@tearleads/client-sdk 0.1.64 → 0.1.66

package/workflows/containers/child/share/sharePrincipalPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kEAAkE,CAAC;AACzH,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}
+{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mFAAmF,CAAC;AACvI,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AACpH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kFAAkF,CAAC;AACzI,OAAO,EAAE,mCAAmC,EAAE,MAAM,0FAA0F,CAAC;AAC/I,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}

package/workflows/containers/index.d.ts

@@ -2,9 +2,9 @@ export { ContainerAuthorAccessError } from "../../data/containers/shared/authorA
 export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
 export type { ContainerReciteApi } from "../../data/containers/shared/reciteApi.js";
 export type { ContainerMutationAuthor, MaterializedContainerRekeyPlan, } from "../../data/containers/shared/types.js";
-export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
-export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/keyringRebuild.js";
-export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
+export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
 export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
 export { moveRemoteContainer } from "./child/move/index.js";

package/workflows/containers/index.js

@@ -4,8 +4,8 @@ export { ContainerAuthorAccessError } from "../../data/containers/shared/authorA
 // A create or move past the readable path length; `code` is
 // `container_path_too_deep`. Queued moves are abandoned, queued creates wait.
 export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
-export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
-export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/containerKek/keyringRebuild.js";
 // A share's projection verification can be cancelled by a newer generation
 // underneath the caller; hosts filter that outcome from their own reporting.
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";

package/workflows/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yDAAyD,CAAC;AACjE,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}

package/workflows/containers/writeRefusal.js

@@ -1,5 +1,5 @@
 import { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
-import { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKek/containerKekCurrency.js";
 function namedError(error, name) {
     return error instanceof Error && error.name === name;
 }

package/workflows/containers/writeRefusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"writeRefusal.js","sourceRoot":"","sources":["writeRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAkB1D,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,0EAA0E;IAC1E,IACE,KAAK,YAAY,mCAAmC;QACpD,UAAU,CAAC,KAAK,EAAE,qCAAqC,CAAC,EACxD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,IACE,KAAK,YAAY,+BAA+B;QAChD,UAAU,CAAC,KAAK,EAAE,iCAAiC,CAAC,EACpD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\n\n/**\n * Why the SDK refused to author a container-scoped write before anything was\n * encrypted or sent:\n *\n * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this\n *   writer's next document sync pass, or a peer, re-keys it parent-first.\n * - `repair-inaccessible`: the same, but the stale container is one this writer\n *   can neither re-key nor be given the key for. Queued changes stay queued and\n *   sync once a member with access to `containerId` repairs it.\n * - `unauthorized`: the signed path grants this signer too little access.\n */\nexport type ContainerWriteRefusal =\n  | { readonly kind: \"repair-required\"; readonly containerId: string }\n  | { readonly kind: \"repair-inaccessible\"; readonly containerId: string }\n  | { readonly kind: \"unauthorized\" };\n\nfunction namedError(error: unknown, name: string): error is Error {\n  return error instanceof Error && error.name === name;\n}\n\n/** A same-named error from elsewhere may lack the field; never say \"undefined\". */\nfunction repairContainerId(error: unknown): string | null {\n  const containerId = Reflect.get(Object(error), \"containerId\");\n  return typeof containerId === \"string\" && containerId.length > 0\n    ? containerId\n    : null;\n}\n\n/** Null for anything else, including keying-verification failures. */\nexport function classifyContainerWriteRefusal(\n  error: unknown,\n): ContainerWriteRefusal | null {\n  // Match by name as well: a host bundling the SDK twice holds two classes.\n  if (\n    error instanceof ContainerKekRepairInaccessibleError ||\n    namedError(error, \"ContainerKekRepairInaccessibleError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-inaccessible\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    namedError(error, \"ContainerKekRepairRequiredError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-required\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerAuthorAccessError ||\n    namedError(error, \"ContainerAuthorAccessError\")\n  ) {\n    return { kind: \"unauthorized\" };\n  }\n  return null;\n}\n"]}
+{"version":3,"file":"writeRefusal.js","sourceRoot":"","sources":["writeRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAkBvE,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,0EAA0E;IAC1E,IACE,KAAK,YAAY,mCAAmC;QACpD,UAAU,CAAC,KAAK,EAAE,qCAAqC,CAAC,EACxD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,IACE,KAAK,YAAY,+BAA+B;QAChD,UAAU,CAAC,KAAK,EAAE,iCAAiC,CAAC,EACpD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\n\n/**\n * Why the SDK refused to author a container-scoped write before anything was\n * encrypted or sent:\n *\n * - `repair-required`: the path cites a retired ancestor key epoch. Retry; this\n *   writer's next document sync pass, or a peer, re-keys it parent-first.\n * - `repair-inaccessible`: the same, but the stale container is one this writer\n *   can neither re-key nor be given the key for. Queued changes stay queued and\n *   sync once a member with access to `containerId` repairs it.\n * - `unauthorized`: the signed path grants this signer too little access.\n */\nexport type ContainerWriteRefusal =\n  | { readonly kind: \"repair-required\"; readonly containerId: string }\n  | { readonly kind: \"repair-inaccessible\"; readonly containerId: string }\n  | { readonly kind: \"unauthorized\" };\n\nfunction namedError(error: unknown, name: string): error is Error {\n  return error instanceof Error && error.name === name;\n}\n\n/** A same-named error from elsewhere may lack the field; never say \"undefined\". */\nfunction repairContainerId(error: unknown): string | null {\n  const containerId = Reflect.get(Object(error), \"containerId\");\n  return typeof containerId === \"string\" && containerId.length > 0\n    ? containerId\n    : null;\n}\n\n/** Null for anything else, including keying-verification failures. */\nexport function classifyContainerWriteRefusal(\n  error: unknown,\n): ContainerWriteRefusal | null {\n  // Match by name as well: a host bundling the SDK twice holds two classes.\n  if (\n    error instanceof ContainerKekRepairInaccessibleError ||\n    namedError(error, \"ContainerKekRepairInaccessibleError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-inaccessible\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    namedError(error, \"ContainerKekRepairRequiredError\")\n  ) {\n    const containerId = repairContainerId(error);\n    return containerId ? { kind: \"repair-required\", containerId } : null;\n  }\n  if (\n    error instanceof ContainerAuthorAccessError ||\n    namedError(error, \"ContainerAuthorAccessError\")\n  ) {\n    return { kind: \"unauthorized\" };\n  }\n  return null;\n}\n"]}

package/workflows/documents/create/createAdoption.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, unwrapDocumentContentKeyFromWriterProjection, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, unwrapDocumentContentKeyFromWriterProjection, } from "../../../data/documents/shared/projection/index.js";
 import { persistedDocumentCreateStateFromWriterProjection } from "../../../data/documents/shared/responses.js";
 import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
 import { readAccessEvent, readAccessManifest, } from "../../../data/keyingProjectionVerification/readers.js";

package/workflows/documents/create/createResponse.js

@@ -1,6 +1,6 @@
-import { acknowledgeDocumentMutation } from "../../../data/documents/shared/mutationAcknowledgement.js";
-import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection/index.js";
 import { persistedDocumentCreateStateFromResponse } from "../../../data/documents/shared/responses.js";
+import { acknowledgeDocumentMutation } from "../../../data/documents/shared/sync/mutationAcknowledgement.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { nullOnProjectionVerificationCancellation } from "../../../data/keyingProjectionVerification/types.js";
 import { adoptExistingRemoteDocument } from "./createAdoption.js";

package/workflows/documents/create/createResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"createResponse.js","sourceRoot":"","sources":["createResponse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AASpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,wCAAwC,EAAE,MAAM,kDAAkD,CAAC;AAE5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,wCAAwC,CAC7D,gBAAgB,CAAC,IAAI,EACrB,QAAQ,CACT,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAClE,wCAAwC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,2BAA2B,CAAC;YAC1B,GAAG,KAAK;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,WAAW;YAC1D,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;YAChE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,cAAc;QACd,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n} from \"@tearleads/validators/response\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/mutationAcknowledgement\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { nullOnProjectionVerificationCancellation } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { adoptExistingRemoteDocument } from \"./createAdoption\";\nimport { documentWriterProjectionFromCreateResponse } from \"./createProjection\";\n\n/** A matched acknowledgement remains committed if authorization evidence races. */\nexport async function acknowledgeRemoteDocumentCreate(\n  input: {\n    readonly apiClient: DocumentCreateApi;\n    readonly author: DocumentCreateAuthor;\n    readonly containerProjection: ContainerWriterProjectionResponse;\n    readonly execSql: ExecSql;\n    readonly materializedPlan: MaterializedDocumentCreatePlan;\n    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n    readonly response: DocumentCreateResponse;\n    readonly targetSecretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<CreateRemoteDocumentResult | null> {\n  const { materializedPlan, response } = input;\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    materializedPlan.plan,\n    response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const writerProjection = documentWriterProjectionFromCreateResponse(input);\n  try {\n    const targets = await nullOnProjectionVerificationCancellation(() =>\n      assertDocumentWriterProjectionConsistent(writerProjection, input),\n    );\n    if (!targets || input.stillCurrent?.() === false) return null;\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n    // A principal pin can advance while POST is in flight. Recover the already\n    // committed document from fresh evidence, without submitting another create.\n    // The adoption path still verifies its author, scope, chain and key binding.\n    return nullOnProjectionVerificationCancellation(() =>\n      adoptExistingRemoteDocument({\n        ...input,\n        documentId: response.id,\n        expectedContainerId: input.containerProjection.containerId,\n        expectedOrganizationId: input.containerProjection.organizationId,\n        expectedSignerUserId: input.author.signerUserId,\n      }),\n    );\n  }\n  input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);\n  return {\n    contentKey: materializedPlan.contentKey,\n    documentId: response.id,\n    persistedState,\n    plan: materializedPlan.plan,\n    response,\n    writerProjection,\n  };\n}\n"]}
+{"version":3,"file":"createResponse.js","sourceRoot":"","sources":["createResponse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAS1G,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,wCAAwC,EAAE,MAAM,kDAAkD,CAAC;AAE5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,wCAAwC,CAC7D,gBAAgB,CAAC,IAAI,EACrB,QAAQ,CACT,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAClE,wCAAwC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,2BAA2B,CAAC;YAC1B,GAAG,KAAK;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,WAAW;YAC1D,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;YAChE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,cAAc;QACd,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/sync/mutationAcknowledgement\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { nullOnProjectionVerificationCancellation } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { adoptExistingRemoteDocument } from \"./createAdoption\";\nimport { documentWriterProjectionFromCreateResponse } from \"./createProjection\";\n\n/** A matched acknowledgement remains committed if authorization evidence races. */\nexport async function acknowledgeRemoteDocumentCreate(\n  input: {\n    readonly apiClient: DocumentCreateApi;\n    readonly author: DocumentCreateAuthor;\n    readonly containerProjection: ContainerWriterProjectionResponse;\n    readonly execSql: ExecSql;\n    readonly materializedPlan: MaterializedDocumentCreatePlan;\n    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n    readonly response: DocumentCreateResponse;\n    readonly targetSecretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<CreateRemoteDocumentResult | null> {\n  const { materializedPlan, response } = input;\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    materializedPlan.plan,\n    response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const writerProjection = documentWriterProjectionFromCreateResponse(input);\n  try {\n    const targets = await nullOnProjectionVerificationCancellation(() =>\n      assertDocumentWriterProjectionConsistent(writerProjection, input),\n    );\n    if (!targets || input.stillCurrent?.() === false) return null;\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n    // A principal pin can advance while POST is in flight. Recover the already\n    // committed document from fresh evidence, without submitting another create.\n    // The adoption path still verifies its author, scope, chain and key binding.\n    return nullOnProjectionVerificationCancellation(() =>\n      adoptExistingRemoteDocument({\n        ...input,\n        documentId: response.id,\n        expectedContainerId: input.containerProjection.containerId,\n        expectedOrganizationId: input.containerProjection.organizationId,\n        expectedSignerUserId: input.author.signerUserId,\n      }),\n    );\n  }\n  input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);\n  return {\n    contentKey: materializedPlan.contentKey,\n    documentId: response.id,\n    persistedState,\n    plan: materializedPlan.plan,\n    response,\n    writerProjection,\n  };\n}\n"]}

package/workflows/documents/create/index.js

@@ -1,7 +1,7 @@
 import { DOCUMENT_SYNC_ERROR_CODES, } from "../../../internal/validators/response/index.js";
 import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
 import { buildDocumentCreatePlan } from "../../../data/documents/shared/events.js";
-import { wrapDocumentContentKeyForCreate } from "../../../data/documents/shared/projection.js";
+import { wrapDocumentContentKeyForCreate } from "../../../data/documents/shared/projection/index.js";
 import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
 import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { isContainerCreatePending } from "../../../data/persistence/container-contents/pendingContainerCreate.js";

package/workflows/documents/documentMutationCommit.d.ts

@@ -1,6 +1,6 @@
 import { type DocumentProjectorRegistry, type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
 import type { DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
-import type { PendingUpdateFields } from "../../data/sqlite/documentPersistence.js";
+import type { PendingUpdateFields } from "../../data/sqlite/documentPersistence/index.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import { type PrepareDocumentMutationInput } from "./documentMutationPreparation.js";
 export interface PersistedDocumentState {

package/workflows/documents/documentMutationPreparation.d.ts

@@ -1,4 +1,4 @@
-import { type DocumentSyncPullContinuation } from "../../data/documents/shared/syncPagination.js";
+import { type DocumentSyncPullContinuation } from "../../data/documents/shared/sync/syncPagination.js";
 import type { DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import { mergePersistedDocumentHistory } from "./historyContent.js";

package/workflows/documents/documentMutationPreparation.js

@@ -1,5 +1,5 @@
 import { mergeVersionVectors, satisfiesVersionVector } from "../../internal/loro/index.js";
-import { documentSyncPullContinuationsEqual, } from "../../data/documents/shared/syncPagination.js";
+import { documentSyncPullContinuationsEqual, } from "../../data/documents/shared/sync/syncPagination.js";
 import { canWriteEffectiveAccessLevel } from "../../data/keying/accessLevel.js";
 import { mergePersistedDocumentHistory } from "./historyContent.js";
 function sameNullableDocumentValue(left, right) {

package/workflows/documents/documentMutationPreparation.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentMutationPreparation.js","sourceRoot":"","sources":["documentMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,kCAAkC,GACnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAM7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAyBjE,SAAS,yBAAyB,CAChC,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAoC,EACpC,QAA8B;IAE9B,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QAC1B,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,yBAAyB,CACvB,OAAO,CAAC,eAAe,EACvB,QAAQ,CAAC,eAAe,CACzB;QACD,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;YACpC,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,gBAAgB,EACxB,QAAQ,CAAC,gBAAgB,CAC1B;QACD,yBAAyB,CACvB,OAAO,CAAC,kBAAkB,EAC1B,QAAQ,CAAC,kBAAkB,CAC5B;QACD,yBAAyB,CACvB,OAAO,CAAC,sBAAsB,EAC9B,QAAQ,CAAC,sBAAsB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,MAA4B;IAE5B,OAAO,CACL,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;QACvE,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QACxD,CAAC,yBAAyB,CACxB,OAAO,CAAC,kBAAkB,EAC1B,MAAM,CAAC,kBAAkB,CAC1B;QACD,CAAC,kCAAkC,CACjC,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,gBAAgB,CACxB;QACD,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoC,EACpC,aAAmC;IAEnC,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,aAAa,CAAC,kBAAkB,EAChC,CAAC;QACD,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAmC,EACnC,aAA0C;IAE1C,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,aAAa,KAAK,IAAI;QACtB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC;IACjE,MAAM,8BAA8B,GAClC,CAAC,iBAAiB;QAClB,CAAC,aAAa,CAAC,kBAAkB,KAAK,IAAI;YACxC,aAAa,CAAC,kBAAkB,KAAK,SAAS;YAC9C,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,iBAAiB,CAClB,CAAC,CAAC;IACP,OAAO,CACL,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU;QAC3D,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CACvC;QACD,8BAA8B;QAC9B,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;YAC1C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACtE,CAAC,4BAA4B,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC3C,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAoC,EACpC,QAA+C;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,qBAAqB,GACzB,yBAAyB,CACvB,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,MAAM,CAAC,aAAa,CAC9B;QACD,OAAO,EAAE,kBAAkB,KAAK,QAAQ,CAAC,MAAM,CAAC,kBAAkB;QAClE,yBAAyB,CACvB,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CACnC,CAAC;IACJ,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC;QAC3D,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,CAAC;YAChC,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;QACL,0BAA0B,EACxB,CAAC,sBAAsB;YACvB,CAAC,qBAAqB;YACtB,CAAC,oBAAoB;YACrB,CAAC,kCAAkC,CACjC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,CAAC,gBAAgB,CAC1B;QACH,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC,EACnC,OAAgB,EAChB,KAAoC;IAEpC,MAAM,oBAAoB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAC/D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,kBAAkB,GACtB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,oBAAoB,KAAK,IAAI,CAAC;IAChE,MAAM,qBAAqB,GAAG,oBAAoB,IAAI,KAAK,CAAC,aAAa,CAAC;IAC1E,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,+BAA+B,CAC3D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,GAC1D,kBAAkB,IAAI,mBAAmB,IAAI,qBAAqB;QAChE,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE;QACrE,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;YACpE,CAAC,CAAC,0BAA0B,CACxB,qBAAqB,EACrB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACV,MAAM,uBAAuB,GAAG,8BAA8B,CAC5D,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAI,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;QACtD,MAAM,6BAA6B,CAAC;YAClC,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,uBAAuB,IAAI,oBAAoB;YAC/C,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,kBAAkB;QAClB,qBAAqB;QACrB,0BAA0B;QAC1B,aAAa,EACX,sBAAsB,KAAK,SAAS;YAClC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;QAC3E,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n} from \"../../data/documents/shared/syncPagination\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/keying/accessLevel\";\nimport type {\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { mergePersistedDocumentHistory } from \"./historyContent\";\n\nexport interface ExpectedDocumentSyncState {\n  pullContinuation: DocumentSyncPullContinuation | null;\n  record: StoredDocumentRecord;\n}\n\nexport interface PrepareDocumentMutationInput {\n  currentDoc: Parameters<typeof mergePersistedDocumentHistory>[0][\"doc\"];\n  currentRecord: StoredDocumentRecord | null;\n  expectedSyncState?: ExpectedDocumentSyncState | undefined;\n  historyCheckpoint?:\n    | {\n        coveredTailIds: readonly string[];\n        endVersionVector: string;\n        pruneCoveredLocalState: boolean;\n        snapshot: string;\n      }\n    | undefined;\n  historyUpdateOrigin?: \"local\" | \"remote\" | undefined;\n  historyUpdates?: readonly string[] | undefined;\n  localId: string;\n  persistence: DocumentsPersistence;\n}\n\nfunction sameNullableDocumentValue(\n  left: string | null | undefined,\n  right: string | null | undefined,\n): boolean {\n  return (left ?? null) === (right ?? null);\n}\n\nexport function documentSyncSecurityContextMatches(\n  current: StoredDocumentRecord | null,\n  expected: StoredDocumentRecord,\n): boolean {\n  return (\n    current !== null &&\n    current.id === expected.id &&\n    current.documentId === expected.documentId &&\n    current.containerId === expected.containerId &&\n    current.accessEpoch === expected.accessEpoch &&\n    sameNullableDocumentValue(\n      current.accessStateHash,\n      expected.accessStateHash,\n    ) &&\n    (current.effectiveAccessLevel ?? null) ===\n      (expected.effectiveAccessLevel ?? null) &&\n    sameNullableDocumentValue(\n      current.contentKeyBundle,\n      expected.contentKeyBundle,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentKekTargets,\n      expected.documentKekTargets,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentManifestBundle,\n      expected.documentManifestBundle,\n    )\n  );\n}\n\nfunction patchSpecifiesContainer(\n  patch: Partial<StoredDocumentRecord>,\n): boolean {\n  return Object.hasOwn(patch, \"containerId\");\n}\n\nfunction documentSyncStateDiffers(\n  current: StoredDocumentRecord,\n  cached: StoredDocumentRecord,\n): boolean {\n  return (\n    !sameNullableDocumentValue(current.lastCommitLsn, cached.lastCommitLsn) ||\n    current.snapshotEndVersion !== cached.snapshotEndVersion ||\n    !sameNullableDocumentValue(\n      current.pendingBaseVersion,\n      cached.pendingBaseVersion,\n    ) ||\n    !documentSyncPullContinuationsEqual(\n      current.pullContinuation,\n      cached.pullContinuation,\n    ) ||\n    Boolean(current.pullContinuationRecoveryRequired) !==\n      Boolean(cached.pullContinuationRecoveryRequired)\n  );\n}\n\nfunction mergeMutationFrontiers(\n  patch: Partial<StoredDocumentRecord>,\n  durableRecord: StoredDocumentRecord,\n): Partial<StoredDocumentRecord> {\n  const nextPatch = { ...patch };\n  if (patch.snapshotEndVersion !== undefined) {\n    nextPatch.snapshotEndVersion = mergeVersionVectors([\n      durableRecord.snapshotEndVersion,\n      patch.snapshotEndVersion,\n    ]);\n  }\n  if (\n    patch.pendingBaseVersion !== undefined &&\n    patch.pendingBaseVersion !== null &&\n    durableRecord.pendingBaseVersion\n  ) {\n    nextPatch.pendingBaseVersion = mergeVersionVectors([\n      durableRecord.pendingBaseVersion,\n      patch.pendingBaseVersion,\n    ]);\n  }\n  return nextPatch;\n}\n\nfunction ordinarySaveNeedsHistoryRebase(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  if (\n    input.expectedSyncState !== undefined ||\n    durableRecord === null ||\n    input.currentRecord === null\n  ) {\n    return false;\n  }\n  const cachedPendingBase = input.currentRecord.pendingBaseVersion;\n  const durableCoversCachedPendingBase =\n    !cachedPendingBase ||\n    (durableRecord.pendingBaseVersion !== null &&\n      durableRecord.pendingBaseVersion !== undefined &&\n      satisfiesVersionVector(\n        durableRecord.pendingBaseVersion,\n        cachedPendingBase,\n      ));\n  return (\n    durableRecord.id === input.currentRecord.id &&\n    durableRecord.documentId === input.currentRecord.documentId &&\n    satisfiesVersionVector(\n      durableRecord.snapshotEndVersion,\n      input.currentRecord.snapshotEndVersion,\n    ) &&\n    durableCoversCachedPendingBase &&\n    documentSyncStateDiffers(durableRecord, input.currentRecord)\n  );\n}\n\nfunction ordinarySaveIdentityWasReplaced(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (durableRecord.id !== input.currentRecord.id ||\n      durableRecord.documentId !== input.currentRecord.documentId)\n  );\n}\n\nfunction ordinarySaveWriteAccessWasRevoked(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    canWriteEffectiveAccessLevel(input.currentRecord.effectiveAccessLevel) &&\n    !canWriteEffectiveAccessLevel(durableRecord.effectiveAccessLevel)\n  );\n}\n\nfunction recoveryGenerationWasSuperseded(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (input.currentRecord.recoveryGeneration ?? 0) !==\n      (durableRecord.recoveryGeneration ?? 0)\n  );\n}\n\nfunction resolveSyncSettlementState(\n  current: StoredDocumentRecord | null,\n  expected: ExpectedDocumentSyncState | undefined,\n): { pullContinuationSuperseded: boolean; securityContextMatches: boolean } {\n  if (!expected) {\n    return { pullContinuationSuperseded: false, securityContextMatches: true };\n  }\n  const securityContextMatches = documentSyncSecurityContextMatches(\n    current,\n    expected.record,\n  );\n  const contentFrontiersMatch =\n    sameNullableDocumentValue(\n      current?.lastCommitLsn,\n      expected.record.lastCommitLsn,\n    ) &&\n    current?.snapshotEndVersion === expected.record.snapshotEndVersion &&\n    sameNullableDocumentValue(\n      current?.pendingBaseVersion,\n      expected.record.pendingBaseVersion,\n    );\n  const recoveryStateMatches =\n    Boolean(current?.pullContinuationRecoveryRequired) ===\n      Boolean(expected.record.pullContinuationRecoveryRequired) &&\n    (current?.recoveryGeneration ?? 0) ===\n      (expected.record.recoveryGeneration ?? 0);\n  return {\n    pullContinuationSuperseded:\n      !securityContextMatches ||\n      !contentFrontiersMatch ||\n      !recoveryStateMatches ||\n      !documentSyncPullContinuationsEqual(\n        current?.pullContinuation,\n        expected.pullContinuation,\n      ),\n    securityContextMatches,\n  };\n}\n\nexport async function prepareDocumentMutation(\n  input: PrepareDocumentMutationInput,\n  execSql: ExecSql,\n  patch: Partial<StoredDocumentRecord>,\n) {\n  const durableCurrentRecord = await input.persistence.loadDocument(\n    execSql,\n    input.localId,\n  );\n  const creationSuperseded =\n    input.currentRecord === null && durableCurrentRecord !== null;\n  const mutationCurrentRecord = durableCurrentRecord ?? input.currentRecord;\n  const identityWasReplaced = ordinarySaveIdentityWasReplaced(\n    input,\n    durableCurrentRecord,\n  );\n  const writeAccessWasRevoked = ordinarySaveWriteAccessWasRevoked(\n    input,\n    durableCurrentRecord,\n  );\n  const recoveryWasSuperseded = recoveryGenerationWasSuperseded(\n    input,\n    durableCurrentRecord,\n  );\n  const { pullContinuationSuperseded, securityContextMatches } =\n    creationSuperseded || identityWasReplaced || writeAccessWasRevoked\n      ? { pullContinuationSuperseded: true, securityContextMatches: false }\n      : recoveryWasSuperseded\n        ? { pullContinuationSuperseded: true, securityContextMatches: true }\n        : resolveSyncSettlementState(\n            mutationCurrentRecord,\n            input.expectedSyncState,\n          );\n  const ordinarySaveNeedsRebase = ordinarySaveNeedsHistoryRebase(\n    input,\n    durableCurrentRecord,\n  );\n\n  if (ordinarySaveNeedsRebase && securityContextMatches) {\n    await mergePersistedDocumentHistory({\n      doc: input.currentDoc,\n      execSql,\n      localId: input.localId,\n      persistence: input.persistence,\n    });\n  }\n  const mutationPatch = pullContinuationSuperseded\n    ? {}\n    : ordinarySaveNeedsRebase && durableCurrentRecord\n      ? mergeMutationFrontiers(patch, durableCurrentRecord)\n      : patch;\n  const authoritativeContainer = patchSpecifiesContainer(mutationPatch)\n    ? undefined\n    : await input.persistence.loadDocumentContainer(execSql, input.localId);\n  return {\n    creationSuperseded,\n    mutationCurrentRecord,\n    pullContinuationSuperseded,\n    resolvedPatch:\n      authoritativeContainer === undefined\n        ? mutationPatch\n        : { ...mutationPatch, containerId: authoritativeContainer.containerId },\n    securityContextMatches,\n  };\n}\n"]}
+{"version":3,"file":"documentMutationPreparation.js","sourceRoot":"","sources":["documentMutationPreparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,kCAAkC,GACnC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAM7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAyBjE,SAAS,yBAAyB,CAChC,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAoC,EACpC,QAA8B;IAE9B,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QAC1B,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,yBAAyB,CACvB,OAAO,CAAC,eAAe,EACvB,QAAQ,CAAC,eAAe,CACzB;QACD,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;YACpC,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,gBAAgB,EACxB,QAAQ,CAAC,gBAAgB,CAC1B;QACD,yBAAyB,CACvB,OAAO,CAAC,kBAAkB,EAC1B,QAAQ,CAAC,kBAAkB,CAC5B;QACD,yBAAyB,CACvB,OAAO,CAAC,sBAAsB,EAC9B,QAAQ,CAAC,sBAAsB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,MAA4B;IAE5B,OAAO,CACL,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;QACvE,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QACxD,CAAC,yBAAyB,CACxB,OAAO,CAAC,kBAAkB,EAC1B,MAAM,CAAC,kBAAkB,CAC1B;QACD,CAAC,kCAAkC,CACjC,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,gBAAgB,CACxB;QACD,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoC,EACpC,aAAmC;IAEnC,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,aAAa,CAAC,kBAAkB,EAChC,CAAC;QACD,SAAS,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;YACjD,aAAa,CAAC,kBAAkB;YAChC,KAAK,CAAC,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAmC,EACnC,aAA0C;IAE1C,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,aAAa,KAAK,IAAI;QACtB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC;IACjE,MAAM,8BAA8B,GAClC,CAAC,iBAAiB;QAClB,CAAC,aAAa,CAAC,kBAAkB,KAAK,IAAI;YACxC,aAAa,CAAC,kBAAkB,KAAK,SAAS;YAC9C,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,iBAAiB,CAClB,CAAC,CAAC;IACP,OAAO,CACL,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU;QAC3D,sBAAsB,CACpB,aAAa,CAAC,kBAAkB,EAChC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CACvC;QACD,8BAA8B;QAC9B,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,aAAa,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE;YAC1C,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACtE,CAAC,4BAA4B,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAmC,EACnC,aAA0C;IAE1C,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,aAAa,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC3C,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAoC,EACpC,QAA+C;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,sBAAsB,GAAG,kCAAkC,CAC/D,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,qBAAqB,GACzB,yBAAyB,CACvB,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,MAAM,CAAC,aAAa,CAC9B;QACD,OAAO,EAAE,kBAAkB,KAAK,QAAQ,CAAC,MAAM,CAAC,kBAAkB;QAClE,yBAAyB,CACvB,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CACnC,CAAC;IACJ,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC;QAC3D,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,CAAC;YAChC,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;QACL,0BAA0B,EACxB,CAAC,sBAAsB;YACvB,CAAC,qBAAqB;YACtB,CAAC,oBAAoB;YACrB,CAAC,kCAAkC,CACjC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,CAAC,gBAAgB,CAC1B;QACH,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC,EACnC,OAAgB,EAChB,KAAoC;IAEpC,MAAM,oBAAoB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAC/D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,kBAAkB,GACtB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,oBAAoB,KAAK,IAAI,CAAC;IAChE,MAAM,qBAAqB,GAAG,oBAAoB,IAAI,KAAK,CAAC,aAAa,CAAC;IAC1E,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,qBAAqB,GAAG,+BAA+B,CAC3D,KAAK,EACL,oBAAoB,CACrB,CAAC;IACF,MAAM,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,GAC1D,kBAAkB,IAAI,mBAAmB,IAAI,qBAAqB;QAChE,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE;QACrE,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;YACpE,CAAC,CAAC,0BAA0B,CACxB,qBAAqB,EACrB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACV,MAAM,uBAAuB,GAAG,8BAA8B,CAC5D,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAI,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;QACtD,MAAM,6BAA6B,CAAC;YAClC,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,uBAAuB,IAAI,oBAAoB;YAC/C,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO;QACL,kBAAkB;QAClB,qBAAqB;QACrB,0BAA0B;QAC1B,aAAa,EACX,sBAAsB,KAAK,SAAS;YAClC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;QAC3E,sBAAsB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n} from \"../../data/documents/shared/sync/syncPagination\";\nimport { canWriteEffectiveAccessLevel } from \"../../data/keying/accessLevel\";\nimport type {\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { mergePersistedDocumentHistory } from \"./historyContent\";\n\nexport interface ExpectedDocumentSyncState {\n  pullContinuation: DocumentSyncPullContinuation | null;\n  record: StoredDocumentRecord;\n}\n\nexport interface PrepareDocumentMutationInput {\n  currentDoc: Parameters<typeof mergePersistedDocumentHistory>[0][\"doc\"];\n  currentRecord: StoredDocumentRecord | null;\n  expectedSyncState?: ExpectedDocumentSyncState | undefined;\n  historyCheckpoint?:\n    | {\n        coveredTailIds: readonly string[];\n        endVersionVector: string;\n        pruneCoveredLocalState: boolean;\n        snapshot: string;\n      }\n    | undefined;\n  historyUpdateOrigin?: \"local\" | \"remote\" | undefined;\n  historyUpdates?: readonly string[] | undefined;\n  localId: string;\n  persistence: DocumentsPersistence;\n}\n\nfunction sameNullableDocumentValue(\n  left: string | null | undefined,\n  right: string | null | undefined,\n): boolean {\n  return (left ?? null) === (right ?? null);\n}\n\nexport function documentSyncSecurityContextMatches(\n  current: StoredDocumentRecord | null,\n  expected: StoredDocumentRecord,\n): boolean {\n  return (\n    current !== null &&\n    current.id === expected.id &&\n    current.documentId === expected.documentId &&\n    current.containerId === expected.containerId &&\n    current.accessEpoch === expected.accessEpoch &&\n    sameNullableDocumentValue(\n      current.accessStateHash,\n      expected.accessStateHash,\n    ) &&\n    (current.effectiveAccessLevel ?? null) ===\n      (expected.effectiveAccessLevel ?? null) &&\n    sameNullableDocumentValue(\n      current.contentKeyBundle,\n      expected.contentKeyBundle,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentKekTargets,\n      expected.documentKekTargets,\n    ) &&\n    sameNullableDocumentValue(\n      current.documentManifestBundle,\n      expected.documentManifestBundle,\n    )\n  );\n}\n\nfunction patchSpecifiesContainer(\n  patch: Partial<StoredDocumentRecord>,\n): boolean {\n  return Object.hasOwn(patch, \"containerId\");\n}\n\nfunction documentSyncStateDiffers(\n  current: StoredDocumentRecord,\n  cached: StoredDocumentRecord,\n): boolean {\n  return (\n    !sameNullableDocumentValue(current.lastCommitLsn, cached.lastCommitLsn) ||\n    current.snapshotEndVersion !== cached.snapshotEndVersion ||\n    !sameNullableDocumentValue(\n      current.pendingBaseVersion,\n      cached.pendingBaseVersion,\n    ) ||\n    !documentSyncPullContinuationsEqual(\n      current.pullContinuation,\n      cached.pullContinuation,\n    ) ||\n    Boolean(current.pullContinuationRecoveryRequired) !==\n      Boolean(cached.pullContinuationRecoveryRequired)\n  );\n}\n\nfunction mergeMutationFrontiers(\n  patch: Partial<StoredDocumentRecord>,\n  durableRecord: StoredDocumentRecord,\n): Partial<StoredDocumentRecord> {\n  const nextPatch = { ...patch };\n  if (patch.snapshotEndVersion !== undefined) {\n    nextPatch.snapshotEndVersion = mergeVersionVectors([\n      durableRecord.snapshotEndVersion,\n      patch.snapshotEndVersion,\n    ]);\n  }\n  if (\n    patch.pendingBaseVersion !== undefined &&\n    patch.pendingBaseVersion !== null &&\n    durableRecord.pendingBaseVersion\n  ) {\n    nextPatch.pendingBaseVersion = mergeVersionVectors([\n      durableRecord.pendingBaseVersion,\n      patch.pendingBaseVersion,\n    ]);\n  }\n  return nextPatch;\n}\n\nfunction ordinarySaveNeedsHistoryRebase(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  if (\n    input.expectedSyncState !== undefined ||\n    durableRecord === null ||\n    input.currentRecord === null\n  ) {\n    return false;\n  }\n  const cachedPendingBase = input.currentRecord.pendingBaseVersion;\n  const durableCoversCachedPendingBase =\n    !cachedPendingBase ||\n    (durableRecord.pendingBaseVersion !== null &&\n      durableRecord.pendingBaseVersion !== undefined &&\n      satisfiesVersionVector(\n        durableRecord.pendingBaseVersion,\n        cachedPendingBase,\n      ));\n  return (\n    durableRecord.id === input.currentRecord.id &&\n    durableRecord.documentId === input.currentRecord.documentId &&\n    satisfiesVersionVector(\n      durableRecord.snapshotEndVersion,\n      input.currentRecord.snapshotEndVersion,\n    ) &&\n    durableCoversCachedPendingBase &&\n    documentSyncStateDiffers(durableRecord, input.currentRecord)\n  );\n}\n\nfunction ordinarySaveIdentityWasReplaced(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (durableRecord.id !== input.currentRecord.id ||\n      durableRecord.documentId !== input.currentRecord.documentId)\n  );\n}\n\nfunction ordinarySaveWriteAccessWasRevoked(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.expectedSyncState === undefined &&\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    canWriteEffectiveAccessLevel(input.currentRecord.effectiveAccessLevel) &&\n    !canWriteEffectiveAccessLevel(durableRecord.effectiveAccessLevel)\n  );\n}\n\nfunction recoveryGenerationWasSuperseded(\n  input: PrepareDocumentMutationInput,\n  durableRecord: StoredDocumentRecord | null,\n): boolean {\n  return (\n    input.currentRecord !== null &&\n    durableRecord !== null &&\n    (input.currentRecord.recoveryGeneration ?? 0) !==\n      (durableRecord.recoveryGeneration ?? 0)\n  );\n}\n\nfunction resolveSyncSettlementState(\n  current: StoredDocumentRecord | null,\n  expected: ExpectedDocumentSyncState | undefined,\n): { pullContinuationSuperseded: boolean; securityContextMatches: boolean } {\n  if (!expected) {\n    return { pullContinuationSuperseded: false, securityContextMatches: true };\n  }\n  const securityContextMatches = documentSyncSecurityContextMatches(\n    current,\n    expected.record,\n  );\n  const contentFrontiersMatch =\n    sameNullableDocumentValue(\n      current?.lastCommitLsn,\n      expected.record.lastCommitLsn,\n    ) &&\n    current?.snapshotEndVersion === expected.record.snapshotEndVersion &&\n    sameNullableDocumentValue(\n      current?.pendingBaseVersion,\n      expected.record.pendingBaseVersion,\n    );\n  const recoveryStateMatches =\n    Boolean(current?.pullContinuationRecoveryRequired) ===\n      Boolean(expected.record.pullContinuationRecoveryRequired) &&\n    (current?.recoveryGeneration ?? 0) ===\n      (expected.record.recoveryGeneration ?? 0);\n  return {\n    pullContinuationSuperseded:\n      !securityContextMatches ||\n      !contentFrontiersMatch ||\n      !recoveryStateMatches ||\n      !documentSyncPullContinuationsEqual(\n        current?.pullContinuation,\n        expected.pullContinuation,\n      ),\n    securityContextMatches,\n  };\n}\n\nexport async function prepareDocumentMutation(\n  input: PrepareDocumentMutationInput,\n  execSql: ExecSql,\n  patch: Partial<StoredDocumentRecord>,\n) {\n  const durableCurrentRecord = await input.persistence.loadDocument(\n    execSql,\n    input.localId,\n  );\n  const creationSuperseded =\n    input.currentRecord === null && durableCurrentRecord !== null;\n  const mutationCurrentRecord = durableCurrentRecord ?? input.currentRecord;\n  const identityWasReplaced = ordinarySaveIdentityWasReplaced(\n    input,\n    durableCurrentRecord,\n  );\n  const writeAccessWasRevoked = ordinarySaveWriteAccessWasRevoked(\n    input,\n    durableCurrentRecord,\n  );\n  const recoveryWasSuperseded = recoveryGenerationWasSuperseded(\n    input,\n    durableCurrentRecord,\n  );\n  const { pullContinuationSuperseded, securityContextMatches } =\n    creationSuperseded || identityWasReplaced || writeAccessWasRevoked\n      ? { pullContinuationSuperseded: true, securityContextMatches: false }\n      : recoveryWasSuperseded\n        ? { pullContinuationSuperseded: true, securityContextMatches: true }\n        : resolveSyncSettlementState(\n            mutationCurrentRecord,\n            input.expectedSyncState,\n          );\n  const ordinarySaveNeedsRebase = ordinarySaveNeedsHistoryRebase(\n    input,\n    durableCurrentRecord,\n  );\n\n  if (ordinarySaveNeedsRebase && securityContextMatches) {\n    await mergePersistedDocumentHistory({\n      doc: input.currentDoc,\n      execSql,\n      localId: input.localId,\n      persistence: input.persistence,\n    });\n  }\n  const mutationPatch = pullContinuationSuperseded\n    ? {}\n    : ordinarySaveNeedsRebase && durableCurrentRecord\n      ? mergeMutationFrontiers(patch, durableCurrentRecord)\n      : patch;\n  const authoritativeContainer = patchSpecifiesContainer(mutationPatch)\n    ? undefined\n    : await input.persistence.loadDocumentContainer(execSql, input.localId);\n  return {\n    creationSuperseded,\n    mutationCurrentRecord,\n    pullContinuationSuperseded,\n    resolvedPatch:\n      authoritativeContainer === undefined\n        ? mutationPatch\n        : { ...mutationPatch, containerId: authoritativeContainer.containerId },\n    securityContextMatches,\n  };\n}\n"]}

package/workflows/documents/index.d.ts

@@ -1,10 +1,10 @@
-export { type DocumentSyncUpdateIsolationError, type IncomingDocumentSyncUpdateValidator, isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection.js";
+export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection/index.js";
 export { persistedDocumentCreateStateFromResponse } from "../../data/documents/shared/responses.js";
-export { type DocumentSyncPullContinuation, documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/syncPagination.js";
+export { type DocumentSyncUpdateIsolationError, type IncomingDocumentSyncUpdateValidator, isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/sync/documentSyncUpdateIsolation.js";
+export { type DocumentSyncPullContinuation, documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/sync/syncPagination.js";
 export type { DocumentCreateAuthor, DocumentLinkSetFailureHandler, DocumentLinkSetMutationFailure, RelinkRemoteDocumentResult, } from "../../data/documents/shared/types.js";
-export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentHistoryPersistence.js";
-export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence.js";
+export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence/index.js";
+export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentPersistence/documentHistoryPersistence.js";
 export type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 export { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
 export { settleOutgoingPassAndDecideReArm } from "../../data/sync/outgoingUpdateSettlement.js";

package/workflows/documents/index.js

@@ -1,9 +1,9 @@
-export { isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection.js";
+export { unwrapContainerKekPath, unwrapDocumentContentKeyTarget, } from "../../data/documents/shared/projection/index.js";
 export { persistedDocumentCreateStateFromResponse } from "../../data/documents/shared/responses.js";
-export { documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/syncPagination.js";
-export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentHistoryPersistence.js";
-export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence.js";
+export { isDocumentSyncUpdateIsolationError, validateDocumentSyncUpdateImports, } from "../../data/documents/shared/sync/documentSyncUpdateIsolation.js";
+export { documentSyncPullContinuationsEqual, readPullContinuation, } from "../../data/documents/shared/sync/syncPagination.js";
+export { clearDocumentSyncFailure, invalidateDocumentSyncPullContinuation, recordDocumentSyncFailure, } from "../../data/sqlite/documentPersistence/index.js";
+export { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../data/sqlite/documentPersistence/documentHistoryPersistence.js";
 export { selectDocumentSyncOutgoingBatch } from "../../data/sync/documentSyncOutgoingBatch.js";
 export { settleOutgoingPassAndDecideReArm } from "../../data/sync/outgoingUpdateSettlement.js";
 export { didRegainSyncPrerequisites, isDatabaseUnavailableError, } from "../../data/sync/syncCoordinator.js";

package/workflows/documents/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,EAEL,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,0CAA0C,GAC3C,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,kBAAkB,EAGlB,2BAA2B,EAE3B,+BAA+B,EAK/B,oBAAoB,EAEpB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uCAAuC,EAGvC,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,GAM/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAEL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAEhF,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export {\n  type DocumentSyncUpdateIsolationError,\n  type IncomingDocumentSyncUpdateValidator,\n  isDocumentSyncUpdateIsolationError,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nexport {\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n} from \"../../data/documents/shared/projection\";\nexport { persistedDocumentCreateStateFromResponse } from \"../../data/documents/shared/responses\";\nexport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n  readPullContinuation,\n} from \"../../data/documents/shared/syncPagination\";\nexport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nexport {\n  DOCUMENT_HISTORY_COMPACTION_MAX_BYTES,\n  DOCUMENT_HISTORY_COMPACTION_MAX_ROWS,\n} from \"../../data/sqlite/documentHistoryPersistence\";\nexport {\n  clearDocumentSyncFailure,\n  invalidateDocumentSyncPullContinuation,\n  recordDocumentSyncFailure,\n} from \"../../data/sqlite/documentPersistence\";\nexport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nexport { selectDocumentSyncOutgoingBatch } from \"../../data/sync/documentSyncOutgoingBatch\";\nexport { settleOutgoingPassAndDecideReArm } from \"../../data/sync/outgoingUpdateSettlement\";\nexport {\n  didRegainSyncPrerequisites,\n  isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  deleteLocalDocumentAttachment,\n  deletePendingDocumentAttachment,\n  markLocalDocumentAttachmentDetached,\n  saveLocalDocumentAttachments,\n  savePendingDocumentAttachment,\n} from \"./attachments/attachmentPersistence\";\nexport { runSerializedDocumentBlobMutation } from \"./attachments/blobMutationLock\";\nexport { reclaimDocumentOrphanBlobs } from \"./attachments/orphanBlobReclaims\";\nexport { resolveDocumentCreateAuthor } from \"./author\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createRemoteDocument,\n  documentWriterProjectionFromCreateResponse,\n} from \"./create\";\nexport {\n  importDocumentHistoryTailUpdates,\n  loadPersistedDocumentContent,\n  mergePersistedDocumentHistory,\n} from \"./historyContent\";\nexport { buildMaterializedDocumentLinkSetMutationPlan } from \"./linkSet\";\nexport { relinkRemoteDocument } from \"./linkSet/linkSetRemote\";\nexport {\n  enqueuePendingDocumentUpdate,\n  listPendingDocumentUpdates,\n} from \"./pendingUpdatePersistence\";\nexport {\n  type AttachmentRemovalRows,\n  type AttachmentStagingRows,\n  DOCUMENTS_APP_KIND,\n  type DocumentRecord,\n  type DocumentsPersistence,\n  defaultDocumentsPersistence,\n  type LocalAttachmentRecord,\n  loadPersistedDocumentStoreState,\n  type PendingAttachmentRecord,\n  type PendingAttachmentUploadIdentity,\n  type PendingUpdateInsert,\n  type PendingUpdateRecord,\n  persistDocumentState,\n  type RelinkPersistedDocumentInput,\n  runSerializedSqlMutation,\n} from \"./persistence\";\nexport {\n  createDocumentProjectionUserKeyResolver,\n  type DocumentProjectionKeyRuntime,\n  type DocumentProjectionUserKeyResolver,\n  didDocumentProjectionKeyRuntimeChange,\n} from \"./projectionKeys\";\nexport {\n  buildDocumentPurgeRequest,\n  purgeRemoteDocument,\n} from \"./purge\";\nexport {\n  type DiscardedDocumentShellResult,\n  deletePersistedDocument,\n  discardPersistedDocumentToShell,\n} from \"./purge/persistedDocumentRemoval\";\nexport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntimeGroups,\n  type DocumentsWorkflowRuntimeInfra,\n  type DocumentsWorkflowRuntimeInput,\n  type DocumentsWorkflowRuntimeInputGroups,\n} from \"./runtime\";\nexport {\n  hasDocumentUpdateEvent,\n  syncRemoteDocument,\n} from \"./sync\";\nexport type { SyncRemoteDocumentInput } from \"./sync/readOnlySync\";\nexport type { DocumentSyncContainerRekeyBuilder } from \"./sync/syncAttemptState\";\nexport {\n  type DocumentSyncLane,\n  registerDocumentSyncLane,\n  requestDocumentSyncLaneAndWait,\n} from \"./sync/syncLane\";\nexport {\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n} from \"./sync/syncTrace\";\nexport {\n  describeDocumentRevalidationFailure,\n  describeDocumentSyncSubmitFailure,\n  type TerminalSubmitFailureHandler,\n} from \"./syncFailures/syncFailureClassification\";\nexport { shouldClearDocumentSyncFailureAfterPass } from \"./syncFailures/syncFailureClearance\";\nexport { DocumentRawHistoryUnavailableError } from \"./syncPlan/syncContentKeys\";\nexport type { RekeyPendingUpdate } from \"./syncRekeys/syncRecoveryRekey\";\nexport { createDocumentWriterPublicKeyResolver } from \"./writerKeys\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,EAGL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAEL,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AAOzD,OAAO,EACL,wBAAwB,EACxB,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,kEAAkE,CAAC;AAE1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,0CAA0C,GAC3C,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,kBAAkB,EAGlB,2BAA2B,EAE3B,+BAA+B,EAK/B,oBAAoB,EAEpB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uCAAuC,EAGvC,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,GAM/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAEL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAEhF,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export {\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n} from \"../../data/documents/shared/projection\";\nexport { persistedDocumentCreateStateFromResponse } from \"../../data/documents/shared/responses\";\nexport {\n  type DocumentSyncUpdateIsolationError,\n  type IncomingDocumentSyncUpdateValidator,\n  isDocumentSyncUpdateIsolationError,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/sync/documentSyncUpdateIsolation\";\nexport {\n  type DocumentSyncPullContinuation,\n  documentSyncPullContinuationsEqual,\n  readPullContinuation,\n} from \"../../data/documents/shared/sync/syncPagination\";\nexport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nexport {\n  clearDocumentSyncFailure,\n  invalidateDocumentSyncPullContinuation,\n  recordDocumentSyncFailure,\n} from \"../../data/sqlite/documentPersistence\";\nexport {\n  DOCUMENT_HISTORY_COMPACTION_MAX_BYTES,\n  DOCUMENT_HISTORY_COMPACTION_MAX_ROWS,\n} from \"../../data/sqlite/documentPersistence/documentHistoryPersistence\";\nexport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nexport { selectDocumentSyncOutgoingBatch } from \"../../data/sync/documentSyncOutgoingBatch\";\nexport { settleOutgoingPassAndDecideReArm } from \"../../data/sync/outgoingUpdateSettlement\";\nexport {\n  didRegainSyncPrerequisites,\n  isDatabaseUnavailableError,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  deleteLocalDocumentAttachment,\n  deletePendingDocumentAttachment,\n  markLocalDocumentAttachmentDetached,\n  saveLocalDocumentAttachments,\n  savePendingDocumentAttachment,\n} from \"./attachments/attachmentPersistence\";\nexport { runSerializedDocumentBlobMutation } from \"./attachments/blobMutationLock\";\nexport { reclaimDocumentOrphanBlobs } from \"./attachments/orphanBlobReclaims\";\nexport { resolveDocumentCreateAuthor } from \"./author\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createRemoteDocument,\n  documentWriterProjectionFromCreateResponse,\n} from \"./create\";\nexport {\n  importDocumentHistoryTailUpdates,\n  loadPersistedDocumentContent,\n  mergePersistedDocumentHistory,\n} from \"./historyContent\";\nexport { buildMaterializedDocumentLinkSetMutationPlan } from \"./linkSet\";\nexport { relinkRemoteDocument } from \"./linkSet/linkSetRemote\";\nexport {\n  enqueuePendingDocumentUpdate,\n  listPendingDocumentUpdates,\n} from \"./pendingUpdatePersistence\";\nexport {\n  type AttachmentRemovalRows,\n  type AttachmentStagingRows,\n  DOCUMENTS_APP_KIND,\n  type DocumentRecord,\n  type DocumentsPersistence,\n  defaultDocumentsPersistence,\n  type LocalAttachmentRecord,\n  loadPersistedDocumentStoreState,\n  type PendingAttachmentRecord,\n  type PendingAttachmentUploadIdentity,\n  type PendingUpdateInsert,\n  type PendingUpdateRecord,\n  persistDocumentState,\n  type RelinkPersistedDocumentInput,\n  runSerializedSqlMutation,\n} from \"./persistence\";\nexport {\n  createDocumentProjectionUserKeyResolver,\n  type DocumentProjectionKeyRuntime,\n  type DocumentProjectionUserKeyResolver,\n  didDocumentProjectionKeyRuntimeChange,\n} from \"./projectionKeys\";\nexport {\n  buildDocumentPurgeRequest,\n  purgeRemoteDocument,\n} from \"./purge\";\nexport {\n  type DiscardedDocumentShellResult,\n  deletePersistedDocument,\n  discardPersistedDocumentToShell,\n} from \"./purge/persistedDocumentRemoval\";\nexport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntimeGroups,\n  type DocumentsWorkflowRuntimeInfra,\n  type DocumentsWorkflowRuntimeInput,\n  type DocumentsWorkflowRuntimeInputGroups,\n} from \"./runtime\";\nexport {\n  hasDocumentUpdateEvent,\n  syncRemoteDocument,\n} from \"./sync\";\nexport type { SyncRemoteDocumentInput } from \"./sync/readOnlySync\";\nexport type { DocumentSyncContainerRekeyBuilder } from \"./sync/syncAttemptState\";\nexport {\n  type DocumentSyncLane,\n  registerDocumentSyncLane,\n  requestDocumentSyncLaneAndWait,\n} from \"./sync/syncLane\";\nexport {\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n} from \"./sync/syncTrace\";\nexport {\n  describeDocumentRevalidationFailure,\n  describeDocumentSyncSubmitFailure,\n  type TerminalSubmitFailureHandler,\n} from \"./syncFailures/syncFailureClassification\";\nexport { shouldClearDocumentSyncFailureAfterPass } from \"./syncFailures/syncFailureClearance\";\nexport { DocumentRawHistoryUnavailableError } from \"./syncPlan/syncContentKeys\";\nexport type { RekeyPendingUpdate } from \"./syncRekeys/syncRecoveryRekey\";\nexport { createDocumentWriterPublicKeyResolver } from \"./writerKeys\";\n"]}

package/workflows/documents/linkSet/index.js

@@ -2,9 +2,9 @@ import { computeAccessManifestHash, computeDocumentContentKeyTargetHash, DOCUMEN
 import { bytesToBase64 } from "../../../internal/encoding/index.js";
 import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
 import { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, } from "../../../internal/validators/util/index.js";
-import { assertContainerKekPathCurrent, assertDocumentKekPathsCurrent, } from "../../../data/documents/shared/containerKekCurrency.js";
+import { assertContainerKekPathCurrent, assertDocumentKekPathsCurrent, } from "../../../data/documents/shared/containerKek/containerKekCurrency.js";
 import { buildDocumentLinkSetEventPlan } from "../../../data/documents/shared/events.js";
-import { assertDocumentWriterProjectionConsistent, collectContainerKeksForDocumentSync, containerPathRefs, currentDocumentTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, unwrapContainerKekPath, unwrapDocumentContentKeyFromWriterProjection, verifiedDocumentWrapTargets, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentWriterProjectionConsistent, collectContainerKeksForDocumentSync, containerPathRefs, currentDocumentTargets, deriveDocumentTargetFromProjection, mergeTargetEnvelopes, readLinkedContainerIdsFromDocumentManifest, unwrapContainerKekPath, unwrapDocumentContentKeyFromWriterProjection, verifiedDocumentWrapTargets, } from "../../../data/documents/shared/projection/index.js";
 import { assertDocumentManifestBundleConsistent, describeDocumentTargetKek, sortDocumentTargets, targetKey, uniqueSortedStrings, } from "../../../data/documents/shared/readers.js";
 import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
 import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";

package/workflows/documents/linkSet/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAG/B,6BAA6B,EAC7B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,sBAAsB,EACtB,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,mBAAmB,EACnB,SAAS,EACT,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAQL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAE5B,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,yBAAyB,GAAG,0CAA0C,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxD,2CAA2C,CACzC,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAClD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CACvC,EACD,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAC5C,CAAC;QAEF,OAAO;YACL,cAAc;YACd,kBAAkB,EAAE,mBAAmB,CAAC;gBACtC,GAAG,yBAAyB;gBAC5B,MAAM,CAAC,WAAW;aACnB,CAAC;YACF,MAAM;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CACpD,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,kBAA0B;IAE1B,IAAI,kBAAkB,IAAI,qCAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,4CAA4C,qCAAqC,aAAa,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,kBAAqC,EACrC,gBAAwB;IAExB,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,EACjC,gBAAgB,CACjB,CAAC;IACF,IAAI,eAAe,GAAG,yCAAyC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,2CAA2C,yCAAyC,2BAA2B,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAM/C;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kDAAkD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;YAChE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,KAAK,UAAU,0CAA0C,CAAC,KAGzD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IACE,gBAAgB,CAAC,cAAc;QAC/B,KAAK,CAAC,yBAAyB,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,gBAAgB,CAAC,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,gCAAgC,CACvC,gBAAkD;IAElD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,EAC9C,MAAM,EACN,WAAW,EACX,eAAe,EACf,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,yBAAyB,EACzB,eAAe,EACf,gBAAgB,GACsB;IACtC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS;QACT,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,oBAAoB,CACpD,WAAW,CAAC,OAAO,EACnB,eAAe,CAChB,CAAC;IACF,MAAM,uBAAuB,GAAG,iBAAiB,CAC/C,yBAAyB,CAAC,IAAI,CAC/B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,MAAM;QACN,WAAW;QACX,OAAO;QACP,SAAS;QACT,cAAc;QACd,QAAQ;QACR,uBAAuB;QACvB,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAiC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,cAAc;QACd,KAAK,EAAE,aAAa,GAAG,CAAC;QACxB,oBAAoB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QACpE,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,kBAAkB,EAAE,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,WAAW,CAAC,OAAO,CACpB,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,OAAO,EAAE;YACP,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC;YACtE,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC;YACnE,oBAAoB,EAAE,YAAY;YAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;YACrE,uBAAuB;YACvB,4BAA4B,EAAE,SAAS,CAAC,4BAA4B;YACpE,gBAAgB,EAAE;gBAChB,eAAe;gBACf,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,OAAO,EAAE,yBAAyB;aACnC;SACF;QACD,KAAK;QACL,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAciC;IAEjC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC7D,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,sBAAsB,CACpB,KAAK,CAAC,yBAAyB,CAAC,IAAI,EACpC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB;QAChC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,MAAM,4CAA4C,CAAC;QAC3E,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QACvD,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE;QAC/D,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC;QAChE,eAAe;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyE,EACzE,IAIC;IAED,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;KAC9C,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO;YAClD,GAAG,CAAC,MAAM,gCAAgC,CAAC;gBACzC,GAAG,OAAO;gBACV,aAAa,EAAE,MAAM,sBAAsB,CAAC;oBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,yBAAyB;oBAC3C,SAAS,EAAE,KAAK,CAAC,eAAe;oBAChC,GAAG,mBAAmB;iBACvB,CAAC;gBACF,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,CAAC;QACtC,GAAG,OAAO;QACV,aAAa,EAAE,CACb,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,mBAAmB;SACvB,CAAC,CACH,CAAC,aAAa;QACf,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,2BAA2B,CAAC;YACnC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;YACvD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACvC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,KAGC,EACD,kBAAqC;IAErC,0FAA0F;IAC1F,6BAA6B,CAC3B,KAAK,CAAC,gBAAgB,EACtB,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,6BAA6B,CAC3B,KAAK,CAAC,yBAAyB,CAAC,aAAa,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkSetManifestState,\n  deriveDocumentLinkSetManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n} from \"@tearleads/validators/util\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"../../../data/documents/shared/containerKekCurrency\";\nimport { buildDocumentLinkSetEventPlan } from \"../../../data/documents/shared/events\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  collectContainerKeksForDocumentSync,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyFromWriterProjection,\n  verifiedDocumentWrapTargets,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  describeDocumentTargetKek,\n  sortDocumentTargets,\n  targetKey,\n  uniqueSortedStrings,\n} from \"../../../data/documents/shared/readers\";\nimport {\n  type BuildDocumentLinkSetMutationPlanInput,\n  type DocumentCreateAuthor,\n  type DocumentLinkSetMutationOperation,\n  type DocumentLinkSetMutationPlan,\n  type DocumentLinkSetTargetState,\n  type MaterializedDocumentLinkSetMutationPlan,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"../purge/subtreePurgeScope\";\nimport {\n  assertDocumentLinkAuthorAccess,\n  verifyDocumentLinkSetCurrentPolicies,\n} from \"./linkSetAuthority\";\n\nfunction deriveDocumentLinkSetTargetState(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentLinkSetTargetState {\n  const currentTargets = currentDocumentTargets(input.writerProjection);\n  const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  const target = deriveDocumentTargetFromProjection(\n    input.targetContainerProjection,\n  );\n  const currentTarget = currentTargets.find(\n    (candidate) => candidate.containerId === target.containerId,\n  );\n\n  if (input.operation === \"link\") {\n    if (currentTarget) {\n      throw new Error(\"Document link target is already linked\");\n    }\n    assertDocumentLinkTargetCapacity(currentTargets.length);\n    assertDocumentLinkAuthorizationPathCapacity(\n      input.writerProjection.authorizingContainerPaths.map(\n        (projection) => projection.path.length,\n      ),\n      input.targetContainerProjection.path.length,\n    );\n\n    return {\n      currentTargets,\n      linkedContainerIds: uniqueSortedStrings([\n        ...currentLinkedContainerIds,\n        target.containerId,\n      ]),\n      target,\n      targets: sortDocumentTargets([...currentTargets, target]),\n    };\n  }\n\n  if (!currentTarget) {\n    throw new Error(\"Document unlink target is not linked\");\n  }\n  if (targetKey(currentTarget) !== targetKey(target)) {\n    throw new Error(\"Document unlink target projection is stale\");\n  }\n\n  const linkedContainerIds = currentLinkedContainerIds.filter(\n    (containerId) => containerId !== target.containerId,\n  );\n  if (linkedContainerIds.length === 0) {\n    throw new Error(\"Document unlink must leave a linked container\");\n  }\n\n  return {\n    currentTargets,\n    linkedContainerIds,\n    target,\n    targets: currentTargets.filter(\n      (candidate) => candidate.containerId !== target.containerId,\n    ),\n  };\n}\n\nexport function assertDocumentLinkTargetCapacity(\n  currentTargetCount: number,\n): void {\n  if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {\n    throw new RangeError(\n      `A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`,\n    );\n  }\n}\n\nexport function assertDocumentLinkAuthorizationPathCapacity(\n  currentPathLengths: readonly number[],\n  targetPathLength: number,\n): void {\n  const totalReferences = currentPathLengths.reduce(\n    (total, length) => total + length,\n    targetPathLength,\n  );\n  if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {\n    throw new RangeError(\n      `Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`,\n    );\n  }\n}\n\nasync function wrapDocumentContentKeyForTargets(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  targets: readonly DocumentContentKeyTarget[];\n}): Promise<DocumentContentKeyTargetEnvelope[]> {\n  return Promise.all(\n    sortDocumentTargets(input.targets).map(async (target) => {\n      const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);\n      if (!targetKek) {\n        throw new Error(\n          `Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n\n      const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n        kind: \"Document\",\n        objectId: input.documentId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: target.containerId,\n        containerKeyEpochId: target.containerKeyEpochId,\n      });\n      return {\n        ...target,\n        wrappedKey: bytesToBase64(wrapped.ciphertext),\n        wrappingMetadata: {\n          suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n          iv: bytesToBase64(wrapped.iv),\n        },\n      };\n    }),\n  );\n}\n\n// Resolve the organization a link/unlink mutation belongs to: the document's\n// own org (from its manifest), which must equal the target container's org —\n// both are owned by the same organization. The acting member's personal org is\n// intentionally not part of this check; a member may link documents within any\n// org they belong to. Returns the document org so the plan stamps it onto the\n// signed event and manifest rather than the author's org.\nasync function resolveDocumentLinkSetMutationOrganization(input: {\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<string> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document link-set manifest\",\n  });\n  if (\n    manifestIdentity.organizationId !==\n    input.targetContainerProjection.organizationId\n  ) {\n    throw new Error(\"Document target container organization mismatch\");\n  }\n\n  return manifestIdentity.organizationId;\n}\n\nfunction readDocumentLinkSetPreviousEpoch(\n  writerProjection: DocumentWriterProjectionResponse,\n): number {\n  const previousState = writerProjection.documentManifest.state;\n  const previousEpoch = isPlainRecord(previousState)\n    ? Reflect.get(previousState, \"epoch\")\n    : undefined;\n  if (\n    typeof previousEpoch !== \"number\" ||\n    !Number.isInteger(previousEpoch) ||\n    previousEpoch <= 0\n  ) {\n    throw new Error(\"Document link-set previous epoch is invalid\");\n  }\n\n  return previousEpoch;\n}\n\nasync function buildDocumentLinkSetMutationPlan({\n  author,\n  blobRewraps,\n  contentKeyEpoch,\n  eventId = crypto.randomUUID(),\n  operation,\n  signedAt = new Date().toISOString(),\n  targetContainerProjection,\n  targetEnvelopes,\n  writerProjection,\n}: BuildDocumentLinkSetMutationPlanInput): Promise<DocumentLinkSetMutationPlan> {\n  const organizationId = await resolveDocumentLinkSetMutationOrganization({\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation,\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetEnvelopesForRequest = mergeTargetEnvelopes(\n    targetState.targets,\n    targetEnvelopes,\n  );\n  const targetContainerPathRefs = containerPathRefs(\n    targetContainerProjection.path,\n  );\n  const eventPlan = await buildDocumentLinkSetEventPlan({\n    author,\n    blobRewraps,\n    eventId,\n    operation,\n    organizationId,\n    signedAt,\n    targetContainerPathRefs,\n    targetState,\n    writerProjection,\n  });\n  const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);\n\n  const state: DocumentLinkSetManifestState = {\n    version: 1,\n    documentId: writerProjection.documentId,\n    organizationId,\n    epoch: previousEpoch + 1,\n    previousManifestHash: writerProjection.documentManifest.manifestHash,\n    eventHash: eventPlan.eventHash,\n    linkedContainerIds: [...targetState.linkedContainerIds],\n  };\n  const manifest = await deriveDocumentLinkSetManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const targetHash = await computeDocumentContentKeyTargetHash(\n    targetState.targets,\n  );\n\n  return {\n    body: eventPlan.body,\n    contentKeyEpoch,\n    documentId: writerProjection.documentId,\n    event: eventPlan.event,\n    eventHash: eventPlan.eventHash,\n    manifest,\n    manifestHash,\n    operation,\n    request: {\n      event: readCanonicalRecord(eventPlan.event, \"Document link-set event\"),\n      body: readCanonicalRecord(eventPlan.body, \"Document link-set body\"),\n      expectedManifestHash: manifestHash,\n      manifest: readCanonicalRecord(manifest, \"Document link-set manifest\"),\n      targetContainerPathRefs,\n      authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,\n      contentKeyBundle: {\n        contentKeyEpoch,\n        linkSetManifestHash: manifestHash,\n        targetHash,\n        targets: targetEnvelopesForRequest,\n      },\n    },\n    state,\n    targetHash,\n    targets: sortDocumentTargets(targetState.targets),\n  };\n}\n\nexport async function buildMaterializedDocumentLinkSetMutationPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n    prepareBlobRewraps: (\n      targets: readonly DocumentContentKeyTarget[],\n    ) => Promise<BuildDocumentLinkSetMutationPlanInput[\"blobRewraps\"]>;\n    contentKey?: Uint8Array | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    operation: DocumentLinkSetMutationOperation;\n    signedAt?: string | undefined;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentLinkSetMutationPlan> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const principalPolicyCache: PrincipalPolicyCache = new Map();\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    execSql: input.execSql,\n    principalPolicyCache,\n    ...verificationOptions,\n  });\n  await verifyDocumentLinkSetCurrentPolicies({\n    execSql: input.execSql,\n    principalPolicyCache,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  assertSubtreePurgePath(\n    input.targetContainerProjection.path,\n    input.expectedSubtreeRoot,\n  );\n  if (input.resolveProjectionUserKey)\n    assertDocumentLinkAuthorAccess({\n      ...input,\n      principalPolicies: [...principalPolicyCache.values()],\n    });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation: input.operation,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n  });\n  assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);\n  const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  const contentKeyRotated = input.operation === \"unlink\";\n  const contentKey = contentKeyRotated\n    ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))\n    : currentContentKey;\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n  // A link carries the existing envelopes forward at the same epoch; an\n  // unlink rotates to a fresh key at the next one.\n  const contentKeyEpoch =\n    input.writerProjection.contentKeyBundle.contentKeyEpoch +\n    (contentKeyRotated ? 1 : 0);\n  const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {\n    contentKey,\n    contentKeyEpoch,\n    targetState,\n  });\n\n  const plan = await buildDocumentLinkSetMutationPlan({\n    author: input.author,\n    blobRewraps: await input.prepareBlobRewraps(targetState.targets),\n    contentKeyEpoch,\n    eventId: input.eventId,\n    operation: input.operation,\n    signedAt: input.signedAt,\n    targetContainerProjection: input.targetContainerProjection,\n    targetEnvelopes,\n    writerProjection: input.writerProjection,\n  });\n\n  return {\n    contentKey,\n    contentKeyRotated,\n    plan,\n  };\n}\n\nasync function buildLinkSetTargetEnvelopes(\n  input: Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n  wrap: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    targetState: ReturnType<typeof deriveDocumentLinkSetTargetState>;\n  },\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const sealing = {\n    contentKey: wrap.contentKey,\n    contentKeyEpoch: wrap.contentKeyEpoch,\n    documentId: input.writerProjection.documentId,\n  };\n  if (input.operation === \"link\") {\n    return [\n      ...input.writerProjection.contentKeyBundle.targets,\n      ...(await wrapDocumentContentKeyForTargets({\n        ...sealing,\n        keksByEpochId: await unwrapContainerKekPath({\n          execSql: input.execSql,\n          projection: input.targetContainerProjection,\n          secretKey: input.targetSecretKey,\n          ...verificationOptions,\n        }),\n        targets: [wrap.targetState.target],\n      })),\n    ];\n  }\n  return wrapDocumentContentKeyForTargets({\n    ...sealing,\n    keksByEpochId: (\n      await collectContainerKeksForDocumentSync({\n        execSql: input.execSql,\n        secretKey: input.targetSecretKey,\n        writerProjection: input.writerProjection,\n        ...verificationOptions,\n      })\n    ).keksByEpochId,\n    // The rotated key is wrapped only to verified current heads of the\n    // remaining linked containers, never to a server-listed epoch.\n    targets: verifiedDocumentWrapTargets({\n      linkedContainerIds: wrap.targetState.linkedContainerIds,\n      serverTargets: wrap.targetState.targets,\n      writerProjection: input.writerProjection,\n    }),\n  });\n}\n\nfunction assertLinkSetWriteKeksCurrent(\n  input: Pick<\n    Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n    \"writerProjection\" | \"targetContainerProjection\" | \"operation\"\n  >,\n  linkedContainerIds: readonly string[],\n): void {\n  // Unlink can escape a stale branch; only recipients of the successor key must be current.\n  assertDocumentKekPathsCurrent(\n    input.writerProjection,\n    new Set(linkedContainerIds),\n  );\n  if (input.operation === \"link\") {\n    assertContainerKekPathCurrent(\n      input.targetContainerProjection.containerKeks,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAG/B,6BAA6B,EAC7B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMrF,OAAO,EACL,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,sBAAsB,EACtB,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,mBAAmB,EACnB,SAAS,EACT,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAQL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAE5B,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,yBAAyB,GAAG,0CAA0C,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxD,2CAA2C,CACzC,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAClD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CACvC,EACD,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAC5C,CAAC;QAEF,OAAO;YACL,cAAc;YACd,kBAAkB,EAAE,mBAAmB,CAAC;gBACtC,GAAG,yBAAyB;gBAC5B,MAAM,CAAC,WAAW;aACnB,CAAC;YACF,MAAM;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CACpD,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC5D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,kBAA0B;IAE1B,IAAI,kBAAkB,IAAI,qCAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,4CAA4C,qCAAqC,aAAa,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,kBAAqC,EACrC,gBAAwB;IAExB,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,EACjC,gBAAgB,CACjB,CAAC;IACF,IAAI,eAAe,GAAG,yCAAyC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,2CAA2C,yCAAyC,2BAA2B,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAM/C;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kDAAkD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;YAChE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,+BAA+B;gBACtC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,KAAK,UAAU,0CAA0C,CAAC,KAGzD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IACE,gBAAgB,CAAC,cAAc;QAC/B,KAAK,CAAC,yBAAyB,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,gBAAgB,CAAC,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,gCAAgC,CACvC,gBAAkD;IAElD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC;IAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,EAC9C,MAAM,EACN,WAAW,EACX,eAAe,EACf,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,yBAAyB,EACzB,eAAe,EACf,gBAAgB,GACsB;IACtC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS;QACT,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,oBAAoB,CACpD,WAAW,CAAC,OAAO,EACnB,eAAe,CAChB,CAAC;IACF,MAAM,uBAAuB,GAAG,iBAAiB,CAC/C,yBAAyB,CAAC,IAAI,CAC/B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,MAAM;QACN,WAAW;QACX,OAAO;QACP,SAAS;QACT,cAAc;QACd,QAAQ;QACR,uBAAuB;QACvB,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAiC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,cAAc;QACd,KAAK,EAAE,aAAa,GAAG,CAAC;QACxB,oBAAoB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QACpE,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,kBAAkB,EAAE,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,WAAW,CAAC,OAAO,CACpB,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,eAAe;QACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,OAAO,EAAE;YACP,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC;YACtE,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC;YACnE,oBAAoB,EAAE,YAAY;YAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;YACrE,uBAAuB;YACvB,4BAA4B,EAAE,SAAS,CAAC,4BAA4B;YACpE,gBAAgB,EAAE;gBAChB,eAAe;gBACf,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,OAAO,EAAE,yBAAyB;aACnC;SACF;QACD,KAAK;QACL,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAciC;IAEjC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC7D,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,sBAAsB,CACpB,KAAK,CAAC,yBAAyB,CAAC,IAAI,EACpC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB;QAChC,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,MAAM,4CAA4C,CAAC;QAC3E,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,eAAe;QACvD,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE;QAC/D,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC;QAChE,eAAe;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAyE,EACzE,IAIC;IAED,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;KAC9C,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO;YAClD,GAAG,CAAC,MAAM,gCAAgC,CAAC;gBACzC,GAAG,OAAO;gBACV,aAAa,EAAE,MAAM,sBAAsB,CAAC;oBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,yBAAyB;oBAC3C,SAAS,EAAE,KAAK,CAAC,eAAe;oBAChC,GAAG,mBAAmB;iBACvB,CAAC;gBACF,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,CAAC;QACtC,GAAG,OAAO;QACV,aAAa,EAAE,CACb,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,mBAAmB;SACvB,CAAC,CACH,CAAC,aAAa;QACf,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,2BAA2B,CAAC;YACnC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;YACvD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACvC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,KAGC,EACD,kBAAqC;IAErC,0FAA0F;IAC1F,6BAA6B,CAC3B,KAAK,CAAC,gBAAgB,EACtB,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,6BAA6B,CAC3B,KAAK,CAAC,yBAAyB,CAAC,aAAa,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  computeAccessManifestHash,\n  computeDocumentContentKeyTargetHash,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkSetManifestState,\n  deriveDocumentLinkSetManifest,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentContentKeyTargetEnvelope } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n} from \"@tearleads/validators/util\";\nimport {\n  assertContainerKekPathCurrent,\n  assertDocumentKekPathsCurrent,\n} from \"../../../data/documents/shared/containerKek/containerKekCurrency\";\nimport { buildDocumentLinkSetEventPlan } from \"../../../data/documents/shared/events\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  collectContainerKeksForDocumentSync,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyFromWriterProjection,\n  verifiedDocumentWrapTargets,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  describeDocumentTargetKek,\n  sortDocumentTargets,\n  targetKey,\n  uniqueSortedStrings,\n} from \"../../../data/documents/shared/readers\";\nimport {\n  type BuildDocumentLinkSetMutationPlanInput,\n  type DocumentCreateAuthor,\n  type DocumentLinkSetMutationOperation,\n  type DocumentLinkSetMutationPlan,\n  type DocumentLinkSetTargetState,\n  type MaterializedDocumentLinkSetMutationPlan,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"../purge/subtreePurgeScope\";\nimport {\n  assertDocumentLinkAuthorAccess,\n  verifyDocumentLinkSetCurrentPolicies,\n} from \"./linkSetAuthority\";\n\nfunction deriveDocumentLinkSetTargetState(input: {\n  operation: DocumentLinkSetMutationOperation;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): DocumentLinkSetTargetState {\n  const currentTargets = currentDocumentTargets(input.writerProjection);\n  const currentLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  const target = deriveDocumentTargetFromProjection(\n    input.targetContainerProjection,\n  );\n  const currentTarget = currentTargets.find(\n    (candidate) => candidate.containerId === target.containerId,\n  );\n\n  if (input.operation === \"link\") {\n    if (currentTarget) {\n      throw new Error(\"Document link target is already linked\");\n    }\n    assertDocumentLinkTargetCapacity(currentTargets.length);\n    assertDocumentLinkAuthorizationPathCapacity(\n      input.writerProjection.authorizingContainerPaths.map(\n        (projection) => projection.path.length,\n      ),\n      input.targetContainerProjection.path.length,\n    );\n\n    return {\n      currentTargets,\n      linkedContainerIds: uniqueSortedStrings([\n        ...currentLinkedContainerIds,\n        target.containerId,\n      ]),\n      target,\n      targets: sortDocumentTargets([...currentTargets, target]),\n    };\n  }\n\n  if (!currentTarget) {\n    throw new Error(\"Document unlink target is not linked\");\n  }\n  if (targetKey(currentTarget) !== targetKey(target)) {\n    throw new Error(\"Document unlink target projection is stale\");\n  }\n\n  const linkedContainerIds = currentLinkedContainerIds.filter(\n    (containerId) => containerId !== target.containerId,\n  );\n  if (linkedContainerIds.length === 0) {\n    throw new Error(\"Document unlink must leave a linked container\");\n  }\n\n  return {\n    currentTargets,\n    linkedContainerIds,\n    target,\n    targets: currentTargets.filter(\n      (candidate) => candidate.containerId !== target.containerId,\n    ),\n  };\n}\n\nexport function assertDocumentLinkTargetCapacity(\n  currentTargetCount: number,\n): void {\n  if (currentTargetCount >= MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS) {\n    throw new RangeError(\n      `A document cannot be linked to more than ${MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS} containers`,\n    );\n  }\n}\n\nexport function assertDocumentLinkAuthorizationPathCapacity(\n  currentPathLengths: readonly number[],\n  targetPathLength: number,\n): void {\n  const totalReferences = currentPathLengths.reduce(\n    (total, length) => total + length,\n    targetPathLength,\n  );\n  if (totalReferences > MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS) {\n    throw new RangeError(\n      `Document links cannot require more than ${MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS} authorization references`,\n    );\n  }\n}\n\nasync function wrapDocumentContentKeyForTargets(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  targets: readonly DocumentContentKeyTarget[];\n}): Promise<DocumentContentKeyTargetEnvelope[]> {\n  return Promise.all(\n    sortDocumentTargets(input.targets).map(async (target) => {\n      const targetKek = input.keksByEpochId.get(target.containerKeyEpochId);\n      if (!targetKek) {\n        throw new Error(\n          `Document target KEK could not be unwrapped for ${describeDocumentTargetKek(target)}`,\n        );\n      }\n\n      const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n        kind: \"Document\",\n        objectId: input.documentId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: target.containerId,\n        containerKeyEpochId: target.containerKeyEpochId,\n      });\n      return {\n        ...target,\n        wrappedKey: bytesToBase64(wrapped.ciphertext),\n        wrappingMetadata: {\n          suite: DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n          iv: bytesToBase64(wrapped.iv),\n        },\n      };\n    }),\n  );\n}\n\n// Resolve the organization a link/unlink mutation belongs to: the document's\n// own org (from its manifest), which must equal the target container's org —\n// both are owned by the same organization. The acting member's personal org is\n// intentionally not part of this check; a member may link documents within any\n// org they belong to. Returns the document org so the plan stamps it onto the\n// signed event and manifest rather than the author's org.\nasync function resolveDocumentLinkSetMutationOrganization(input: {\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): Promise<string> {\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document link-set manifest\",\n  });\n  if (\n    manifestIdentity.organizationId !==\n    input.targetContainerProjection.organizationId\n  ) {\n    throw new Error(\"Document target container organization mismatch\");\n  }\n\n  return manifestIdentity.organizationId;\n}\n\nfunction readDocumentLinkSetPreviousEpoch(\n  writerProjection: DocumentWriterProjectionResponse,\n): number {\n  const previousState = writerProjection.documentManifest.state;\n  const previousEpoch = isPlainRecord(previousState)\n    ? Reflect.get(previousState, \"epoch\")\n    : undefined;\n  if (\n    typeof previousEpoch !== \"number\" ||\n    !Number.isInteger(previousEpoch) ||\n    previousEpoch <= 0\n  ) {\n    throw new Error(\"Document link-set previous epoch is invalid\");\n  }\n\n  return previousEpoch;\n}\n\nasync function buildDocumentLinkSetMutationPlan({\n  author,\n  blobRewraps,\n  contentKeyEpoch,\n  eventId = crypto.randomUUID(),\n  operation,\n  signedAt = new Date().toISOString(),\n  targetContainerProjection,\n  targetEnvelopes,\n  writerProjection,\n}: BuildDocumentLinkSetMutationPlanInput): Promise<DocumentLinkSetMutationPlan> {\n  const organizationId = await resolveDocumentLinkSetMutationOrganization({\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation,\n    targetContainerProjection,\n    writerProjection,\n  });\n  const targetEnvelopesForRequest = mergeTargetEnvelopes(\n    targetState.targets,\n    targetEnvelopes,\n  );\n  const targetContainerPathRefs = containerPathRefs(\n    targetContainerProjection.path,\n  );\n  const eventPlan = await buildDocumentLinkSetEventPlan({\n    author,\n    blobRewraps,\n    eventId,\n    operation,\n    organizationId,\n    signedAt,\n    targetContainerPathRefs,\n    targetState,\n    writerProjection,\n  });\n  const previousEpoch = readDocumentLinkSetPreviousEpoch(writerProjection);\n\n  const state: DocumentLinkSetManifestState = {\n    version: 1,\n    documentId: writerProjection.documentId,\n    organizationId,\n    epoch: previousEpoch + 1,\n    previousManifestHash: writerProjection.documentManifest.manifestHash,\n    eventHash: eventPlan.eventHash,\n    linkedContainerIds: [...targetState.linkedContainerIds],\n  };\n  const manifest = await deriveDocumentLinkSetManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const targetHash = await computeDocumentContentKeyTargetHash(\n    targetState.targets,\n  );\n\n  return {\n    body: eventPlan.body,\n    contentKeyEpoch,\n    documentId: writerProjection.documentId,\n    event: eventPlan.event,\n    eventHash: eventPlan.eventHash,\n    manifest,\n    manifestHash,\n    operation,\n    request: {\n      event: readCanonicalRecord(eventPlan.event, \"Document link-set event\"),\n      body: readCanonicalRecord(eventPlan.body, \"Document link-set body\"),\n      expectedManifestHash: manifestHash,\n      manifest: readCanonicalRecord(manifest, \"Document link-set manifest\"),\n      targetContainerPathRefs,\n      authorizingContainerPathRefs: eventPlan.authorizingContainerPathRefs,\n      contentKeyBundle: {\n        contentKeyEpoch,\n        linkSetManifestHash: manifestHash,\n        targetHash,\n        targets: targetEnvelopesForRequest,\n      },\n    },\n    state,\n    targetHash,\n    targets: sortDocumentTargets(targetState.targets),\n  };\n}\n\nexport async function buildMaterializedDocumentLinkSetMutationPlan(\n  input: {\n    author: DocumentCreateAuthor;\n    expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n    prepareBlobRewraps: (\n      targets: readonly DocumentContentKeyTarget[],\n    ) => Promise<BuildDocumentLinkSetMutationPlanInput[\"blobRewraps\"]>;\n    contentKey?: Uint8Array | undefined;\n    eventId?: string | undefined;\n    execSql?: ExecSql | undefined;\n    operation: DocumentLinkSetMutationOperation;\n    signedAt?: string | undefined;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<MaterializedDocumentLinkSetMutationPlan> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const principalPolicyCache: PrincipalPolicyCache = new Map();\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    execSql: input.execSql,\n    principalPolicyCache,\n    ...verificationOptions,\n  });\n  await verifyDocumentLinkSetCurrentPolicies({\n    execSql: input.execSql,\n    principalPolicyCache,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  assertSubtreePurgePath(\n    input.targetContainerProjection.path,\n    input.expectedSubtreeRoot,\n  );\n  if (input.resolveProjectionUserKey)\n    assertDocumentLinkAuthorAccess({\n      ...input,\n      principalPolicies: [...principalPolicyCache.values()],\n    });\n  const targetState = deriveDocumentLinkSetTargetState({\n    operation: input.operation,\n    targetContainerProjection: input.targetContainerProjection,\n    writerProjection: input.writerProjection,\n  });\n  assertLinkSetWriteKeksCurrent(input, targetState.linkedContainerIds);\n  const currentContentKey = await unwrapDocumentContentKeyFromWriterProjection({\n    execSql: input.execSql,\n    secretKey: input.targetSecretKey,\n    writerProjection: input.writerProjection,\n    ...verificationOptions,\n  });\n  const contentKeyRotated = input.operation === \"unlink\";\n  const contentKey = contentKeyRotated\n    ? (input.contentKey ?? crypto.getRandomValues(new Uint8Array(32)))\n    : currentContentKey;\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Document content key must be 32 bytes\");\n  }\n  // A link carries the existing envelopes forward at the same epoch; an\n  // unlink rotates to a fresh key at the next one.\n  const contentKeyEpoch =\n    input.writerProjection.contentKeyBundle.contentKeyEpoch +\n    (contentKeyRotated ? 1 : 0);\n  const targetEnvelopes = await buildLinkSetTargetEnvelopes(input, {\n    contentKey,\n    contentKeyEpoch,\n    targetState,\n  });\n\n  const plan = await buildDocumentLinkSetMutationPlan({\n    author: input.author,\n    blobRewraps: await input.prepareBlobRewraps(targetState.targets),\n    contentKeyEpoch,\n    eventId: input.eventId,\n    operation: input.operation,\n    signedAt: input.signedAt,\n    targetContainerProjection: input.targetContainerProjection,\n    targetEnvelopes,\n    writerProjection: input.writerProjection,\n  });\n\n  return {\n    contentKey,\n    contentKeyRotated,\n    plan,\n  };\n}\n\nasync function buildLinkSetTargetEnvelopes(\n  input: Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n  wrap: {\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    targetState: ReturnType<typeof deriveDocumentLinkSetTargetState>;\n  },\n): Promise<DocumentContentKeyTargetEnvelope[]> {\n  const verificationOptions = projectionVerificationOptions(input);\n  const sealing = {\n    contentKey: wrap.contentKey,\n    contentKeyEpoch: wrap.contentKeyEpoch,\n    documentId: input.writerProjection.documentId,\n  };\n  if (input.operation === \"link\") {\n    return [\n      ...input.writerProjection.contentKeyBundle.targets,\n      ...(await wrapDocumentContentKeyForTargets({\n        ...sealing,\n        keksByEpochId: await unwrapContainerKekPath({\n          execSql: input.execSql,\n          projection: input.targetContainerProjection,\n          secretKey: input.targetSecretKey,\n          ...verificationOptions,\n        }),\n        targets: [wrap.targetState.target],\n      })),\n    ];\n  }\n  return wrapDocumentContentKeyForTargets({\n    ...sealing,\n    keksByEpochId: (\n      await collectContainerKeksForDocumentSync({\n        execSql: input.execSql,\n        secretKey: input.targetSecretKey,\n        writerProjection: input.writerProjection,\n        ...verificationOptions,\n      })\n    ).keksByEpochId,\n    // The rotated key is wrapped only to verified current heads of the\n    // remaining linked containers, never to a server-listed epoch.\n    targets: verifiedDocumentWrapTargets({\n      linkedContainerIds: wrap.targetState.linkedContainerIds,\n      serverTargets: wrap.targetState.targets,\n      writerProjection: input.writerProjection,\n    }),\n  });\n}\n\nfunction assertLinkSetWriteKeksCurrent(\n  input: Pick<\n    Parameters<typeof buildMaterializedDocumentLinkSetMutationPlan>[0],\n    \"writerProjection\" | \"targetContainerProjection\" | \"operation\"\n  >,\n  linkedContainerIds: readonly string[],\n): void {\n  // Unlink can escape a stale branch; only recipients of the successor key must be current.\n  assertDocumentKekPathsCurrent(\n    input.writerProjection,\n    new Set(linkedContainerIds),\n  );\n  if (input.operation === \"link\") {\n    assertContainerKekPathCurrent(\n      input.targetContainerProjection.containerKeks,\n    );\n  }\n}\n"]}

package/workflows/documents/linkSet/linkSetAuthority.js

@@ -1,5 +1,5 @@
 import { assertContainerAuthorAccess, ContainerAuthorAccessError, } from "../../../data/containers/shared/authorAccess.js";
-import { readLinkedContainerIdsFromDocumentManifest } from "../../../data/documents/shared/projection.js";
+import { readLinkedContainerIdsFromDocumentManifest } from "../../../data/documents/shared/projection/index.js";
 import { resolveProjectionVerifier, } from "../../../data/documents/shared/types.js";
 import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
 import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";