId,\n    );\n    if (!containerKek) {\n      throw new Error(\n        `Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`,\n      );\n    }\n    const wrapped = await wrapContentKey(input.contentKey, containerKek, {\n      kind: \"Document\",\n      objectId: contentKeyBundle.documentId,\n      contentKeyEpoch,\n      containerId: target.containerId,\n      containerKeyEpochId: target.containerKeyEpochId,\n    });\n    envelopes.push({\n      ...target,\n      wrappedKey: bytesToBase64(wrapped.ciphertext),\n      wrappingMetadata: {\n        suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n        iv: bytesToBase64(wrapped.iv),\n      },\n    });\n  }\n\n  return {\n    contentKeyEpoch,\n    documentId: contentKeyBundle.documentId,\n    linkSetManifestHash: documentKekTargets.linkSetManifestHash,\n    targetHash: documentKekTargets.documentKeyTargetHash,\n    targets: envelopes,\n  };\n}\n"]}

package/data/documents/shared/projectionTargets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projectionTargets.js","sourceRoot":"","sources":["projectionTargets.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AASrF,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAGnB,MAAM,UAAU,2BAA2B,CACzC,UAAuC;IAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,uBAAuB,CAAC,cAAc,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,SAAS,CAAC,kBAAkB,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL;YACE,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,qBAAqB,EAAE,SAAS,CAAC,kBAAkB;YACnD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA4C,EAC5C,SAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACrD,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAuC;IAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,UAAuC;IAEvC,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GACf,yBAAyB,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,WAAW;QACtB,UAAU,CAAC,WAAW,CAAC;IACzB,OAAO,SAAS;QACd,CAAC,CAAC,aAAa,WAAW,UAAU,SAAS,CAAC,mBAAmB,EAAE;QACnE,CAAC,CAAC,aAAa,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAuC;IAEvC,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,gBAAkD;IAElD,MAAM,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACtD,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAClC,kBAAkB,CAAC,IAAI,CACrB,CAAC,WAAW,EAAE,EAAE,CACd,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QAC9D,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC7D,IACE,kBAAkB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACvD,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CACxB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,uDAAuD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,gBAAkD;IAElD,MAAM,OAAO,GAAG,kCAAkC,CAChD,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACvC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CACvE,CAAC;IAEF,IACE,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC;QAC1C,kBAAkB,CAAC,aAAa,EAAE,qBAAqB,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAyC;IAEzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,gBAAkD;IAElD,OAAO,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACnE,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CACnE,CAAC,UAAU,EAAE,EAAE,CACb,KAAK,CAAC,SAAS,KAAK,MAAM;QAC1B,yBAAyB,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB,CACpE,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import {\n  type DocumentContentKeyTarget,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKeyingPathResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  describeDocumentTargetKek,\n  normalizeDocumentKekTargetResponse,\n  readManifestContainerId,\n  serializeCanonical,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n  targetKey,\n  uniqueSortedStrings,\n} from \"./readers\";\nimport type { DocumentLinkSetMutationOperation } from \"./types\";\n\nexport function deriveDocumentCreateTargets(\n  projection: ContainerKeyingPathResponse,\n): DocumentContentKeyTarget[] {\n  const targetIndex = projection.path.length - 1;\n  const targetManifest = projection.path[targetIndex];\n  if (!targetManifest) {\n    throw new Error(\"Container writer projection path is empty\");\n  }\n\n  if (readManifestContainerId(targetManifest) !== projection.containerId) {\n    throw new Error(\"Container writer projection target path is inconsistent\");\n  }\n\n  const targetKek = projection.containerKeks[targetIndex];\n  if (!targetKek) {\n    throw new Error(\"Container writer projection target KEK is unavailable\");\n  }\n  if (targetKek.containerId !== projection.containerId) {\n    throw new Error(\"Container writer projection target KEK is inconsistent\");\n  }\n  if (targetKek.accessManifestHash !== targetManifest.manifestHash) {\n    throw new Error(\"Container writer projection target KEK is stale\");\n  }\n\n  return [\n    {\n      containerId: targetKek.containerId,\n      containerManifestHash: targetKek.accessManifestHash,\n      containerKeyEpochId: targetKek.containerKeyEpochId,\n      containerKeyEpoch: targetKek.containerKeyEpoch,\n    },\n  ];\n}\n\nexport function mergeTargetEnvelopes(\n  targets: readonly DocumentContentKeyTarget[],\n  envelopes: readonly DocumentContentKeyTargetEnvelope[],\n): DocumentContentKeyTargetEnvelope[] {\n  const expectedByKey = new Map(\n    targets.map((target) => [targetKey(target), target]),\n  );\n  const envelopeByKey = new Map<string, DocumentContentKeyTargetEnvelope>();\n\n  for (const envelope of envelopes) {\n    const key = targetKey(envelope);\n    if (!expectedByKey.has(key)) {\n      throw new Error(\"Document content-key target envelope is unexpected\");\n    }\n    if (envelopeByKey.has(key)) {\n      throw new Error(\"Document content-key target envelope is duplicated\");\n    }\n    if (envelope.wrappedKey.length === 0) {\n      throw new Error(\"Document content-key target envelope is empty\");\n    }\n    if (!isPlainRecord(envelope.wrappingMetadata)) {\n      throw new Error(\n        \"Document content-key target wrapping metadata must be an object\",\n      );\n    }\n    envelopeByKey.set(key, envelope);\n  }\n\n  return sortDocumentTargets(targets).map((target) => {\n    const envelope = envelopeByKey.get(targetKey(target));\n    if (!envelope) {\n      throw new Error(\"Document content-key target envelope is missing\");\n    }\n    return envelope;\n  });\n}\n\nfunction projectionLeafContainerId(\n  projection: ContainerKeyingPathResponse,\n): string | null {\n  const leafBundle = projection.path.at(-1);\n  return leafBundle ? readManifestContainerId(leafBundle) : null;\n}\n\nexport function describeProjectionTargetKek(\n  projection: ContainerKeyingPathResponse,\n): string {\n  const targetKek = projection.containerKeks.at(-1);\n  const containerId =\n    projectionLeafContainerId(projection) ??\n    targetKek?.containerId ??\n    projection.containerId;\n  return targetKek\n    ? `container ${containerId} epoch ${targetKek.containerKeyEpochId}`\n    : `container ${containerId}`;\n}\n\nexport function deriveDocumentTargetFromProjection(\n  projection: ContainerKeyingPathResponse,\n): DocumentContentKeyTarget {\n  const target = deriveDocumentCreateTargets(projection)[0];\n  if (!target) {\n    throw new Error(\"Document target projection is unavailable\");\n  }\n  return target;\n}\n\nexport function readLinkedContainerIdsFromDocumentManifest(\n  writerProjection: DocumentWriterProjectionResponse,\n): string[] {\n  const state = writerProjection.documentManifest.state;\n  const linkedContainerIds = isPlainRecord(state)\n    ? Reflect.get(state, \"linkedContainerIds\")\n    : undefined;\n  if (\n    !Array.isArray(linkedContainerIds) ||\n    linkedContainerIds.some(\n      (containerId) =>\n        typeof containerId !== \"string\" || containerId.length === 0,\n    )\n  ) {\n    throw new Error(\"Document link-set state is invalid\");\n  }\n\n  return uniqueSortedStrings(linkedContainerIds);\n}\n\n/**\n * The targets a content-key (re)wrap may address. The server's KEK target list\n * only says which linked containers the bundle must cover; the epoch each\n * envelope lands on comes from that container's verified authorizing-path\n * leaf, never from the server row. A listed epoch that is not the linked\n * container's verified current head — a predecessor a revoked member still\n * holds, or another container's epoch — therefore fails before any wrap, as\n * does a container listed twice. A linked container with no authorizing path\n * is an availability gap, not tampering: its KEK is simply unavailable here.\n */\nexport function verifiedDocumentWrapTargets(input: {\n  linkedContainerIds: readonly string[];\n  serverTargets: readonly DocumentContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentContentKeyTarget[] {\n  const verifiedByKey = new Map<string, DocumentContentKeyTarget>();\n  const verifiedContainerIds = new Set<string>();\n  for (const projection of input.writerProjection.authorizingContainerPaths) {\n    const target = deriveDocumentTargetFromProjection(projection);\n    verifiedByKey.set(targetKey(target), target);\n    verifiedContainerIds.add(target.containerId);\n  }\n\n  const containerIds = input.serverTargets.map((target) => target.containerId);\n  if (new Set(containerIds).size !== containerIds.length) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      \"Document content-key targets name a linked container more than once\",\n    );\n  }\n  const linkedContainerIds = uniqueSortedStrings(input.linkedContainerIds);\n  const sortedContainerIds = uniqueSortedStrings(containerIds);\n  if (\n    sortedContainerIds.length !== linkedContainerIds.length ||\n    sortedContainerIds.some((id, index) => id !== linkedContainerIds[index])\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document content-key targets do not match the linked containers\",\n    );\n  }\n\n  return sortDocumentTargets(\n    input.serverTargets.map((target) => {\n      const verified = verifiedByKey.get(targetKey(target));\n      if (verified) {\n        return verified;\n      }\n      if (!verifiedContainerIds.has(target.containerId)) {\n        throw new Error(\n          `Document content-key re-wrap KEK is unavailable for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `Document content-key target is not the verified head of ${describeDocumentTargetKek(target)}`,\n      );\n    }),\n  );\n}\n\nexport function currentDocumentTargets(\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentContentKeyTarget[] {\n  const targets = normalizeDocumentKekTargetResponse(\n    writerProjection.documentKekTargets,\n  );\n  const bundleTargets = sortDocumentTargets(\n    writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference),\n  );\n\n  if (\n    serializeCanonical(targets, \"KEK targets\") !==\n    serializeCanonical(bundleTargets, \"content-key targets\")\n  ) {\n    throw new Error(\"Document link-set content-key targets mismatch\");\n  }\n\n  return targets;\n}\n\n/**\n * Reduce a single container path (root→leaf chain) to {containerId,\n * manifestHash} references. The server already stores each manifest and resolves\n * it from its own store, so a write echoes only the hashes instead of\n * re-embedding the full signed bundles it received in the writer projection.\n */\nexport function containerPathRefs(\n  path: ContainerKeyingPathResponse[\"path\"],\n): ContainerManifestRef[] {\n  return path.map((bundle) => {\n    const containerId = readManifestContainerId(bundle);\n    if (!containerId) {\n      throw new Error(\"Container path manifest is missing a container id\");\n    }\n    return { containerId, manifestHash: bundle.manifestHash };\n  });\n}\n\nexport function authorizingContainerPathRefs(\n  writerProjection: DocumentWriterProjectionResponse,\n): ContainerManifestRef[][] {\n  return writerProjection.authorizingContainerPaths.map((projection) =>\n    containerPathRefs(projection.path),\n  );\n}\n\nexport function authorizingContainerPathRefsForLinkSet(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerId: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}): ContainerManifestRef[][] {\n  const paths = input.writerProjection.authorizingContainerPaths.filter(\n    (projection) =>\n      input.operation === \"link\" ||\n      projectionLeafContainerId(projection) !== input.targetContainerId,\n  );\n  if (paths.length === 0) {\n    throw new Error(\"Document link-set authorizing paths are missing\");\n  }\n\n  return paths.map((projection) => containerPathRefs(projection.path));\n}\n"]}

package/data/documents/shared/syncPagination.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncPagination.js","sourceRoot":"","sources":["syncPagination.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAezD,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAmBD,MAAM,UAAU,oBAAoB,CAClC,QAA8B;IAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,YAAsD,EACtD,QAA4B;IAE5B,IAAI,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,YAAY,CAAC,aAAa,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC;QACjE,CAAC,CAAC,YAAY,CAAC,SAAS;QACxB,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAI7B;IACC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,wCAAwC,CAChD,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACpE,MAAM,IAAI,wCAAwC,CAChD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wCAAwC,CAChD,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IACvC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wCAAwC,CAChD,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,wCAAwC,CAChD,iDAAiD,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAA8B;IACrD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAIrC;IACC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IACE,KAAK,CAAC,qBAAqB,KAAK,SAAS;QACzC,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,qBAAqB,EAC3D,CAAC;QACD,MAAM,IAAI,wCAAwC,CAChD,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IAC7D,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QACjC,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,wCAAwC,CAChD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,IAAI,wCAAwC,CAChD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,UAAU,KAAK,IAAI;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAIxC;IACC,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACrD,KAAK,CAAC,IAAI,CAAC,UAAU,EACrB,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;gBACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;gBAChE,YAAY,EAAE,KAAK;aACpB,CACF,CAAC;YACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport type {\n  DocumentSyncCommitLsnMode,\n  DocumentSyncPullContinuation,\n} from \"./pullContinuation\";\nimport type {\n  DocumentSyncApi,\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n} from \"./types\";\n\nexport type {\n  DocumentSyncCommitLsnMode,\n  DocumentSyncPullContinuation,\n} from \"./pullContinuation\";\nexport { documentSyncPullContinuationsEqual } from \"./pullContinuation\";\n\nexport class InvalidDocumentSyncPullContinuationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidDocumentSyncPullContinuationError\";\n  }\n}\n\ntype DocumentSyncPageSubmission =\n  | {\n      readonly ok: true;\n      readonly response: DocumentSyncResponse;\n    }\n  | DocumentSyncSubmitFailure\n  | null;\n\ntype DocumentSyncSubmission =\n  | {\n      readonly ok: true;\n      readonly pullComplete: boolean;\n      readonly response: DocumentSyncResponse;\n    }\n  | DocumentSyncSubmitFailure\n  | null;\n\nexport function readPullContinuation(\n  response: DocumentSyncResponse,\n): DocumentSyncPullContinuation | null {\n  const cursor = requirePullPage(response).nextCursor;\n  if (cursor === null) return null;\n  if (response.commitLsn === null) {\n    throw new Error(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  return {\n    commitLsn: response.commitLsn,\n    commitLsnMode: response.commitLsnMode,\n    cursor,\n  };\n}\n\nexport function resolvePullContinuationMinLsn(\n  continuation: DocumentSyncPullContinuation | undefined,\n  fallback: string | undefined,\n): string | undefined {\n  if (!continuation) return fallback;\n  if (continuation.commitLsnMode === \"untracked\" || fallback === undefined) {\n    return continuation.commitLsn;\n  }\n  return parseWalLsn(continuation.commitLsn) >= parseWalLsn(fallback)\n    ? continuation.commitLsn\n    : fallback;\n}\n\nfunction assertPageCheckpoint(input: {\n  readonly minLsn: string | undefined;\n  readonly nextCursor: string | null;\n  readonly response: DocumentSyncResponse;\n}): void {\n  if (input.response.commitLsnMode === \"untracked\") {\n    if (input.response.commitLsn !== \"0/0\") {\n      throw new InvalidDocumentSyncPullContinuationError(\n        \"Document sync continuation untracked LSN is invalid\",\n      );\n    }\n    return;\n  }\n  if (input.response.commitLsn === null) {\n    if (input.minLsn === undefined && input.nextCursor === null) return;\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  let responseLsn: bigint;\n  try {\n    responseLsn = parseWalLsn(input.response.commitLsn);\n  } catch {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN is invalid\",\n    );\n  }\n  if (input.minLsn === undefined) return;\n  let minimumLsn: bigint;\n  try {\n    minimumLsn = parseWalLsn(input.minLsn);\n  } catch {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync minimum commit LSN is invalid\",\n    );\n  }\n  if (responseLsn < minimumLsn) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN regressed\",\n    );\n  }\n}\n\nfunction requirePullPage(response: DocumentSyncResponse) {\n  if (response.pullPage === undefined) {\n    throw new Error(\"Document sync response is missing pull page metadata\");\n  }\n  return response.pullPage;\n}\n\nasync function submitDocumentSyncPage(input: {\n  readonly expectedCommitLsnMode?: DocumentSyncCommitLsnMode | undefined;\n  readonly plan: DocumentSyncPlan;\n  readonly submit: () => Promise<DocumentSyncPageSubmission>;\n}): Promise<DocumentSyncSubmission> {\n  const page = await input.submit();\n  if (!page?.ok) return page;\n  if (\n    input.expectedCommitLsnMode !== undefined &&\n    page.response.commitLsnMode !== input.expectedCommitLsnMode\n  ) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN mode changed\",\n    );\n  }\n  const nextCursor = requirePullPage(page.response).nextCursor;\n  assertPageCheckpoint({\n    minLsn: input.plan.request.minLsn,\n    nextCursor,\n    response: page.response,\n  });\n  if (nextCursor !== null && page.response.commitLsn === null) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  if (nextCursor !== null && nextCursor === input.plan.request.pullCursor) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation cursor did not advance\",\n    );\n  }\n  return {\n    ok: true,\n    pullComplete: nextCursor === null,\n    response: page.response,\n  };\n}\n\nexport async function submitDocumentSync(input: {\n  apiClient: DocumentSyncApi;\n  expectedCommitLsnMode?: DocumentSyncCommitLsnMode | undefined;\n  plan: DocumentSyncPlan;\n}): Promise<DocumentSyncSubmission> {\n  return submitDocumentSyncPage({\n    expectedCommitLsnMode: input.expectedCommitLsnMode,\n    plan: input.plan,\n    submit: async () => {\n      const result = await input.apiClient.syncDocumentResult(\n        input.plan.documentId,\n        input.plan.request,\n        {\n          expectedPaymentRequiredOrganizationId: input.plan.organizationId,\n          reportErrors: false,\n        },\n      );\n      return result.ok ? { ok: true, response: result.data } : result;\n    },\n  });\n}\n"]}

package/data/documents/shared/syncResponseAuthorization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncResponseAuthorization.js","sourceRoot":"","sources":["syncResponseAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EAEnC,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,qEAAqE,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGhD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAWzD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACxD,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,IACE,CAAC,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IACE,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;QAC/D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CACxC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,MAAM,CAAC,qBAAqB,CAClE,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IACE,CAAC,IAAI;YACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YAC7C,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc;YACvD,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EAC7D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;IAC3D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;QACxD,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,qBAAqB,EAAE,KAAK,CAAC,UAAU;QACvC,0BAA0B,EAAE,OAAO,CAAC,GAAG,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CACvC;QACD,6BAA6B,EAAE,OAAO,CAAC,GAAG,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC;QACD,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,yBAAyB;QACzB,kBAAkB;QAClB,gBAAgB;QAChB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computeDocumentContentKeyTargetHash,\n  type DocumentContentKeyTarget,\n  makeVerifiedDocumentKekTargets,\n} from \"@tearleads/crypto\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { resolveEventContainerPaths } from \"../../keyingProjectionVerification/document/documentDependencyPaths\";\nimport { sortDocumentTargets } from \"./readers\";\nimport type { DocumentSyncPlan } from \"./types\";\n\nexport async function documentWriteAuthorizationForHeader(input: {\n  readonly allowMissingAuthorization: boolean;\n  readonly dependencyManifestHashes: readonly string[];\n  readonly authorizationTargets: readonly DocumentContentKeyTarget[];\n  readonly contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  readonly manifestHash: string;\n  readonly plan: Pick<\n    DocumentSyncPlan,\n    \"documentId\" | \"organizationId\" | \"documentWriterAuthorization\"\n  >;\n  readonly targetHash: string;\n}) {\n  const source = input.plan.documentWriterAuthorization;\n  if (!source) {\n    if (input.allowMissingAuthorization) {\n      return null;\n    }\n    throw new Error(\n      \"Document sync response lacks verified writer-authorization material\",\n    );\n  }\n  const documentManifest = source.documentManifestByHash.get(\n    input.manifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\n      \"Document sync response write manifest is not in verified history\",\n    );\n  }\n  if (input.contentKeyBundle.documentId !== input.plan.documentId) {\n    throw new Error(\n      \"Document sync response content-key bundle belongs to another document\",\n    );\n  }\n\n  const targets = sortDocumentTargets(input.authorizationTargets);\n  if (\n    (await computeDocumentContentKeyTargetHash(targets)) !== input.targetHash\n  ) {\n    throw new Error(\"Document sync response write targets are not canonical\");\n  }\n  const linkedContainerIds = new Set(documentManifest.state.linkedContainerIds);\n  if (\n    targets.length !== linkedContainerIds.size ||\n    targets.some((target) => !linkedContainerIds.has(target.containerId))\n  ) {\n    throw new Error(\n      \"Document sync response write targets do not match the signed link set\",\n    );\n  }\n\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash: source.containerPathByManifestHash,\n    dependencyManifestHashes: input.dependencyManifestHashes,\n  });\n  // A writer needs one committed target, and can be unable to read another\n  // linked container. Validate the targets that are cited without inventing\n  // paths for uncited targets or dropping signed ancestor evidence.\n  for (const target of targets) {\n    const path = dependencyContainerPaths.find(\n      (candidate) =>\n        candidate.at(-1)?.manifestHash === target.containerManifestHash,\n    );\n    if (!path) continue;\n    const leaf = path.at(-1);\n    if (\n      !leaf ||\n      leaf.state.containerId !== target.containerId ||\n      leaf.state.organizationId !== input.plan.organizationId ||\n      leaf.state.containerKeyEpochId !== target.containerKeyEpochId\n    ) {\n      throw new Error(\n        \"Document sync response write target lacks a verified container path\",\n      );\n    }\n  }\n  const authorizingContainerPaths = dependencyContainerPaths;\n  const documentKekTargets = makeVerifiedDocumentKekTargets({\n    documentId: input.contentKeyBundle.documentId,\n    documentKeyTargetHash: input.targetHash,\n    linkedContainerKeyEpochIds: targets.map(\n      (target) => target.containerKeyEpochId,\n    ),\n    linkedContainerManifestHashes: targets.map(\n      (target) => target.containerManifestHash,\n    ),\n    linkSetManifestHash: input.manifestHash,\n    targets,\n  });\n  return {\n    authorizingContainerPaths,\n    documentKekTargets,\n    documentManifest,\n    principalPolicies: source.principalPolicies,\n  };\n}\n"]}

package/data/documents/shared/syncResponses.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncResponses.js","sourceRoot":"","sources":["syncResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAQlF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAClE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,wCAAwC,CAC/C,IAAsB,EACtB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IACE,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2CAA2C,CAAC,KAQ1D;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;IACF,MAAM,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;QACxE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM;QACN,IAAI;KACL,CAAC,CAAC;IACH,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,qCAAqC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,8CAA8C,CAAC;QACnD,MAAM;QACN,gBAAgB;QAChB,IAAI;QACJ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gDAAgD,CAAC,KAOzD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,IAAI,yCAAyC,CACjD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yCAAyC,CACjD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACrC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAErD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,YAAY;QACZ,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,2CAA2C,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5E,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;QACnC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC7C,MAAM,CAAC,eAAe,KAAK,+BAA+B;QAC1D,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,iBAAiB;QACxD,CAAC,wBAAwB;YACvB,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC9C,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,2BAA2B;gBAC9D,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,MAA+C;IAE/C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CACtC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qCAAqC,CAAC,KAGpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAC;IACH,IAAI,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAM7D;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;QACzD,2BAA2B,EAAE,MAAM,CAAC,oBAAoB;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,yBAAyB,EAAE,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC;QACrE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,0BAA0B,EAAE,qBAAqB;YAC/C,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,IAAI,CAAC,2BAA2B;QACpC,cAAc,EAAE;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;QACD,MAAM;QACN,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,kBAAkB,EAAE,qBAAqB;YACvC,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,IAAI,CAAC,kBAAkB;QAC3B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,6CAA6C,CACpD,IAAsB,EACtB,QAA8B;IAE9B,IACE,QAAQ,CAAC,aAAa,KAAK,WAAW;QACtC,QAAQ,CAAC,SAAS,KAAK,oBAAoB,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CACxB,IAAI,CAAC,MAAM,EACX,qCAAqC,CACtC,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IACE,CAAC,CACC,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,CACvC;QACD,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAClE,MAAM,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,yBAAyB,CAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAC3B,OAAO,EACP,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,qDAAqD;AACrD,SAAS,yCAAyC,CAChD,IAAsB,EACtB,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,WAAW,GAAG,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgD;IAEhD,OAAO,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oCAAoC,CAC3C,IAAsB,EACtB,QAA8B;IAE9B,IACE,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpD,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,CAAC,eAAe,IAAI,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8CAA8C,CAC3D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,IAAI,EACJ,QAAQ,CACT,CAAC;IACF,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC9D,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,wCAAwC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,6CAA6C,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9D,yCAAyC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,2CAA2C,CAAC;QAC1C,wBAAwB;QACxB,IAAI;QACJ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IAEF,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,8CAA8C,CACzD,IAAI,EACJ,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yCAAyC;YAAE,MAAM,KAAK,CAAC;QAC5E,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,UAAU,CACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,UAAU,oCAAoC,CAClD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,6BAA6B,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  verifyWriteHeader,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  DOCUMENT_SYNC_ERROR_CODES,\n  type DocumentSyncResponse,\n} from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport { throwKeyingVerificationShapeFailure } from \"../../keyingProjectionVerification/error\";\nimport {\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"./readers\";\n\nexport { submitDocumentSync } from \"./syncPagination\";\n\nimport { documentWriteAuthorizationForHeader } from \"./syncResponseAuthorization\";\nimport type {\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n  DocumentWriterPublicKeyResolver,\n  PersistedDocumentSyncState,\n} from \"./types\";\n\n// Remote-primary databases without a portable WAL position use the zero LSN\n// as an explicit \"checkpoint not tracked\" sentinel. It is accepted only when\n// the response declares that mode, letting a local record carrying a checkpoint\n// from another backend move to that primary without weakening tracked checks.\n// This protects against replica lag, not a server that falsely declares its own\n// consistency capability; the authenticated server remains the source of data.\nconst UNTRACKED_COMMIT_LSN = \"0/0\";\n\nexport class DocumentSyncResponseUpdateContentKeyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DocumentSyncResponseUpdateContentKeyError\";\n  }\n}\n\nfunction assertAcceptedOutgoingUpdateIdsMatchPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const expected = plan.request.outgoingUpdates.map((update) => update.id);\n  const accepted = response.acceptedOutgoingUpdateIds;\n  const expectedSorted = [...expected].sort();\n  const acceptedSorted = [...accepted].sort();\n  if (\n    expectedSorted.length !== acceptedSorted.length ||\n    expectedSorted.some((id, index) => id !== acceptedSorted[index])\n  ) {\n    throw new Error(\"Document sync response accepted update mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseUpdateMatchesPlan(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n}): Promise<void> {\n  const { plan, update } = input;\n  if (update.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response update document mismatch\");\n  }\n  const header = readWriteHeader(\n    update.writeHeader,\n    \"Document sync response write header\",\n  );\n  await assertDocumentSyncResponseUpdateHashes({ update });\n  const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({\n    contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,\n    header,\n    plan,\n  });\n  assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });\n  await assertDocumentSyncResponseNonceDomain({ header, plan });\n  await assertDocumentSyncResponseWriteHeaderSignature({\n    header,\n    contentKeyBundle,\n    plan,\n    resolveWriterPublicKey: input.resolveWriterPublicKey,\n    update,\n  });\n}\n\nfunction assertDocumentSyncResponseUpdateContentKeyBundle(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): DocumentSyncResponse[\"contentKeyBundle\"] {\n  const { header, plan } = input;\n  if (header.contentKeyEpoch > plan.contentKeyEpoch) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response includes a future content-key epoch\",\n    );\n  }\n\n  const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);\n  if (!bundle) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response content-key bundle missing\",\n    );\n  }\n  if (\n    bundle.documentId !== plan.documentId ||\n    bundle.contentKeyEpoch !== header.contentKeyEpoch\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n  return bundle;\n}\n\nasync function assertDocumentSyncResponseUpdateHashes(input: {\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { update } = input;\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    update.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response ciphertext hash mismatch\");\n  }\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: update.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    metadataHash !==\n    readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response metadata hash mismatch\");\n  }\n}\n\nfunction assertDocumentSyncResponseWriteHeaderFields(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): void {\n  const { header, plan, update } = input;\n  const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);\n\n  if (\n    header.version !== 1 ||\n    header.objectKind !== \"document\" ||\n    header.objectId !== plan.documentId ||\n    header.organizationId !== plan.organizationId ||\n    header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||\n    header.writerKeyFingerprint !== update.authorFingerprint ||\n    (mustMatchCurrentBoundary &&\n      (header.contentKeyEpoch !== plan.contentKeyEpoch ||\n        header.accessManifestHash !== plan.expectedLinkSetManifestHash ||\n        header.targetHash !== plan.expectedTargetHash))\n  ) {\n    throw new Error(\"Document sync response write header mismatch\");\n  }\n}\n\nfunction isAcceptedOutgoingSyncUpdate(\n  plan: DocumentSyncPlan,\n  update: DocumentSyncResponse[\"updates\"][number],\n): boolean {\n  return plan.request.outgoingUpdates.some(\n    (outgoingUpdate) => outgoingUpdate.id === update.id,\n  );\n}\n\nasync function assertDocumentSyncResponseNonceDomain(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): Promise<void> {\n  const { header, plan } = input;\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: plan.organizationId,\n    objectKind: \"document\",\n    objectId: plan.documentId,\n    contentKeyEpoch: header.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: header.contentRecordId,\n  });\n  if (nonceDomainHash !== header.nonceDomainHash) {\n    throw new Error(\"Document sync response nonce domain mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseWriteHeaderSignature(input: {\n  contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { header, plan, update } = input;\n  const writerPublicKey = await input.resolveWriterPublicKey({\n    writerSigningKeyFingerprint: header.writerKeyFingerprint,\n    writerUserId: header.writerUserId,\n  });\n  if (!writerPublicKey) {\n    throw new Error(\"Document sync response writer public key missing\");\n  }\n\n  const documentAuthorization = await documentWriteAuthorizationForHeader({\n    allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),\n    authorizationTargets: update.authorizationTargets,\n    dependencyManifestHashes: header.dependencyManifestHashes,\n    contentKeyBundle: input.contentKeyBundle,\n    manifestHash: header.accessManifestHash,\n    plan,\n    targetHash: header.targetHash,\n  });\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    expectedAccessManifestHash: documentAuthorization\n      ? header.accessManifestHash\n      : plan.expectedLinkSetManifestHash,\n    expectedObject: {\n      objectKind: \"document\",\n      objectId: plan.documentId,\n      organizationId: plan.organizationId,\n    },\n    header,\n    ...(documentAuthorization ? { documentAuthorization } : {}),\n    expectedTargetHash: documentAuthorization\n      ? header.targetHash\n      : plan.expectedTargetHash,\n    writerPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n\nfunction assertDocumentSyncCommitCheckpointMatchesPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  if (\n    response.commitLsnMode === \"untracked\" &&\n    response.commitLsn !== UNTRACKED_COMMIT_LSN\n  ) {\n    throw new Error(\n      \"Document sync response untracked commit LSN must use the 0/0 sentinel\",\n    );\n  }\n  if (\n    response.commitLsn === UNTRACKED_COMMIT_LSN &&\n    response.commitLsnMode !== \"untracked\"\n  ) {\n    throw new Error(\n      \"Document sync response 0/0 commit LSN must be declared untracked\",\n    );\n  }\n  if (response.commitLsn !== null) {\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\");\n  }\n  if (plan.minLsn === undefined) {\n    return;\n  }\n  const minLsn = parseWalLsn(\n    plan.minLsn,\n    \"Document sync requested minimum LSN\",\n  );\n  if (response.commitLsn === null) {\n    throw new Error(\"Document sync response commit LSN is missing\");\n  }\n  if (\n    !(\n      response.commitLsn === UNTRACKED_COMMIT_LSN &&\n      response.commitLsnMode === \"untracked\"\n    ) &&\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\") <\n      minLsn\n  ) {\n    throw new Error(\"Document sync response commit LSN is stale\");\n  }\n}\n\nfunction documentSyncManifestEpoch(plan: DocumentSyncPlan): number {\n  if (!isPlainRecord(plan.documentManifest.state)) {\n    throw new Error(\"Document sync manifest state is invalid\");\n  }\n\n  return readRecordPositiveInteger(\n    plan.documentManifest.state,\n    \"epoch\",\n    \"Document sync manifest state\",\n  );\n}\n\n// The one load-bearing epoch check: no returned update may claim an\n// accessEpoch newer than the current manifest epoch.\nfunction assertDocumentSyncAccessEpochsNotInFuture(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const currentAccessEpoch = documentSyncManifestEpoch(plan);\n  for (const update of response.updates) {\n    if (update.accessEpoch > currentAccessEpoch) {\n      throw new Error(\"Document sync response includes a future access epoch\");\n    }\n  }\n}\n\nfunction contentKeyBundleCanonical(\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"],\n): string {\n  return serializeCanonical(bundle, \"content-key bundle\");\n}\n\nfunction documentSyncContentKeyBundlesByEpoch(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  if (\n    contentKeyBundleCanonical(response.contentKeyBundle) !==\n    contentKeyBundleCanonical(plan.sourceContentKeyBundle)\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n\n  const bundleByEpoch = new Map<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >();\n  const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];\n\n  for (const bundle of bundles) {\n    if (bundle.documentId !== plan.documentId) {\n      throw new Error(\n        \"Document sync response content-key bundle document mismatch\",\n      );\n    }\n    if (\n      !Number.isInteger(bundle.contentKeyEpoch) ||\n      bundle.contentKeyEpoch <= 0\n    ) {\n      throw new Error(\n        \"Document sync response content-key bundle epoch mismatch\",\n      );\n    }\n\n    // The current epoch travels only as contentKeyBundle; the array carries\n    // each older epoch once.\n    if (bundleByEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    bundleByEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return bundleByEpoch;\n}\n\nasync function persistedDocumentSyncStateFromResponseInternal(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  if (response.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response document id mismatch\");\n  }\n  const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(\n    plan,\n    response,\n  );\n  if (\n    serializeCanonical(response.documentKekTargets, \"KEK targets\") !==\n    serializeCanonical(plan.documentKekTargets, \"KEK targets\")\n  ) {\n    throw new Error(\"Document sync response KEK target mismatch\");\n  }\n  assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);\n  assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);\n  assertDocumentSyncAccessEpochsNotInFuture(plan, response);\n\n  await Promise.all(\n    response.updates.map((update) =>\n      assertDocumentSyncResponseUpdateMatchesPlan({\n        contentKeyBundlesByEpoch,\n        plan,\n        resolveWriterPublicKey: options.resolveWriterPublicKey,\n        update,\n      }),\n    ),\n  );\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: plan.documentId,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: plan.documentManifest,\n  });\n}\n\nexport async function persistedDocumentSyncStateFromResponse(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  try {\n    return await persistedDocumentSyncStateFromResponseInternal(\n      plan,\n      response,\n      options,\n    );\n  } catch (error) {\n    if (error instanceof DocumentSyncResponseUpdateContentKeyError) throw error;\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function isRetryableDocumentSyncConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale\n  );\n}\n\n// The wipe gate is deliberately strict — coded 404s only, which is the right\n// failure mode for a destructive action. A bare 404 proves nothing about the\n// document: proxy/tunnel error pages, deploy-skew route misses, and\n// container-level lookups all produce one.\nexport function isUpstreamDeletedDocumentSyncFailure(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n  );\n}\n"]}

package/data/persistence/documentPurgeCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentPurgeCheckpointPersistence.js","sourceRoot":"","sources":["documentPurgeCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AASpE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,UAAkB;IAElB,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC;SAC3D,EAAE,CAAC,MAAM,CAAC;QACT,UAAU,EAAE,wBAAwB,CAAC,UAAU;QAC/C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,UAAmC,EACnC,SAAiB;IAEjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;SACrE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,EAAE,CAAC;QACX,IACE,MAAM,CAAC,oBAAoB,KAAK,UAAU,CAAC,oBAAoB;YAC/D,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACnD,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc,EACnD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;SACpC,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport {\n  documentPurgeCheckpoints,\n  keyingCheckpointTables,\n} from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface DocumentPurgeCheckpoint {\n  readonly documentId: string;\n  readonly documentManifestHash: string;\n  readonly organizationId: string;\n  readonly purgeEventHash: string;\n}\n\nexport async function loadDocumentPurgeCheckpoint(\n  execSql: ExecSql,\n  documentId: string,\n): Promise<DocumentPurgeCheckpoint | null> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n  const [row] = await getClientSQLitePersistenceRuntime(execSql)\n    .db.select({\n      documentId: documentPurgeCheckpoints.documentId,\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function storeDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: DocumentPurgeCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const [stored] = await tx\n    .select({\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, checkpoint.documentId))\n    .limit(1);\n  if (stored) {\n    if (\n      stored.documentManifestHash !== checkpoint.documentManifestHash ||\n      stored.organizationId !== checkpoint.organizationId ||\n      stored.purgeEventHash !== checkpoint.purgeEventHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"Document purge checkpoint conflicts with the verified terminal event\",\n      );\n    }\n    return;\n  }\n  await tx\n    .insert(documentPurgeCheckpoints)\n    .values({ ...checkpoint, updatedAt })\n    .run();\n}\n"]}

package/data/persistence/keyingCheckpointAdvancePersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAKvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,8CAA8C,EAC9C,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAmCpF,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAMrE;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,8CAA8C,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,sBAAsB,CAC1B,EAAE,EACF,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IACE,CAAC,UAAU;gBACX,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACrC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { verifiedManifestBundleTables } from \"../sqlite/verifiedManifestBundleSchema\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport {\n  assertPrincipalPolicyBundleStoredInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"./verifiedManifestBundlePersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface VerifiedPrincipalPolicyBundleEntry {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\nasync function validatePolicyAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\nasync function writePolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n\n/**\n * Persists each verified full policy bundle together with its durable head.\n * This prevents a crash or bundle-write failure from leaving a checkpoint\n * without the exact same-head payload and member-envelope evidence.\n */\nexport async function persistVerifiedPrincipalPolicyBundlesAtomically(input: {\n  readonly entries: readonly VerifiedPrincipalPolicyBundleEntry[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  const seen = new Set<string>();\n  for (const entry of input.entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `verified policy bundle batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const persist = async (tx: ClientSQLiteTransactionScope) => {\n    const policies = await validatePolicyAdvances(\n      tx,\n      input.entries.map((entry) => entry.policy),\n    );\n    for (const entry of input.entries) {\n      await writePrincipalPolicyBundleInTransaction(\n        tx,\n        entry.bundle,\n        input.updatedAt,\n        input.organizationId,\n      );\n      await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);\n    }\n    await writePolicyCheckpoints(\n      tx,\n      policies,\n      input.updatedAt,\n      input.organizationId,\n    );\n    for (const policy of policies.values()) {\n      const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n      if (\n        !checkpoint ||\n        checkpoint.version !== policy.version ||\n        checkpoint.stateHash !== policy.stateHash\n      ) {\n        throw new Error(\n          \"Verified principal policy checkpoint was not persisted\",\n        );\n      }\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(persist, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(persist, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/keyingCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAc1G,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"./principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}

package/data/persistence/locallyAcknowledgedCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"locallyAcknowledgedCheckpointPersistence.js","sourceRoot":"","sources":["locallyAcknowledgedCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oCAAoC,EACpC,uBAAuB,EAGvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAOpF,MAAM,UAAU,iCAAiC,CAAC,IAGjD;IACC,OAAO;QACL,UAAU,EAAE,oCAAoC,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAA2C,EAC3C,eAAgD;IAEhD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,EAAE;QAC1B,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,UAAU;YAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD;QACD,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAgC,EAChC,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,wBAAwB,CACtB,IAAI,EACJ,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAsD,EACtD,SAAiB;IAEjB,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uDAAuD,CAAC,KAO7E;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,IACE,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK;gBACjC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAC9C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxE,IACE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EACxC,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CACL,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;YAChE,QAAQ,EAAE,WAAW;SACtB,CAAC,CACH,CAAC,SAAS,CAAC;IACd,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA+B,EAC/B,UAA4C;IAE5C,+BAA+B,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,gCAAgC,CACvC,OAA4D;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,KAUtD;IACC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACvD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,0BAA0B,CACxB,MAAM,EACN,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB;YACzB,MAAM,8BAA8B,CAClC,EAAE,EACF,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EACzC,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,wCAAwC,CAC5C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;YAC1D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gDAAgD,CAAC,KAMhE;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAC7D,KAKC;IAED,OAAO,gDAAgD,CAAC;QACtD,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAAC,KAS/D;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  accessManifestCheckpointFromManifest,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedPrincipalPolicy,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport {\n  type AcknowledgedPrincipalGrantRetirements,\n  assertContainerNotRetired,\n  storePrincipalGrantRetirements,\n} from \"./principalGrantRetirementPersistence\";\nimport {\n  retainPrincipalPolicyBundleInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface LocallyAcknowledgedAccessManifestHead {\n  readonly checkpoint: AccessManifestCheckpoint;\n  readonly previousManifestHash: string | null;\n}\n\nexport function locallyAuthoredAccessManifestHead(plan: {\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n}): LocallyAcknowledgedAccessManifestHead {\n  return {\n    checkpoint: accessManifestCheckpointFromManifest({\n      manifest: plan.manifest,\n      manifestHash: plan.manifestHash,\n    }),\n    previousManifestHash: plan.manifest.previousManifestHash,\n  };\n}\n\nfunction validateAcknowledgedHead(\n  head: LocallyAcknowledgedAccessManifestHead,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): void {\n  if (!localCheckpoint) {\n    if (head.checkpoint.epoch !== 1 || head.previousManifestHash !== null) {\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"locally acknowledged access manifest does not begin at epoch 1\",\n      );\n    }\n    return;\n  }\n\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: [],\n    current: {\n      ...head.checkpoint,\n      previousManifestHash: head.previousManifestHash,\n    },\n    localCheckpoint,\n  });\n}\n\nasync function validateAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  heads: readonly LocallyAcknowledgedAccessManifestHead[],\n): Promise<Map<string, AccessManifestCheckpoint>> {\n  const pending = new Map<string, AccessManifestCheckpoint>();\n  for (const head of heads) {\n    await assertContainerNotRetired(tx, head.checkpoint);\n    const key = accessManifestObjectKey(head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `locally acknowledged batch contains multiple heads for ${key}`,\n      );\n    }\n    validateAcknowledgedHead(\n      head,\n      await loadStoredAccessManifestCheckpoint(tx, head.checkpoint),\n    );\n    pending.set(key, head.checkpoint);\n  }\n  return pending;\n}\n\nasync function writeAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, AccessManifestCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const checkpoint of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/**\n * Commits only heads authored and signed by this client after an exact remote\n * acknowledgement check. Every non-initial head must directly extend the\n * latest durable pin; arbitrary remote projections must use the verified\n * projection checkpoint path instead.\n */\nexport async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input: {\n  readonly execSql: ExecSql;\n  readonly heads: readonly LocallyAcknowledgedAccessManifestHead[];\n  /** Optional optimistic read dependencies, checked inside the write transaction. */\n  readonly expectedAccessManifestCheckpoints?: readonly AccessManifestCheckpoint[];\n  readonly expectedPrincipalPolicyCheckpoints?: readonly PrincipalPolicyCheckpoint[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  await ensureSqlTables(input.execSql, keyingCheckpointTables);\n  const updatedAt = new Date().toISOString();\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const acknowledge = async (tx: ClientSQLiteTransactionScope) => {\n    for (const expected of input.expectedAccessManifestCheckpoints ?? []) {\n      const current = await loadStoredAccessManifestCheckpoint(tx, expected);\n      if (\n        current?.epoch !== expected.epoch ||\n        current.manifestHash !== expected.manifestHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation container checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    for (const expected of input.expectedPrincipalPolicyCheckpoints ?? []) {\n      const current = await loadStoredPrincipalPolicyCheckpoint(tx, expected);\n      if (\n        current?.version !== expected.version ||\n        current.stateHash !== expected.stateHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation principal policy checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    const pending = await validateAcknowledgedHeads(tx, input.heads);\n    await writeAcknowledgedHeads(tx, pending, updatedAt);\n  };\n  if (input.stillCurrent) {\n    return (\n      await runtime.guardedTransaction(acknowledge, input.stillCurrent, {\n        behavior: \"immediate\",\n      })\n    ).committed;\n  }\n  await runtime.transaction(acknowledge, { behavior: \"immediate\" });\n  return true;\n}\n\nfunction validateAcknowledgedPolicy(\n  policy: VerifiedPrincipalPolicy,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): void {\n  verifyPrincipalPolicyCheckpoint({\n    chain: policy.history ?? [],\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (!checkpoint && policy.version !== 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not begin at version 1\",\n    );\n  }\n  if (checkpoint && policy.version > checkpoint.version + 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not directly extend the durable checkpoint\",\n    );\n  }\n}\n\ninterface LocallyAcknowledgedPrincipalPolicyBundle {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nfunction assertUniqueAcknowledgedPolicies(\n  entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[],\n): void {\n  const seen = new Set<string>();\n  for (const { policy } of entries) {\n    const key = principalPolicyKey(policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `locally acknowledged policy batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n}\n\nasync function storeAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly placement: \"current\" | \"history\";\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  assertUniqueAcknowledgedPolicies(input.entries);\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const store = async (tx: ClientSQLiteTransactionScope) => {\n    for (const { policy } of input.entries) {\n      validateAcknowledgedPolicy(\n        policy,\n        await loadStoredPrincipalPolicyCheckpoint(tx, policy),\n      );\n    }\n    if (input.retiredContainers)\n      await storePrincipalGrantRetirements(\n        tx,\n        input.retiredContainers,\n        input.entries.map(({ policy }) => policy),\n        input.organizationId,\n      );\n    for (const entry of input.entries) {\n      if (input.placement === \"current\") {\n        await writePrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      } else {\n        await retainPrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      }\n    }\n    for (const { policy } of input.entries) {\n      await upsertPrincipalPolicyCheckpointInTransaction(\n        tx,\n        policy.checkpoint,\n        input.updatedAt,\n        input.organizationId,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(store, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(store, { behavior: \"immediate\" });\n}\n\n/** Atomically pins and caches exact full policy bundles acknowledged by the API. */\nexport function persistLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"current\",\n  });\n}\n\nexport function persistLocallyAcknowledgedPrincipalPolicyBundle(\n  input: LocallyAcknowledgedPrincipalPolicyBundle & {\n    readonly execSql: ExecSql;\n    readonly organizationId?: string | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly updatedAt: string;\n  },\n): Promise<void> {\n  return persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: input.updatedAt,\n  });\n}\n\nexport function retainLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"history\",\n  });\n}\n"]}

package/data/persistence/organizationReplacementCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationReplacementCheckpointPersistence.js","sourceRoot":"","sources":["organizationReplacementCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAE1G;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAI/D;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;IACpD,MAAM,IAAI,GAA6B;QACrC,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,aAAa,CAAC,eAAe;QACvC,cAAc;QACd,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,aAAa,CAAC,gBAAgB;KAC7C,CAAC;IACF,MAAM,UAAU,GAAgC;QAC9C;YACE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,qBAAqB;SAC/C;QACD;YACE,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,mBAAmB;SAC7C;QACD;YACE,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,aAAa,CAAC,aAAa;YACxC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,oBAAoB;SAC9C;KACF,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtE,IACE,UAAU,EAAE,KAAK,KAAK,CAAC;YACvB,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YAE7C,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;QACJ,IAAI,CAAC,UAAU;YACb,MAAM,2CAA2C,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACzE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;gBACvD,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,cAAc;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACxE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;gBACnE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,gEAAgE,CACjE,CAAC;YACJ,IAAI,CAAC,MAAM;gBACT,MAAM,4CAA4C,CAChD,EAAE,EACF,SAAS,EACT,SAAS,EACT,cAAc,CACf,CAAC;QACN,CAAC;IACH,CAAC,EACD,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAClC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"./principalPolicyOrganizationPersistence\";\n\n/**\n * A verified authorization from this identity also authenticates the winning\n * device's genesis. Seed first-sight pins before adopting its IDs; retain any\n * later observations rather than rolling them back to the provisioning epoch.\n */\nexport async function persistOrganizationReplacementCheckpoints(input: {\n  readonly authorization: VerifiedOrganizationReplacementAuthorization;\n  readonly execSql: ExecSql;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  const authorization = input.authorization;\n  const organizationId = authorization.organizationId;\n  const root: AccessManifestCheckpoint = {\n    objectKind: \"container\",\n    objectId: authorization.rootContainerId,\n    organizationId,\n    epoch: 1,\n    manifestHash: authorization.rootManifestHash,\n  };\n  const principals: PrincipalPolicyCheckpoint[] = [\n    {\n      principalType: \"organization\",\n      principalId: organizationId,\n      version: 1,\n      stateHash: authorization.organizationStateHash,\n    },\n    {\n      principalType: \"group\",\n      principalId: authorization.adminGroupId,\n      version: 1,\n      stateHash: authorization.adminGroupStateHash,\n    },\n    {\n      principalType: \"group\",\n      principalId: authorization.memberGroupId,\n      version: 1,\n      stateHash: authorization.memberGroupStateHash,\n    },\n  ];\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const updatedAt = new Date().toISOString();\n      await assertContainerNotRetired(tx, root);\n      const storedRoot = await loadStoredAccessManifestCheckpoint(tx, root);\n      if (\n        storedRoot?.epoch === 1 &&\n        storedRoot.manifestHash !== root.manifestHash\n      )\n        throw new KeyingVerificationError(\n          \"equivocation\",\n          \"Replacement root conflicts with its local genesis checkpoint\",\n        );\n      if (!storedRoot)\n        await upsertAccessManifestCheckpointInTransaction(tx, root, updatedAt);\n      for (const principal of principals) {\n        await recordPrincipalPolicyOrganizationInTransaction(tx, {\n          principalId: principal.principalId,\n          principalType: principal.principalType,\n          organizationId,\n        });\n        const stored = await loadStoredPrincipalPolicyCheckpoint(tx, principal);\n        if (stored?.version === 1 && stored.stateHash !== principal.stateHash)\n          throw new KeyingVerificationError(\n            \"equivocation\",\n            \"Replacement policy conflicts with its local genesis checkpoint\",\n          );\n        if (!stored)\n          await upsertPrincipalPolicyCheckpointInTransaction(\n            tx,\n            principal,\n            updatedAt,\n            organizationId,\n          );\n      }\n    },\n    input.stillCurrent ?? (() => true),\n    { behavior: \"immediate\" },\n  );\n  return result.committed;\n}\n"]}

package/data/persistence/principalAuthorizationCheckpoints.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { loadStoredPrincipalPolicyCheckpoint } from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  for (const policy of policies) {\n    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAGG,EACH,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,iBAAiB,IAAI,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly (\n    | VerifiedPrincipalPolicy\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const history =\n    \"retainedHistory\" in retirement.policy\n      ? retirement.policy.retainedHistory\n      : retirement.policy.history;\n  const previous = history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalHistoryEvidencePersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAa9E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC;IAElC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,KAAK,CAAC,QAAQ;QACd,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KACnE,CAAC,CACH,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,sBAAsB;QACtE,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAAC,CAAC;aACzD,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,uBAAuB,CAAC,cAAc,CAAC;gBACrE,SAAS,EAAE,aAAa,CAAC,uBAAuB,CAAC,SAAS,CAAC;aAC5D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,0BAA0B,CAC9B,EAAE,EACF,KAAK,EACL,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CACrC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI;QAC3C,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { sqliteInsertBatchSize } from \"../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { writePrincipalHistoryNodes } from \"./principalHistoryNodeRetention\";\n\nconst ENTRY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryEntries);\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  // A repeated leaf keeps its last entry, as sequential upserts would.\n  const entries = new Map(\n    page.entries.map((entry) => [\n      entry.leafHash,\n      { ...scope, leafHash: entry.leafHash, entryJson: entry.entryJson },\n    ]),\n  );\n  const rows = [...entries.values()].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  );\n  for (let index = 0; index < rows.length; index += ENTRY_WRITE_BATCH_SIZE)\n    await tx\n      .insert(principalHistoryEntries)\n      .values(rows.slice(index, index + ENTRY_WRITE_BATCH_SIZE))\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: {\n          organizationId: excludedValue(principalHistoryEntries.organizationId),\n          entryJson: excludedValue(principalHistoryEntries.entryJson),\n        },\n      })\n      .run();\n  await writePrincipalHistoryNodes(\n    tx,\n    scope,\n    [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash)),\n  );\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryIndexProof({\n    rootHash: input.history.indexRootHash,\n    treeSize: input.history.currentEntry.state.version,\n    version: input.version,\n    readNode: async (hash) => {\n      const [row] = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            eq(principalHistoryNodes.hash, hash),\n          ),\n        )\n        .limit(1);\n      return row ?? null;\n    },\n  });\n  const [row] = await db\n    .select()\n    .from(principalHistoryEntries)\n    .where(\n      and(\n        eq(principalHistoryEntries.scopeId, input.scopeId),\n        eq(principalHistoryEntries.leafHash, resolved.leafHash),\n      ),\n    )\n    .limit(1);\n  let entry: unknown;\n  try {\n    entry = row ? JSON.parse(row.entryJson) : null;\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  const reference = input.expectedReference ?? {\n    principalType: entry.state.principalType,\n    principalId: entry.state.principalId,\n    version: entry.state.version,\n    keyEpoch: entry.state.keyEpoch,\n    stateHash: entry.state.stateHash,\n    keyFingerprint: entry.state.keyFingerprint,\n  };\n  return { reference, entry, proof: resolved.proof };\n}\n"]}