@tearleads/client-sdk 0.1.64 → 0.1.66

package/workflows/sync/remoteReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPendingUpdatePersistence\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/documentPlacementIntentSchema\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentSyncFailurePersistence\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/organizationReadModelSchema\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/verifiedManifestBundleSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/readModel/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}
+{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPersistence/documentPendingUpdatePersistence\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentPersistence/documentSyncFailurePersistence\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/schema/documentPlacementIntentSchema\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/schema/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/schema/organizationReadModelSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/readModel/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}

package/workflows/sync/remoteResetAttachments.js

@@ -1,6 +1,6 @@
 import { inArray } from "drizzle-orm";
 import { queueDocumentAttachmentStorageKeys } from "../../data/persistence/documents/internal/orphanSideRows.js";
-import { documentPendingAttachments } from "../../data/sqlite/schema.js";
+import { documentPendingAttachments } from "../../data/sqlite/schema/index.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 /** Delete reset-scoped pending rows without abandoning dropped local bytes. */
 export async function clearResetPendingAttachments(input) {

package/workflows/sync/remoteResetCursorScope.js

@@ -1,5 +1,5 @@
 import { and, eq, inArray, or } from "drizzle-orm";
-import { containerSyncWatermarks } from "../../data/sqlite/schema.js";
+import { containerSyncWatermarks } from "../../data/sqlite/schema/index.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 const CONTAINER_DOCUMENTS_LANE = "container_documents";
 const CONTAINER_PARENT_LANE = "container_parent";

package/workflows/sync/remoteResetPlans.js

@@ -3,7 +3,7 @@ import { and, eq, ne, or, sql } from "drizzle-orm";
 import { getDocumentAttachments, } from "../../data/documents/documentContent.js";
 import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
 import { DOCUMENTS_APP_KIND } from "../../data/persistence/documents/documentsPersistence.js";
-import { documentAttachmentBlobProjection, documentHistoryCheckpoints, documentHistoryUpdates, documentPendingAttachments, documents, } from "../../data/sqlite/schema.js";
+import { documentAttachmentBlobProjection, documentHistoryCheckpoints, documentHistoryUpdates, documentPendingAttachments, documents, } from "../../data/sqlite/schema/index.js";
 import { importDocumentHistoryTailUpdates } from "../documents/historyContent.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 function historyScopeKey(appKind, localId) {

package/workflows/sync/remoteResetPrincipalScope.js

@@ -1,9 +1,9 @@
 import { and, eq, or } from "drizzle-orm";
-import { principalHistoryEntries, principalHistoryNodes, principalHistoryPrefixes, } from "../../data/sqlite/principalHistoryEvidenceSchema.js";
-import { principalHistoryNodeReferences, principalHistoryRootOwners, } from "../../data/sqlite/principalHistoryNodeRetentionSchema.js";
-import { principalKeyEnvelopeArchive } from "../../data/sqlite/principalHistoryRetentionSchema.js";
-import { principalHistoryStages } from "../../data/sqlite/principalHistoryStageSchema.js";
-import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, principalPolicyCheckpoints, principalPolicyOrganizations, } from "../../data/sqlite/schema.js";
+import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, principalPolicyCheckpoints, principalPolicyOrganizations, } from "../../data/sqlite/schema/index.js";
+import { principalHistoryEntries, principalHistoryNodes, principalHistoryPrefixes, } from "../../data/sqlite/schema/principalHistoryEvidenceSchema.js";
+import { principalHistoryNodeReferences, principalHistoryRootOwners, } from "../../data/sqlite/schema/principalHistoryNodeRetentionSchema.js";
+import { principalKeyEnvelopeArchive } from "../../data/sqlite/schema/principalHistoryRetentionSchema.js";
+import { principalHistoryStages } from "../../data/sqlite/schema/principalHistoryStageSchema.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 /** Current cache writes atomically pin ownership; reset never backfills it. */
 export async function loadRemoteResetPrincipalScope(tx, organizationId) {

package/workflows/sync/remoteResetPrincipalScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteResetPrincipalScope.js","sourceRoot":"","sources":["remoteResetPrincipalScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAY1D,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAgC,EAChC,cAAsB;IAKtB,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,iBAAiB,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,aAAa;SACtC,CAAC;aACD,IAAI,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT;YACE,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,EAAE;aACC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC,CACf,CACF;QACD,EAAE;aACC,MAAM,CAAC;YACN,cAAc,EAAE,4BAA4B,CAAC,cAAc;YAC3D,WAAW,EAAE,4BAA4B,CAAC,WAAW;YACrD,aAAa,EAAE,4BAA4B,CAAC,aAAa;SAC1D,CAAC;aACD,IAAI,CAAC,4BAA4B,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE;QAC1C,GAAG,CAAC,cAAc;KACnB,CAAC,CACH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,GAAG,CAAC,EAAE,EAChB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,cAAc,EAAE,EAAE;QAC1C,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE;YACnD,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,0BAA0B;QAC1B,uBAAuB;QACvB,qBAAqB;QACrB,wBAAwB;QACxB,2BAA2B;KAC5B;QACC,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;aACrD,GAAG,EAAE,CAAC;IACX,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SACtE,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAC7B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,4BAA4B;YAC5B,+BAA+B;SACvB,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,EAAE;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CACJ,EAAE,CACA,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { and, eq, or } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryNodes,\n  principalHistoryPrefixes,\n} from \"../../data/sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalHistoryNodeReferences,\n  principalHistoryRootOwners,\n} from \"../../data/sqlite/principalHistoryNodeRetentionSchema\";\nimport { principalKeyEnvelopeArchive } from \"../../data/sqlite/principalHistoryRetentionSchema\";\nimport { principalHistoryStages } from \"../../data/sqlite/principalHistoryStageSchema\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n  principalPolicyCheckpoints,\n  principalPolicyOrganizations,\n} from \"../../data/sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\n\nexport interface RemoteResetPrincipalKey {\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n}\n\ninterface PrincipalRow {\n  readonly id: string;\n  readonly type: string;\n}\n\n/** Current cache writes atomically pin ownership; reset never backfills it. */\nexport async function loadRemoteResetPrincipalScope(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<{\n  readonly policyRows: readonly PrincipalRow[];\n  readonly principalKeys: readonly RemoteResetPrincipalKey[];\n}> {\n  const [policyRows, retainedRows, ownershipRows] = await Promise.all([\n    tx\n      .select({\n        id: principalPolicies.principalId,\n        type: principalPolicies.principalType,\n      })\n      .from(principalPolicies),\n    Promise.all(\n      [\n        principalPolicyBundleHistory,\n        principalPolicyBundleReferences,\n        principalPolicyCheckpoints,\n      ].map((table) =>\n        tx\n          .selectDistinct({ id: table.principalId, type: table.principalType })\n          .from(table),\n      ),\n    ),\n    tx\n      .select({\n        organizationId: principalPolicyOrganizations.organizationId,\n        principalId: principalPolicyOrganizations.principalId,\n        principalType: principalPolicyOrganizations.principalType,\n      })\n      .from(principalPolicyOrganizations),\n  ]);\n  const owners = new Map(\n    ownershipRows.map((row) => [\n      `${row.principalType}\\0${row.principalId}`,\n      row.organizationId,\n    ]),\n  );\n  for (const row of [...policyRows, ...retainedRows.flat()]) {\n    const owner = owners.get(`${row.type}\\0${row.id}`);\n    if (row.type === \"group\" && !owner) {\n      throw new Error(\n        \"Unowned group policy cache requires a local database reset before organization purge\",\n      );\n    }\n    if (row.type !== \"group\" && row.type !== \"organization\") {\n      throw new Error(\"Principal policy cache has an invalid principal type\");\n    }\n    if (\n      row.type === \"organization\" &&\n      owner !== undefined &&\n      owner !== row.id\n    ) {\n      throw new Error(\n        \"Organization policy cache ownership does not match its identity\",\n      );\n    }\n  }\n  const keys = new Map<string, RemoteResetPrincipalKey>();\n  keys.set(`organization\\0${organizationId}`, {\n    principalId: organizationId,\n    principalType: \"organization\",\n  });\n  for (const row of ownershipRows) {\n    if (row.principalType !== \"group\" && row.principalType !== \"organization\") {\n      throw new Error(\n        \"Principal policy cache ownership has an invalid principal type\",\n      );\n    }\n    if (!row.organizationId) {\n      throw new Error(\n        \"Principal policy cache ownership requires a local database reset\",\n      );\n    }\n    if (row.organizationId !== organizationId) continue;\n    keys.set(`${row.principalType}\\0${row.principalId}`, {\n      principalId: row.principalId,\n      principalType: row.principalType,\n    });\n  }\n  return { policyRows, principalKeys: [...keys.values()] };\n}\n\n// Trust checkpoints and their ownership survive reset. Clearing cached bundles\n// must not turn a previously observed principal or object into first sight.\nexport async function clearRemoteResetPrincipalRows(input: {\n  organizationId: string;\n  snapshot: { principalKeys: readonly RemoteResetPrincipalKey[] };\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const table of [\n    principalHistoryNodeReferences,\n    principalHistoryRootOwners,\n    principalHistoryEntries,\n    principalHistoryNodes,\n    principalHistoryPrefixes,\n    principalKeyEnvelopeArchive,\n  ])\n    await input.tx\n      .delete(table)\n      .where(eq(table.organizationId, input.organizationId))\n      .run();\n  await input.tx\n    .delete(principalHistoryStages)\n    .where(eq(principalHistoryStages.organizationId, input.organizationId))\n    .run();\n  for (const principalBatch of remoteResetBatches(\n    input.snapshot.principalKeys,\n  )) {\n    for (const table of [\n      principalPolicies,\n      principalPolicyBundleHistory,\n      principalPolicyBundleReferences,\n    ] as const) {\n      await input.tx\n        .delete(table)\n        .where(\n          or(\n            ...principalBatch.map((principal) =>\n              and(\n                eq(table.principalType, principal.principalType),\n                eq(table.principalId, principal.principalId),\n              ),\n            ),\n          ),\n        )\n        .run();\n    }\n  }\n}\n"]}
+{"version":3,"file":"remoteResetPrincipalScope.js","sourceRoot":"","sources":["remoteResetPrincipalScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAE9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAY1D,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAgC,EAChC,cAAsB;IAKtB,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,iBAAiB,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,aAAa;SACtC,CAAC;aACD,IAAI,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT;YACE,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,EAAE;aACC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC,CACf,CACF;QACD,EAAE;aACC,MAAM,CAAC;YACN,cAAc,EAAE,4BAA4B,CAAC,cAAc;YAC3D,WAAW,EAAE,4BAA4B,CAAC,WAAW;YACrD,aAAa,EAAE,4BAA4B,CAAC,aAAa;SAC1D,CAAC;aACD,IAAI,CAAC,4BAA4B,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE;QAC1C,GAAG,CAAC,cAAc;KACnB,CAAC,CACH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,GAAG,CAAC,EAAE,EAChB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,cAAc,EAAE,EAAE;QAC1C,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE;YACnD,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,0BAA0B;QAC1B,uBAAuB;QACvB,qBAAqB;QACrB,wBAAwB;QACxB,2BAA2B;KAC5B;QACC,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;aACrD,GAAG,EAAE,CAAC;IACX,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SACtE,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAC7B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,4BAA4B;YAC5B,+BAA+B;SACvB,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,EAAE;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CACJ,EAAE,CACA,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { and, eq, or } from \"drizzle-orm\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n  principalPolicyCheckpoints,\n  principalPolicyOrganizations,\n} from \"../../data/sqlite/schema\";\nimport {\n  principalHistoryEntries,\n  principalHistoryNodes,\n  principalHistoryPrefixes,\n} from \"../../data/sqlite/schema/principalHistoryEvidenceSchema\";\nimport {\n  principalHistoryNodeReferences,\n  principalHistoryRootOwners,\n} from \"../../data/sqlite/schema/principalHistoryNodeRetentionSchema\";\nimport { principalKeyEnvelopeArchive } from \"../../data/sqlite/schema/principalHistoryRetentionSchema\";\nimport { principalHistoryStages } from \"../../data/sqlite/schema/principalHistoryStageSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\n\nexport interface RemoteResetPrincipalKey {\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n}\n\ninterface PrincipalRow {\n  readonly id: string;\n  readonly type: string;\n}\n\n/** Current cache writes atomically pin ownership; reset never backfills it. */\nexport async function loadRemoteResetPrincipalScope(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<{\n  readonly policyRows: readonly PrincipalRow[];\n  readonly principalKeys: readonly RemoteResetPrincipalKey[];\n}> {\n  const [policyRows, retainedRows, ownershipRows] = await Promise.all([\n    tx\n      .select({\n        id: principalPolicies.principalId,\n        type: principalPolicies.principalType,\n      })\n      .from(principalPolicies),\n    Promise.all(\n      [\n        principalPolicyBundleHistory,\n        principalPolicyBundleReferences,\n        principalPolicyCheckpoints,\n      ].map((table) =>\n        tx\n          .selectDistinct({ id: table.principalId, type: table.principalType })\n          .from(table),\n      ),\n    ),\n    tx\n      .select({\n        organizationId: principalPolicyOrganizations.organizationId,\n        principalId: principalPolicyOrganizations.principalId,\n        principalType: principalPolicyOrganizations.principalType,\n      })\n      .from(principalPolicyOrganizations),\n  ]);\n  const owners = new Map(\n    ownershipRows.map((row) => [\n      `${row.principalType}\\0${row.principalId}`,\n      row.organizationId,\n    ]),\n  );\n  for (const row of [...policyRows, ...retainedRows.flat()]) {\n    const owner = owners.get(`${row.type}\\0${row.id}`);\n    if (row.type === \"group\" && !owner) {\n      throw new Error(\n        \"Unowned group policy cache requires a local database reset before organization purge\",\n      );\n    }\n    if (row.type !== \"group\" && row.type !== \"organization\") {\n      throw new Error(\"Principal policy cache has an invalid principal type\");\n    }\n    if (\n      row.type === \"organization\" &&\n      owner !== undefined &&\n      owner !== row.id\n    ) {\n      throw new Error(\n        \"Organization policy cache ownership does not match its identity\",\n      );\n    }\n  }\n  const keys = new Map<string, RemoteResetPrincipalKey>();\n  keys.set(`organization\\0${organizationId}`, {\n    principalId: organizationId,\n    principalType: \"organization\",\n  });\n  for (const row of ownershipRows) {\n    if (row.principalType !== \"group\" && row.principalType !== \"organization\") {\n      throw new Error(\n        \"Principal policy cache ownership has an invalid principal type\",\n      );\n    }\n    if (!row.organizationId) {\n      throw new Error(\n        \"Principal policy cache ownership requires a local database reset\",\n      );\n    }\n    if (row.organizationId !== organizationId) continue;\n    keys.set(`${row.principalType}\\0${row.principalId}`, {\n      principalId: row.principalId,\n      principalType: row.principalType,\n    });\n  }\n  return { policyRows, principalKeys: [...keys.values()] };\n}\n\n// Trust checkpoints and their ownership survive reset. Clearing cached bundles\n// must not turn a previously observed principal or object into first sight.\nexport async function clearRemoteResetPrincipalRows(input: {\n  organizationId: string;\n  snapshot: { principalKeys: readonly RemoteResetPrincipalKey[] };\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const table of [\n    principalHistoryNodeReferences,\n    principalHistoryRootOwners,\n    principalHistoryEntries,\n    principalHistoryNodes,\n    principalHistoryPrefixes,\n    principalKeyEnvelopeArchive,\n  ])\n    await input.tx\n      .delete(table)\n      .where(eq(table.organizationId, input.organizationId))\n      .run();\n  await input.tx\n    .delete(principalHistoryStages)\n    .where(eq(principalHistoryStages.organizationId, input.organizationId))\n    .run();\n  for (const principalBatch of remoteResetBatches(\n    input.snapshot.principalKeys,\n  )) {\n    for (const table of [\n      principalPolicies,\n      principalPolicyBundleHistory,\n      principalPolicyBundleReferences,\n    ] as const) {\n      await input.tx\n        .delete(table)\n        .where(\n          or(\n            ...principalBatch.map((principal) =>\n              and(\n                eq(table.principalType, principal.principalType),\n                eq(table.principalId, principal.principalId),\n              ),\n            ),\n          ),\n        )\n        .run();\n    }\n  }\n}\n"]}

package/workflows/sync/remoteResetScope.js

@@ -1,5 +1,5 @@
 import { eq } from "drizzle-orm";
-import { containerSyncWatermarks, containers, documentContainerProjection, documentProjection, documents, dormantContainerMetadata, LOCAL_INTENT_LANES, localIntents, } from "../../data/sqlite/schema.js";
+import { containerSyncWatermarks, containers, documentContainerProjection, documentProjection, documents, dormantContainerMetadata, LOCAL_INTENT_LANES, localIntents, } from "../../data/sqlite/schema/index.js";
 import { isRemoteResetSyncCursor } from "./remoteResetCursorScope.js";
 import { loadRemoteResetPrincipalScope, } from "./remoteResetPrincipalScope.js";
 function principalKeyOfRow(row) {

package/data/documents/shared/containerKekPath.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerKekPath.js","sourceRoot":"","sources":["containerKekPath.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AAEjG,OAAO,EACL,4CAA4C,EAC5C,uCAAuC,EACvC,kBAAkB,EAClB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAGnB,SAAS,8BAA8B,CACrC,UAA6C,EAC7C,KAAa;IAEb,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,uBAAuB,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvE,CAAC;IACD,IACE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,mBAAmB;QACzB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtE,GAAG,CAAC,WAAW;QACjB,yBAAyB,CACvB,GAAG,CAAC,QAAQ,EACZ,UAAU,EACV,kBAAkB,CAAC,KAAK,CAAC,CAC1B,KAAK,GAAG,CAAC,iBAAiB;QAC3B,wBAAwB,CACtB,GAAG,CAAC,QAAQ,EACZ,2BAA2B,EAC3B,kBAAkB,CAAC,KAAK,CAAC,CAC1B,KAAK,GAAG,CAAC,yBAAyB,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAInD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC;SACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,cAAc,EAAE,IAAI,CAAC,uBAAuB;QAC5C,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC,CAAC;IACN,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,uCAAuC,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,sBAAsB,CAAC,KAGrC;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE/D,KAAK,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC,kBAAkB;QACvE,IAAI,GAAG,EAAsB,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,yBAAyB,CACzC,KAAK,CAAC,UAAU,EAChB,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,4CAA4C,CAAC;YACjD,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,6BAA6B,CACjC,KAAK,CAAC,UAAU,EAChB,SAAS,CAAC,KAAK,EACf,WAAW,CACZ,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE;YACrC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW;YACtC,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY;YACxC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA6C,EAC7C,mBAA2B;IAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,mBAAmB,KAAK,mBAAmB,EAAE,CAAC;YACxD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,aAAyD,EACzD,GAGC,EACD,SAA4B;IAE5B,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,WAAW,IAAI,SAAS,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAQxC;IAKC,8BAA8B,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GACb,CAAC,MAAM,oCAAoC,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;KACN,CAAC,CAAC;QACH,CAAC,MAAM,gCAAgC,CAAC;YACtC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtC,yBAAyB,EAAE,GAAG,CAAC,yBAAyB;YACxD,mBAAmB,EAAE,KAAK,CAAC,aAAa;YACxC,KAAK;SACN,CAAC,CAAC,CAAC;IAEN,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,4CAA4C,CAAC;YACjD,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtC,GAAG;YACH,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,6BAA6B,CACjC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,KAAK,EACX,SAAS,CACV,CAAC;QACF,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE;YAC/C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,iCAAiC,CAAC;YACtC,eAAe;YACf,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,oBAAoB,EAAE,oBAAoB,CACxC,KAAK,CAAC,aAAa,EACnB,GAAG,EACH,SAAS,CACV;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;SACtD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,iEAAiE;QACjE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,KAAK,EACH,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,2CAA2C,EAAE;oBACrD,KAAK,EAAE,KAAK;iBACb,CAAC;YACR,mBAAmB,EAAE,uCAAuC,CAAC;gBAC3D,GAAG;gBACH,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAS,wBAAwB,CAC/B,iBAAqC,EACrC,iCAAqD,EACrD,OAA2E;IAE3E,IAAI,OAAO,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC9D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAChD,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAEhD;IADX,YACW,WAAmB,EAC5B,KAAa;QAEb,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QAHhC,gBAAW,GAAX,WAAW,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,KAQjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IACE,CAAC,SAAS;QACV,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAC7D,CAAC;QACD,OAAO;IACT,CAAC;IACD,KACE,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EACrD,KAAK,IAAI,CAAC,EACV,KAAK,IAAI,CAAC,EACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,kBAAkB,GACtB,KAAK,CAAC,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACnE,CAAC,OAAO,CAAC,yBAAyB;gBAChC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,GAAG,CACpC,OAAO,CAAC,yBAAyB,CAClC;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,KAAK,CAAC,4CAA4C,CAAC,GAAG,CACpD,OAAO,CAAC,WAAW,CACpB,CAAC;QACJ,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,kBAAkB,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,kCAAkC,CAC1C,SAAS,CAAC,WAAW,EACrB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,QAAqC;IAErC,qEAAqE;IACrE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ;QACX,cAAc,EACZ,QAAQ,CAAC,cAAc;YACvB,IAAI,GAAG,EAA2C;KACrD,CAAC;IACF,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9D,MAAM,4CAA4C,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE9E,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAC7C,KAAK,IAAI,CAAC,EACV,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,yBAAyB,CAAC;YACrD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK;YACL,aAAa;YACb,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,KAAK,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,cAAc,EAAE,CAAC;YACnB,wBAAwB,CACtB,4BAA4B,EAC5B,4CAA4C,EAC5C,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3D,KAAK,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;QACvD,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC;IACD,wBAAwB,CAAC;QACvB,oBAAoB;QACpB,4BAA4B;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,4CAA4C;KAC7C,CAAC,CAAC;IACH,OAAO;QACL,aAAa,EAAE,oBAAoB;QACnC,4BAA4B;QAC5B,4CAA4C;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,OAAO,CAAC,MAAM,yCAAyC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;AAChF,CAAC","sourcesContent":["import type {\n  ContainerKeyWrap,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { unwrapKeyEnvelopesWithPrincipalPolicies } from \"../../principals/principalPolicyCrypto\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  assertUnwrappedContainerKekMatchesMaterialId,\n  projectedUnreachablePredecessorEpochIds,\n  projectionKekLabel,\n  unwrapKeyringContainerKeksAtIndex,\n} from \"./containerKekPathHistory\";\nimport {\n  type UnwrapContainerKekPathInput,\n  verifyContainerKekPathProjection,\n} from \"./containerKekPathVerification\";\nimport {\n  assertSignedWrappingPublicKey,\n  unwrapContainerKekFromParentWrap,\n} from \"./containerKekWrapping\";\nimport {\n  normalizeContainerKeyWrap,\n  readManifestContainerId,\n  readRecordNullableString,\n  readRecordPositiveInteger,\n  readRecordString,\n} from \"./readers\";\nimport type { UnwrappedContainerKek } from \"./types\";\n\nfunction assertProjectionKekMatchesPath(\n  projection: ContainerWriterProjectionResponse,\n  index: number,\n): void {\n  const manifest = projection.path[index];\n  const kek = projection.containerKeks[index];\n  if (!manifest || !kek) {\n    throw new Error(\"Container writer projection path and KEKs are incomplete\");\n  }\n  if (readManifestContainerId(manifest) !== kek.containerId) {\n    throw new Error(`${projectionKekLabel(index)} container is inconsistent`);\n  }\n  if (kek.accessManifestHash !== manifest.manifestHash) {\n    throw new Error(`${projectionKekLabel(index)} manifest is stale`);\n  }\n  if (!isPlainRecord(kek.keyEpoch)) {\n    throw new Error(`${projectionKekLabel(index)} key epoch is invalid`);\n  }\n  if (\n    readRecordString(kek.keyEpoch, \"id\", projectionKekLabel(index)) !==\n      kek.containerKeyEpochId ||\n    readRecordString(kek.keyEpoch, \"containerId\", projectionKekLabel(index)) !==\n      kek.containerId ||\n    readRecordPositiveInteger(\n      kek.keyEpoch,\n      \"keyEpoch\",\n      projectionKekLabel(index),\n    ) !== kek.containerKeyEpoch ||\n    readRecordNullableString(\n      kek.keyEpoch,\n      \"parentContainerKeyEpochId\",\n      projectionKekLabel(index),\n    ) !== kek.parentContainerKeyEpochId\n  ) {\n    throw new Error(`${projectionKekLabel(index)} key epoch is inconsistent`);\n  }\n}\n\nasync function unwrapContainerKekFromPrincipalWraps(input: {\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<Uint8Array | null> {\n  const envelopes = input.wraps\n    .filter((wrap) => wrap.recipientKind !== \"container\")\n    .map((wrap) => ({\n      keyFingerprint: wrap.recipientKeyFingerprint,\n      kemCipherText: wrap.kemCipherText,\n      wrappedKey: wrap.wrappedKey,\n    }));\n  if (envelopes.length === 0) {\n    return null;\n  }\n\n  try {\n    return await unwrapKeyEnvelopesWithPrincipalPolicies({\n      envelopes,\n      execSql: input.execSql,\n      secretKey: input.secretKey,\n    });\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Admits caller-supplied keys that the projection also names.\n *\n * The projection match is deliberate: a seeded key is trusted only once its\n * epoch is one this projection actually carries, which is what makes the\n * material-id check below meaningful. Production seeds this with the epoch it\n * just minted (see `registerIdentity`), never with recovered history — history\n * arrives through the sealed keyring on each path instead, and is shared across\n * authorizing paths through the common `keksByEpochId` map.\n */\nasync function seedKnownContainerKeks(input: {\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  projection: ContainerWriterProjectionResponse;\n}): Promise<Map<string, UnwrappedContainerKek>> {\n  const keksByEpochId = new Map<string, UnwrappedContainerKek>();\n\n  for (const [containerKeyEpochId, keyMaterial] of input.knownContainerKeks ??\n    new Map<string, Uint8Array>()) {\n    const projected = findProjectedContainerKek(\n      input.projection,\n      containerKeyEpochId,\n    );\n    if (!projected) {\n      continue;\n    }\n    await assertUnwrappedContainerKekMatchesMaterialId({\n      label: projected.label,\n      kek: projected.kek,\n      keyMaterial,\n    });\n    await assertSignedWrappingPublicKey(\n      input.projection,\n      projected.index,\n      keyMaterial,\n    );\n    keksByEpochId.set(containerKeyEpochId, {\n      containerId: projected.kek.containerId,\n      keyEpochHash: projected.kek.keyEpochHash,\n      keyMaterial,\n    });\n  }\n\n  return keksByEpochId;\n}\n\nfunction findProjectedContainerKek(\n  projection: ContainerWriterProjectionResponse,\n  containerKeyEpochId: string,\n) {\n  for (const [index, current] of projection.containerKeks.entries()) {\n    if (current.containerKeyEpochId === containerKeyEpochId) {\n      return { index, kek: current, label: projectionKekLabel(index) };\n    }\n  }\n  return null;\n}\n\nfunction successorKeyMaterial(\n  keksByEpochId: ReadonlyMap<string, UnwrappedContainerKek>,\n  kek: Pick<\n    ContainerWriterProjectionResponse[\"containerKeks\"][number],\n    \"containerKeyEpochId\"\n  >,\n  unwrapped: Uint8Array | null,\n): Uint8Array | null {\n  return keksByEpochId.get(kek.containerKeyEpochId)?.keyMaterial ?? unwrapped;\n}\n\nasync function unwrapContainerKekAtIndex(input: {\n  readonly execSql?: ExecSql | undefined;\n  readonly index: number;\n  readonly keksByEpochId: Map<string, UnwrappedContainerKek>;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly secretKey: Uint8Array;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n  readonly verifyBridgeCommitment: boolean;\n}): Promise<{\n  readonly containerId: string;\n  readonly error: Error;\n  readonly unreachableEpochIds: readonly string[];\n} | null> {\n  assertProjectionKekMatchesPath(input.projection, input.index);\n  const kek = input.projection.containerKeks[input.index];\n  const currentManifest = input.projection.path[input.index];\n  if (!kek || !currentManifest) {\n    throw new Error(`${projectionKekLabel(input.index)} is missing`);\n  }\n\n  const wraps: ContainerKeyWrap[] = [];\n  for (const rawWrap of kek.wraps) {\n    const wrap = normalizeContainerKeyWrap(rawWrap);\n    if (wrap.containerKeyEpochId === kek.containerKeyEpochId) {\n      wraps.push(wrap);\n    }\n  }\n  if (wraps.length !== kek.wraps.length) {\n    throw new Error(`${projectionKekLabel(input.index)} contains a stale wrap`);\n  }\n\n  const unwrapped =\n    (await unwrapContainerKekFromPrincipalWraps({\n      execSql: input.execSql,\n      secretKey: input.secretKey,\n      wraps,\n    })) ??\n    (await unwrapContainerKekFromParentWrap({\n      label: projectionKekLabel(input.index),\n      parentContainerKeyEpochId: kek.parentContainerKeyEpochId,\n      parentKeksByEpochId: input.keksByEpochId,\n      wraps,\n    }));\n\n  if (unwrapped) {\n    await assertUnwrappedContainerKekMatchesMaterialId({\n      label: projectionKekLabel(input.index),\n      kek,\n      keyMaterial: unwrapped,\n    });\n    await assertSignedWrappingPublicKey(\n      input.projection,\n      input.index,\n      unwrapped,\n    );\n    input.keksByEpochId.set(kek.containerKeyEpochId, {\n      containerId: kek.containerId,\n      keyEpochHash: kek.keyEpochHash,\n      keyMaterial: unwrapped,\n    });\n  }\n\n  try {\n    // Open the keyring immediately so descendants pinned to an older parent\n    // epoch can still unwrap during the same path walk.\n    await unwrapKeyringContainerKeksAtIndex({\n      currentManifest,\n      index: input.index,\n      kek,\n      keksByEpochId: input.keksByEpochId,\n      successorKeyMaterial: successorKeyMaterial(\n        input.keksByEpochId,\n        kek,\n        unwrapped,\n      ),\n      verifiedByHash: input.verifiedByHash,\n      verifyKeyringCommitment: input.verifyBridgeCommitment,\n    });\n    return null;\n  } catch (error) {\n    // Historical keyring damage must not discard an independently verified\n    // current KEK. If the target still cannot be reached, the caller\n    // surfaces this integrity error; the bridge log remains the recovery\n    // path for the orphaned epochs.\n    return {\n      containerId: kek.containerId,\n      error:\n        error instanceof Error\n          ? error\n          : new Error(\"Container predecessor KEK recovery failed\", {\n              cause: error,\n            }),\n      unreachableEpochIds: projectedUnreachablePredecessorEpochIds({\n        kek,\n        keksByEpochId: input.keksByEpochId,\n      }),\n    };\n  }\n}\n\ninterface UnwrappedContainerKekPathResult {\n  readonly keksByEpochId: ReadonlyMap<string, Uint8Array>;\n  readonly predecessorFailuresByEpochId: ReadonlyMap<string, Error>;\n  readonly unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  >;\n}\n\nfunction recordPredecessorFailure(\n  failuresByEpochId: Map<string, Error>,\n  unattributedFailuresByContainerId: Map<string, Error>,\n  failure: NonNullable<Awaited<ReturnType<typeof unwrapContainerKekAtIndex>>>,\n): void {\n  if (failure.unreachableEpochIds.length === 0) {\n    if (!unattributedFailuresByContainerId.has(failure.containerId)) {\n      unattributedFailuresByContainerId.set(failure.containerId, failure.error);\n    }\n    return;\n  }\n  for (const containerKeyEpochId of failure.unreachableEpochIds) {\n    if (!failuresByEpochId.has(containerKeyEpochId)) {\n      failuresByEpochId.set(containerKeyEpochId, failure.error);\n    }\n  }\n}\n\n/**\n * No wrap on the path opens the target for this reader, and no recorded\n * history failure explains it: the reader simply holds no key here. Distinct\n * from keyring damage, which rethrows the underlying integrity error instead.\n */\nexport class ContainerKekTargetUnreachableError extends Error {\n  constructor(\n    readonly containerId: string,\n    label: string,\n  ) {\n    super(`${label} could not be unwrapped`);\n    this.name = \"ContainerKekTargetUnreachableError\";\n  }\n}\n\nfunction assertTargetKekUnwrapped(input: {\n  readonly keyMaterialByEpochId: ReadonlyMap<string, Uint8Array>;\n  readonly predecessorFailuresByEpochId: ReadonlyMap<string, Error>;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly unattributedPredecessorFailuresByContainerId: ReadonlyMap<\n    string,\n    Error\n  >;\n}): void {\n  const targetKek = input.projection.containerKeks.at(-1);\n  if (\n    !targetKek ||\n    input.keyMaterialByEpochId.has(targetKek.containerKeyEpochId)\n  ) {\n    return;\n  }\n  for (\n    let index = input.projection.containerKeks.length - 1;\n    index >= 0;\n    index -= 1\n  ) {\n    const pathKek = input.projection.containerKeks[index];\n    if (!pathKek) {\n      continue;\n    }\n    const predecessorFailure =\n      input.predecessorFailuresByEpochId.get(pathKek.containerKeyEpochId) ??\n      (pathKek.parentContainerKeyEpochId\n        ? input.predecessorFailuresByEpochId.get(\n            pathKek.parentContainerKeyEpochId,\n          )\n        : undefined) ??\n      input.unattributedPredecessorFailuresByContainerId.get(\n        pathKek.containerId,\n      );\n    if (predecessorFailure) {\n      throw predecessorFailure;\n    }\n  }\n  throw new ContainerKekTargetUnreachableError(\n    targetKek.containerId,\n    projectionKekLabel(input.projection.containerKeks.length - 1),\n  );\n}\n\nexport async function unwrapContainerKekPathWithHistoryFailures(\n  rawInput: UnwrapContainerKekPathInput,\n): Promise<UnwrappedContainerKekPathResult> {\n  // Kept for the keyring checks, which anchor to the verified lineage.\n  const input = {\n    ...rawInput,\n    verifiedByHash:\n      rawInput.verifiedByHash ??\n      new Map<string, VerifiedContainerAccessManifest>(),\n  };\n  await verifyContainerKekPathProjection(input);\n\n  const keksByEpochId = await seedKnownContainerKeks({\n    knownContainerKeks: input.knownContainerKeks,\n    projection: input.projection,\n  });\n  const predecessorFailuresByEpochId = new Map<string, Error>();\n  const unattributedPredecessorFailuresByContainerId = new Map<string, Error>();\n\n  for (\n    let index = 0;\n    index < input.projection.containerKeks.length;\n    index += 1\n  ) {\n    const currentFailure = await unwrapContainerKekAtIndex({\n      execSql: input.execSql,\n      index,\n      keksByEpochId,\n      projection: input.projection,\n      secretKey: input.secretKey,\n      verifiedByHash: input.verifiedByHash,\n      verifyBridgeCommitment: input.trustedLocalProjection !== true,\n    });\n    if (currentFailure) {\n      recordPredecessorFailure(\n        predecessorFailuresByEpochId,\n        unattributedPredecessorFailuresByContainerId,\n        currentFailure,\n      );\n    }\n  }\n\n  const keyMaterialByEpochId = new Map<string, Uint8Array>();\n  for (const [containerKeyEpochId, kek] of keksByEpochId) {\n    keyMaterialByEpochId.set(containerKeyEpochId, kek.keyMaterial);\n  }\n  assertTargetKekUnwrapped({\n    keyMaterialByEpochId,\n    predecessorFailuresByEpochId,\n    projection: input.projection,\n    unattributedPredecessorFailuresByContainerId,\n  });\n  return {\n    keksByEpochId: keyMaterialByEpochId,\n    predecessorFailuresByEpochId,\n    unattributedPredecessorFailuresByContainerId,\n  };\n}\n\nexport async function unwrapContainerKekPath(\n  input: UnwrapContainerKekPathInput,\n): Promise<ReadonlyMap<string, Uint8Array>> {\n  return (await unwrapContainerKekPathWithHistoryFailures(input)).keksByEpochId;\n}\n"]}

package/data/documents/shared/containerKekPathHistory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerKekPathHistory.js","sourceRoot":"","sources":["containerKekPathHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,EACvB,iCAAiC,EACjC,4BAA4B,EAC5B,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAMpD,2FAA2F;AAC3F,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAC5D,YAAY,KAAa;QACvB,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,mCAAmC,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KAOlE;IACC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,KAAK,+CAA+C,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;QAClC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB;QACrC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,KAAK,iDAAiD,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAkB;IACtD,OAAO,GAAG,CAAC,wBAAwB,CAAC,MAAM,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,WAAW,CAChE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CAAC,KAKtC;IACC,MAAM,oBAAoB,GAAG,qBAAqB,CAChD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAClB,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAC/C,CAAC,kBAAkB,CAAC;IACrB,MAAM,gBAAgB,GACpB,oBAAoB,KAAK,KAAK,CAAC,eAAe,CAAC,YAAY;QACzD,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,oBAAoB,CACzD,CAAC;IACR,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,gBAAgB,CAAC,KAAK,EACtB,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CACnD,CAAC;IACF,MAAM,SAAS,GAAG,iCAAiC,CACjD,iBAAiB,CACf,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,EAChC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CACxD,CACF,CAAC;IACF,IACE,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB;QACvC,SAAS,CAAC,SAAS,KAAK,iBAAiB;QACzC,SAAS,CAAC,SAAS,KAAK,kBAAkB,CAAC;QAC7C,SAAS,CAAC,WAAW;YACnB,CAAC,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAOzC;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1D,IACE,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW;QACvC,OAAO,CAAC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAClC,MAAM,uBAAuB,CAAC;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAA4D,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,uBAAuB,CAAC;YACtC,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,OAAO;YACP,qBAAqB,EAAE,KAAK,CAAC,oBAAoB;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,qEAAqE;QACrE,6BAA6B;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,EAChE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE1D,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAClD,CAAC;IACF,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB,EAAE,KAAK,CAAC,eAAe,CAAC,YAAY;QACpD,GAAG;QACH,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,KAAK,MAAM,iBAAiB,IAAI,cAAc,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,yDAAyD,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAkB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,mBAAmB,CAC/B,MAAM,CAAC,KAAK,EACZ,uDAAuD,CACxD,CAAC;QACF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACtE,IACE,OAAO,mBAAmB,KAAK,QAAQ;YACvC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB,EAC/C,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,OACE,OAAO;QACP,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW;QACnD,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAClC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAClD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACxD,OAAO;YACL,YAAY,KAAK,IAAI;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAK1B;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE;QACjD,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,yCAAyC;QACzC,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KASvD;IACC,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAChC,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG;QACH,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,iBAAiB,CAAC;YAChB,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IACC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,mBAAmB,CAC/B,MAAM,CAAC,KAAK,EACZ,uDAAuD,CACxD,CAAC;QACF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACtE,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YAC5C,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAClC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CACvE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computeContainerKekKeyringHash,\n  computeContainerKekMaterialId,\n  isContainerKekMaterialId,\n  KeyingVerificationError,\n  normalizeContainerAccessEventBody,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../keying/canonicalJson\";\nimport { readContainerKeyEpoch } from \"../../keyingProjectionVerification/readers\";\nimport { verifyContainerKekEntries } from \"./containerKekEntryVerification\";\nimport { readManifestContainerId } from \"./readers\";\nimport type { UnwrappedContainerKek } from \"./types\";\n\ntype ProjectionKek = ContainerWriterProjectionResponse[\"containerKeks\"][number];\ntype VerifiedManifests = ReadonlyMap<string, VerifiedContainerAccessManifest>;\n\n/** The projection proves a predecessor existed, but no retained keyring can recover it. */\nexport class ContainerKekHistoryUnavailableError extends Error {\n  constructor(label: string) {\n    super(`${label} keyring is missing`);\n    this.name = \"ContainerKekHistoryUnavailableError\";\n  }\n}\n\nexport function projectionKekLabel(index: number): string {\n  return `Container writer projection KEK[${index}]`;\n}\n\nexport async function assertUnwrappedContainerKekMatchesMaterialId(input: {\n  label: string;\n  keyMaterial: Uint8Array;\n  kek: Pick<\n    ProjectionKek,\n    \"containerId\" | \"containerKeyEpoch\" | \"containerKeyEpochId\"\n  >;\n}): Promise<void> {\n  if (!isContainerKekMaterialId(input.kek.containerKeyEpochId)) {\n    throw new Error(\n      `${input.label} KEK epoch id does not commit to key material`,\n    );\n  }\n  const expectedId = await computeContainerKekMaterialId({\n    containerId: input.kek.containerId,\n    keyEpoch: input.kek.containerKeyEpoch,\n    keyMaterial: input.keyMaterial,\n  });\n  if (expectedId !== input.kek.containerKeyEpochId) {\n    throw new Error(\n      `${input.label} KEK material does not match committed epoch id`,\n    );\n  }\n}\n\nfunction sameContainerManifestHistory(kek: ProjectionKek) {\n  return kek.containerManifestHistory.filter(\n    (bundle) => readManifestContainerId(bundle) === kek.containerId,\n  );\n}\n\n/**\n * Proves the served keyring is the one the rotation that minted the current\n * epoch committed to in its signed event body.\n */\nasync function assertKeyringCommitment(input: {\n  currentManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  index: number;\n  kek: ProjectionKek;\n  keyring: ReturnType<typeof normalizeContainerKekKeyring>;\n}): Promise<void> {\n  const rotationManifestHash = readContainerKeyEpoch(\n    input.kek.keyEpoch,\n    `${projectionKekLabel(input.index)} key epoch`,\n  ).accessManifestHash;\n  const rotationManifest =\n    rotationManifestHash === input.currentManifest.manifestHash\n      ? input.currentManifest\n      : sameContainerManifestHistory(input.kek).find(\n          (bundle) => bundle.manifestHash === rotationManifestHash,\n        );\n  if (!rotationManifest) {\n    throw new Error(\n      `${projectionKekLabel(input.index)} keyring signer is missing`,\n    );\n  }\n  const eventBundle = readCanonicalRecord(\n    rotationManifest.event,\n    `${projectionKekLabel(input.index)} keyring event`,\n  );\n  const eventBody = normalizeContainerAccessEventBody(\n    readCanonicalJson(\n      Reflect.get(eventBundle, \"body\"),\n      `${projectionKekLabel(input.index)} keyring event body`,\n    ),\n  );\n  if (\n    (eventBody.eventType !== \"container.move\" &&\n      eventBody.eventType !== \"container.rekey\" &&\n      eventBody.eventType !== \"container.revoke\") ||\n    eventBody.keyringHash !==\n      (await computeContainerKekKeyringHash(input.keyring))\n  ) {\n    throw new Error(\n      `${projectionKekLabel(input.index)} keyring does not match its signed event`,\n    );\n  }\n}\n\nasync function openVerifiedKeyringEntries(input: {\n  currentManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  index: number;\n  kek: ProjectionKek;\n  successorKeyMaterial: Uint8Array;\n  verifiedByHash: VerifiedManifests;\n  verifyKeyringCommitment: boolean;\n}): Promise<Awaited<ReturnType<typeof openContainerKekKeyring>>> {\n  const { kek } = input;\n  const keyring = normalizeContainerKekKeyring(kek.keyring);\n  if (\n    keyring.containerId !== kek.containerId ||\n    keyring.containerKeyEpochId !== kek.containerKeyEpochId\n  ) {\n    throw new Error(\n      `${projectionKekLabel(input.index)} keyring is inconsistent`,\n    );\n  }\n  if (input.verifyKeyringCommitment) {\n    await assertKeyringCommitment({\n      currentManifest: input.currentManifest,\n      index: input.index,\n      kek,\n      keyring,\n    });\n  }\n\n  let entries: Awaited<ReturnType<typeof openContainerKekKeyring>>;\n  try {\n    entries = await openContainerKekKeyring({\n      keyEpoch: kek.containerKeyEpoch,\n      keyring,\n      successorContainerKey: input.successorKeyMaterial,\n    });\n  } catch (error) {\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    // Label opaque AEAD failures; structural verification errors already\n    // carry their own diagnosis.\n    throw new Error(\n      `${projectionKekLabel(input.index)} keyring could not be opened`,\n      { cause: error },\n    );\n  }\n  // Per-entry material-id verification proves an entry's key matches the id\n  // it declares, but a poisoned keyring can declare a self-consistent FAKE\n  // id — fresh key, matching commitment — for an epoch the container never\n  // had. Anchor every entry the projection can name to the epoch id its\n  // signed history actually committed; anything else is a forged epoch.\n  await verifyContainerKekEntries(kek.containerId, entries);\n\n  // Every epoch id the signed manifest history names must be present in the\n  // keyring. A forged entry can be self-consistent, but it cannot also make\n  // the real epoch id — which a signed state already named — disappear.\n  const entryEpochIds = new Set(\n    entries.map((entry) => entry.containerKeyEpochId),\n  );\n  const signedEpochIds = signedHistoryEpochIds({\n    headManifestHash: input.currentManifest.manifestHash,\n    kek,\n    verifiedByHash: input.verifiedByHash,\n  });\n  for (const historicalEpochId of signedEpochIds) {\n    if (!entryEpochIds.has(historicalEpochId)) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        `${projectionKekLabel(input.index)} keyring omits an epoch its manifest history commits to`,\n      );\n    }\n  }\n  return entries;\n}\n\n/**\n * Epoch ids named by verified historical manifest states for this container.\n * Those states are signed, so an id they name is an epoch the container\n * provably had — and a keyring that omits it in favor of a forged id for the\n * same position is detectable even when no epoch RECORD was shipped.\n */\nexport function manifestHistoryEpochIds(kek: ProjectionKek): Set<string> {\n  const epochIds = new Set<string>();\n  for (const bundle of sameContainerManifestHistory(kek)) {\n    const state = readCanonicalRecord(\n      bundle.state,\n      \"Container writer projection historical manifest state\",\n    );\n    const containerKeyEpochId = Reflect.get(state, \"containerKeyEpochId\");\n    if (\n      typeof containerKeyEpochId === \"string\" &&\n      containerKeyEpochId !== kek.containerKeyEpochId\n    ) {\n      epochIds.add(containerKeyEpochId);\n    }\n  }\n  return epochIds;\n}\n\n/**\n * The epoch ids this KEK's own history names, plus every one its head's\n * verified lineage names wherever the projection served it. Verification pools\n * every KEK's history, so a server can serve a container's older manifests\n * under another KEK; walking the lineage keeps a forged keyring id from passing\n * because the real id it displaces moved (#2365 finding 32). The walk stops at\n * the first manifest verification did not record, so it only ever adds ids.\n */\nexport function signedHistoryEpochIds(input: {\n  readonly headManifestHash: string;\n  readonly kek: ProjectionKek;\n  readonly verifiedByHash: VerifiedManifests;\n}): Set<string> {\n  const epochIds = manifestHistoryEpochIds(input.kek);\n  const visited = new Set<string>();\n  let current = input.verifiedByHash.get(input.headManifestHash);\n  while (\n    current &&\n    current.state.containerId === input.kek.containerId &&\n    !visited.has(current.manifestHash)\n  ) {\n    visited.add(current.manifestHash);\n    const epochId = current.state.containerKeyEpochId;\n    if (epochId !== null && epochId !== input.kek.containerKeyEpochId) {\n      epochIds.add(epochId);\n    }\n    const previousHash = current.state.previousManifestHash;\n    current =\n      previousHash === null\n        ? undefined\n        : input.verifiedByHash.get(previousHash);\n  }\n  return epochIds;\n}\n\nfunction admitKeyringEntry(input: {\n  entry: Awaited<ReturnType<typeof openContainerKekKeyring>>[number];\n  index: number;\n  kek: ProjectionKek;\n  keksByEpochId: Map<string, UnwrappedContainerKek>;\n}): void {\n  const { entry, kek } = input;\n  const cached = input.keksByEpochId.get(entry.containerKeyEpochId);\n  if (cached) {\n    if (cached.containerId !== kek.containerId) {\n      throw new Error(\n        `${projectionKekLabel(input.index)} cached historical KEK is inconsistent`,\n      );\n    }\n    return;\n  }\n  input.keksByEpochId.set(entry.containerKeyEpochId, {\n    containerId: kek.containerId,\n    // A keyring entry is key material plus the epoch id that commits to it —\n    // there is no epoch record, so no fingerprint. Selection falls back to the\n    // epoch id and AEAD authenticates; the commitment check above is what\n    // makes the material itself trustworthy.\n    keyEpochHash: null,\n    keyMaterial: entry.keyMaterial,\n  });\n}\n\n/**\n * Opens the sealed keyring for one path index and admits every entry into\n * `keksByEpochId` after verifying it against the material-id commitment its\n * ordinal position implies (entry i is key epoch i + 1). No chain walk:\n * one decrypt yields the container's complete retained history, and entry\n * verification is independent per entry.\n */\nexport async function unwrapKeyringContainerKeksAtIndex(input: {\n  currentManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  index: number;\n  kek: ProjectionKek;\n  keksByEpochId: Map<string, UnwrappedContainerKek>;\n  successorKeyMaterial: Uint8Array | null;\n  /** Every manifest projection verification recorded; anchors the keyring. */\n  verifiedByHash: VerifiedManifests;\n  verifyKeyringCommitment: boolean;\n}): Promise<void> {\n  const { kek, successorKeyMaterial } = input;\n  if (!successorKeyMaterial) {\n    return;\n  }\n\n  if (kek.keyring === null) {\n    if (kek.containerKeyEpoch !== 1) {\n      throw new ContainerKekHistoryUnavailableError(\n        projectionKekLabel(input.index),\n      );\n    }\n    return;\n  }\n\n  const entries = await openVerifiedKeyringEntries({\n    currentManifest: input.currentManifest,\n    index: input.index,\n    kek,\n    successorKeyMaterial,\n    verifiedByHash: input.verifiedByHash,\n    verifyKeyringCommitment: input.verifyKeyringCommitment,\n  });\n  for (const entry of entries) {\n    admitKeyringEntry({\n      entry,\n      index: input.index,\n      kek,\n      keksByEpochId: input.keksByEpochId,\n    });\n  }\n}\n\n/**\n * Epoch ids this projection implies exist but that were not recovered —\n * used to attribute history failures to the material they orphan.\n */\nexport function projectedUnreachablePredecessorEpochIds(input: {\n  kek: ProjectionKek;\n  keksByEpochId: ReadonlyMap<string, UnwrappedContainerKek>;\n}): string[] {\n  const projectedEpochIds = new Set<string>();\n  for (const bundle of sameContainerManifestHistory(input.kek)) {\n    const state = readCanonicalRecord(\n      bundle.state,\n      \"Container writer projection historical manifest state\",\n    );\n    const containerKeyEpochId = Reflect.get(state, \"containerKeyEpochId\");\n    if (typeof containerKeyEpochId === \"string\") {\n      projectedEpochIds.add(containerKeyEpochId);\n    }\n  }\n  projectedEpochIds.delete(input.kek.containerKeyEpochId);\n  return [...projectedEpochIds].filter(\n    (containerKeyEpochId) => !input.keksByEpochId.has(containerKeyEpochId),\n  );\n}\n"]}

package/data/documents/shared/containerKekPathVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerKekPathVerification.js","sourceRoot":"","sources":["containerKekPathVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iDAAiD,GAElD,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAYpD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkC;IAElC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,GAAG,yBAAyB,CACxD,KAAK,EACL,sBAAsB,CACvB,CAAC;IACF,IACE,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACrC,wBAAwB,KAAK,IAAI,EACjC,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../keyingProjectionVerification\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { resolveProjectionVerifier } from \"./types\";\n\nexport type UnwrapContainerKekPathInput = {\n  execSql?: ExecSql | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  projection: ContainerWriterProjectionResponse;\n  secretKey: Uint8Array;\n  verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n} & ProjectionVerificationOptions;\n\nexport async function verifyContainerKekPathProjection(\n  input: UnwrapContainerKekPathInput,\n): Promise<void> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n  const resolveProjectionUserKey = resolveProjectionVerifier(\n    input,\n    \"Container KEK unwrap\",\n  );\n  if (\n    input.trustedLocalProjection === true ||\n    resolveProjectionUserKey === null\n  ) {\n    return;\n  }\n\n  await collectContainerWriterProjectionPrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.projection,\n    resolveUserKey: resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    verifiedByHash: input.verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/documents/shared/containerKekWrapping.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerKekWrapping.js","sourceRoot":"","sources":["containerKekWrapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAGpD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAKtD;IACC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAC7C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,eAAe;IACf,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,WAAW;QAClC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC1C,IAAI,CAAC,mBAAmB,KAAK,KAAK,CAAC,yBAAyB;QAC5D,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI;YAC9B,IAAI,CAAC,uBAAuB,KAAK,SAAS,CAAC,YAAY,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,iBAAiB,EAAE,SAAS,CAAC,WAAW;YACxC,iBAAiB,EAAE,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,EAAE;YACnE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAA6C,EAC7C,KAAa,EACb,WAAuB;IAEvB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC;QAC1D,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,kDAAkD,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ContainerKeyWrap,\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { projectionKekLabel } from \"./containerKekPathHistory\";\nimport { readManifestContainerId } from \"./readers\";\nimport type { UnwrappedContainerKek } from \"./types\";\n\nexport async function unwrapContainerKekFromParentWrap(input: {\n  label: string;\n  parentContainerKeyEpochId: string | null;\n  parentKeksByEpochId: ReadonlyMap<string, UnwrappedContainerKek>;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<Uint8Array | null> {\n  if (!input.parentContainerKeyEpochId) {\n    return null;\n  }\n\n  const parentKek = input.parentKeksByEpochId.get(\n    input.parentContainerKeyEpochId,\n  );\n  if (!parentKek) {\n    return null;\n  }\n\n  // The epoch-record fingerprint is a SELECTOR for picking the right envelope\n  // among several, not the security boundary — the AEAD tag below is what\n  // authenticates the parent key. Keyring-recovered historical KEKs carry no\n  // epoch record (only the material and the epoch id that commits to it), so\n  // for those the epoch id alone selects and decryption authenticates.\n  //\n  // Without this, an ancestor rotation would strand every descendant still\n  // pinned to the predecessor epoch: opening the descendant requires the\n  // parent's historical KEK, and that is exactly the key a lazy rekey needs in\n  // order to materialize a post-rotation epoch. A cold client would have no\n  // way back in.\n  const parentWrap = input.wraps.find(\n    (wrap) =>\n      wrap.recipientKind === \"container\" &&\n      wrap.recipientId === parentKek.containerId &&\n      wrap.recipientKeyEpochId === input.parentContainerKeyEpochId &&\n      (parentKek.keyEpochHash === null ||\n        wrap.recipientKeyFingerprint === parentKek.keyEpochHash),\n  );\n  if (!parentWrap) {\n    return null;\n  }\n\n  try {\n    return await unwrapContainerKekParentWrap({\n      parentContainerId: parentKek.containerId,\n      parentKeyMaterial: parentKek.keyMaterial,\n      kemCipherText: parentWrap.kemCipherText,\n      wrappedKey: parentWrap.wrappedKey,\n    });\n  } catch (error) {\n    throw new Error(`${input.label} parent wrap could not be unwrapped`, {\n      cause: error,\n    });\n  }\n}\n\nexport async function assertSignedWrappingPublicKey(\n  projection: ContainerWriterProjectionResponse,\n  index: number,\n  keyMaterial: Uint8Array,\n): Promise<void> {\n  const manifest = projection.path[index];\n  if (!manifest || !isPlainRecord(manifest.state))\n    throw new Error(\"Container manifest is missing\");\n  const containerId = readManifestContainerId(manifest);\n  if (!containerId) throw new Error(\"Container manifest ID is missing\");\n  const publicKey = await deriveContainerKekWrappingPublicKey({\n    containerId,\n    keyMaterial,\n  });\n  if (Reflect.get(manifest.state, \"containerKeyPublicKey\") !== publicKey) {\n    throw new Error(\n      `${projectionKekLabel(index)} wrapping public key does not match KEK material`,\n    );\n  }\n}\n"]}

package/data/documents/shared/documentSyncUpdateDecryption.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentSyncUpdateDecryption.js","sourceRoot":"","sources":["documentSyncUpdateDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,qCAAqC,EACrC,8BAA8B,GAE/B,MAAM,SAAS,CAAC;AAIjB,SAAS,4BAA4B,CACnC,aAAqB;IAErB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,oBAAoB,CAClB,KAAK,EACL,8BAA8B,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,2BAA2B,CAAC;QAC9D,qCAAqC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CACvC,KAAK,EACL,SAAS,EACT,2BAA2B,CAC5B,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,yBAAyB,CACtE,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,2BAA2B,CAAC;QACvE,+BAA+B,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CACtB,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAC3D,CAAC;IACF,cAAc,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;IAC9D,OAAO;QACL,UAAU,EAAE,aAAa,CACvB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,2BAA2B,CAAC,CACnE;QACD,eAAe,EAAE,yBAAyB,CACxC,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,YAAY,EAAE,gBAAgB,CAC5B,KAAK,EACL,cAAc,EACd,2BAA2B,CAC5B;QACD,eAAe,EAAE,gBAAgB,CAC/B,KAAK,EACL,iBAAiB,EACjB,2BAA2B,CAC5B;QACD,EAAE;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAOzD;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,qBAAqB,GACzB,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,qBAAqB,KAAK,SAAS;QAC1C,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC;IAC3C,IACE,qBAAqB;QACrB,CAAC,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC1C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB;YACxD,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,mBAAmB,CAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,uBAAuB,CAC/B,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,SAAS,CAAC,eAAe;QACzB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,YAAY,KAAK,YAAY;QACvC,SAAS,CAAC,YAAY;YACpB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IACE,SAAS,CAAC,eAAe,KAAK,eAAe;QAC7C,SAAS,CAAC,eAAe;YACvB,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,0CAA0C,CAAC;YAC/C,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,MAA0B;IAE1B,IAAI,eAAuB,CAAC;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,MAAM;YACtB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,2BAA2B,CAAC;QAChC,eAAe;QACf,UAAU;QACV,cAAc;QACd,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAO7B;IACC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;YAChD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,8BAA8B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACjE,8BAA8B,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,cAAc,EAAE,gCAAgC,CAAC;gBAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;gBAC1C,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAC7C,CACF,CAAC;QACF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iCAAiC,CACrC,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,qCAAqC,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACnB,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import {\n  assertAesGcmIv,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport { versionVectorsEqual } from \"@tearleads/loro\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { contentRecordAdditionalDataBytes } from \"./contentRecordAdditionalData\";\nimport {\n  deriveDocumentContentRecordKey,\n  deriveDocumentPlaintextHashKey,\n} from \"./contentRecordKeys\";\nimport { isolateDocumentSyncUpdateError } from \"./documentSyncUpdateIsolation\";\nimport { assertDecryptedDocumentUpdateMetadata } from \"./documentUpdateIntegrity\";\nimport { assertDocumentUpdatePlaintextHash } from \"./plaintextHash\";\nimport {\n  assertOnlyRecordKeys,\n  asWebCryptoBytes,\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n} from \"./readers\";\nimport {\n  type DecryptedDocumentSyncUpdate,\n  DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n  DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n  type ParsedDocumentEncryptedUpdate,\n} from \"./types\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\n\nfunction parseDocumentEncryptedUpdate(\n  encryptedData: string,\n): ParsedDocumentEncryptedUpdate {\n  let value: unknown;\n  try {\n    value = JSON.parse(encryptedData);\n  } catch {\n    throw new Error(\"Document encrypted update is invalid JSON\");\n  }\n  if (!isPlainRecord(value)) {\n    throw new Error(\"Document encrypted update must be an object\");\n  }\n  assertOnlyRecordKeys(\n    value,\n    DOCUMENT_ENCRYPTED_UPDATE_KEYS,\n    \"Document encrypted update\",\n  );\n  if (\n    readRecordString(value, \"format\", \"Document encrypted update\") !==\n    DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT\n  ) {\n    throw new Error(\"Document encrypted update format is invalid\");\n  }\n  const version = readRecordPositiveInteger(\n    value,\n    \"version\",\n    \"Document encrypted update\",\n  );\n  if (version !== 1) {\n    throw new Error(\n      `Document encrypted update version ${version} is invalid; expected 1`,\n    );\n  }\n  if (\n    readRecordString(value, \"encryptionSuite\", \"Document encrypted update\") !==\n    CONTENT_RECORD_ENCRYPTION_SUITE\n  ) {\n    throw new Error(\"Document encrypted update suite is invalid\");\n  }\n\n  const iv = base64ToBytes(\n    readRecordString(value, \"iv\", \"Document encrypted update\"),\n  );\n  assertAesGcmIv(iv, \"Document encrypted update IV is invalid\");\n  return {\n    ciphertext: base64ToBytes(\n      readRecordString(value, \"ciphertext\", \"Document encrypted update\"),\n    ),\n    contentKeyEpoch: readRecordPositiveInteger(\n      value,\n      \"contentKeyEpoch\",\n      \"Document encrypted update\",\n    ),\n    contentRecordId: readRecordString(\n      value,\n      \"contentRecordId\",\n      \"Document encrypted update\",\n    ),\n    metadataHash: readRecordString(\n      value,\n      \"metadataHash\",\n      \"Document encrypted update\",\n    ),\n    nonceDomainHash: readRecordString(\n      value,\n      \"nonceDomainHash\",\n      \"Document encrypted update\",\n    ),\n    iv,\n  };\n}\n\nasync function assertDocumentEncryptedUpdateMatchesHeader(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  encryptedData: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<void> {\n  const { encrypted, update } = input;\n  const hasCheckpointMetadata =\n    update.checkpointKind !== undefined ||\n    update.checkpointPayloadKind !== undefined ||\n    update.sourceVersionVector !== undefined;\n  if (\n    hasCheckpointMetadata &&\n    (update.checkpointKind !== \"rotate_baseline\" ||\n      update.checkpointPayloadKind !== \"full_history_snapshot\" ||\n      !update.sourceVersionVector ||\n      !versionVectorsEqual(\n        update.sourceVersionVector,\n        update.partialEndVersionVector,\n      ))\n  ) {\n    throw new Error(\"Document rotation checkpoint metadata mismatch\");\n  }\n  if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {\n    throw new Error(\"Document encrypted update content-key epoch mismatch\");\n  }\n  if (update.documentId !== input.documentId) {\n    throw new Error(\"Document encrypted update document id mismatch\");\n  }\n  if (\n    encrypted.contentRecordId !==\n    readRecordString(update.writeHeader, \"contentRecordId\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update content record mismatch\");\n  }\n\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: input.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    encrypted.metadataHash !== metadataHash ||\n    encrypted.metadataHash !==\n      readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update metadata hash mismatch\");\n  }\n\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: encrypted.contentRecordId,\n  });\n  if (\n    encrypted.nonceDomainHash !== nonceDomainHash ||\n    encrypted.nonceDomainHash !==\n      readRecordString(update.writeHeader, \"nonceDomainHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update nonce domain mismatch\");\n  }\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    input.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document encrypted update ciphertext hash mismatch\");\n  }\n}\n\nasync function verifiedEncryptedSyncUpdate(input: {\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<ParsedDocumentEncryptedUpdate> {\n  try {\n    const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);\n    await assertDocumentEncryptedUpdateMatchesHeader({\n      encrypted,\n      encryptedData: input.update.encryptedData,\n      ...input,\n    });\n    return encrypted;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"encrypted_record\",\n      updateId: input.update.id,\n    });\n  }\n}\n\n/** Verifies the encrypted record's structure and every binding to its header. */\nexport async function assertDocumentSyncUpdateEncryptedRecord(\n  update: SyncResponseUpdate,\n): Promise<void> {\n  let contentKeyEpoch: number;\n  let documentId: string;\n  let organizationId: string;\n  try {\n    const header = readWriteHeader(\n      update.writeHeader,\n      \"Document sync response write header\",\n    );\n    if (header.objectKind !== \"document\") {\n      throw new Error(\"Document sync response write header kind mismatch\");\n    }\n    contentKeyEpoch = header.contentKeyEpoch;\n    documentId = header.objectId;\n    organizationId = header.organizationId;\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: update,\n      stage: \"write_header\",\n      updateId: update.id,\n    });\n  }\n  await verifiedEncryptedSyncUpdate({\n    contentKeyEpoch,\n    documentId,\n    organizationId,\n    update,\n  });\n}\n\nasync function decryptPayload(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  encrypted: ParsedDocumentEncryptedUpdate;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<{ plaintextHashKey: CryptoKey; updateData: Uint8Array }> {\n  try {\n    const keyInput = {\n      contentKeyMaterial: input.contentKeyMaterial,\n      contentKeyEpoch: input.contentKeyEpoch,\n      contentRecordId: input.encrypted.contentRecordId,\n      documentId: input.documentId,\n      organizationId: input.organizationId,\n    };\n    const [recordKey, plaintextHashKey] = await Promise.all([\n      deriveDocumentContentRecordKey({ ...keyInput, usage: \"decrypt\" }),\n      deriveDocumentPlaintextHashKey(keyInput),\n    ]);\n    const updateData = new Uint8Array(\n      await crypto.subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: asWebCryptoBytes(input.encrypted.iv),\n          additionalData: contentRecordAdditionalDataBytes({\n            contentKeyEpoch: input.contentKeyEpoch,\n            contentRecordId: input.encrypted.contentRecordId,\n            documentId: input.documentId,\n            metadataHash: input.encrypted.metadataHash,\n            nonceDomainHash: input.encrypted.nonceDomainHash,\n            organizationId: input.organizationId,\n          }),\n        },\n        recordKey,\n        asWebCryptoBytes(input.encrypted.ciphertext),\n      ),\n    );\n    return { plaintextHashKey, updateData };\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"decrypt\",\n      updateId: input.update.id,\n    });\n  }\n}\n\nexport async function decryptDocumentSyncUpdate(input: {\n  contentKeyEpoch: number;\n  contentKeyMaterial: CryptoKey;\n  documentId: string;\n  organizationId: string;\n  update: SyncResponseUpdate;\n}): Promise<DecryptedDocumentSyncUpdate> {\n  const encrypted = await verifiedEncryptedSyncUpdate(input);\n  const { plaintextHashKey, updateData } = await decryptPayload({\n    ...input,\n    encrypted,\n  });\n  try {\n    await assertDocumentUpdatePlaintextHash(\n      updateData,\n      input.update.plaintextHash,\n      plaintextHashKey,\n    );\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"plaintext_integrity\",\n      updateId: input.update.id,\n    });\n  }\n  try {\n    assertDecryptedDocumentUpdateMetadata(updateData, input.update);\n  } catch (error) {\n    throw isolateDocumentSyncUpdateError({\n      cause: error,\n      responseUpdate: input.update,\n      stage: \"loro_metadata\",\n      updateId: input.update.id,\n    });\n  }\n  return {\n    ...(input.update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: input.update.checkpointKind }),\n    ...(input.update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: input.update.checkpointPayloadKind }),\n    id: input.update.id,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    ...(input.update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: input.update.sourceVersionVector }),\n    updateData,\n  };\n}\n"]}

package/data/documents/shared/documentSyncUpdateIsolation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentSyncUpdateIsolation.js","sourceRoot":"","sources":["documentSyncUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAMxD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsC,EACtC,KAAa;IAEb,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC;IAEtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,WAAW,CAAqB;IAChC,iBAAiB,CAAgB;IACjC,cAAc,CAAoB;IAClC,cAAc,CAA2B;IACzC,cAAc,CAAgB;IAC9B,eAAe,CAAgB;IAC/B,UAAU,CAAgB;IAC1B,YAAY,CAAgB;IAC5B,KAAK,CAAmC;IACxC,QAAQ,CAAgB;IACxB,YAAY,CAAgB;IAErC,YAAY,KAMX;QACC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,oBAAoB,CACvC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,MAAM,MAAM,GACV,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,6BAA6B,cAAc,CAAC,MAAM,2CAA2C;YAC/F,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,gBAAgB,MAAM,iBAAiB,WAAW,WAAW,KAAK,GAAG,CAAC;QACpG,KAAK,CACH,6BAA6B,OAAO,WAAW,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc;YACjB,KAAK,CAAC,cAAc,EAAE,cAAc,KAAK,iBAAiB;gBACxD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc,GAAG,oBAAoB,CACxC,KAAK,CAAC,cAAc,EACpB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,oBAAoB,CACtC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,IAAI,gCAAgC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,OAAO,KAAK,CAAC,KAAK,YAAY,gCAAgC;QAC5D,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,OAAO,KAAK,YAAY,gCAAgC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkD;IAElD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CACnE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mFAAmF,CACpF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,8BAA8B,CAAC;YACnC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA+C;IAK/C,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC3C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB,EACxD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAAsB,EACtB,OAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAC/D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,0CAA0C,CAAC;gBACzC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,IACE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChC,+BAA+B,GAAG,UAAU,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,WAAW,KAAK,cAAc;gBAAE,SAAS;YAC7C,IACE,MAAM,CAAC,UAAU,CAAC,UAAU;gBAC5B,+BAA+B,GAAG,UAAU,EAC5C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwB,EACxB,YAAwE;IAExE,IAAI,kBAAkB,GAAa,IAAI,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;YAClD,kBAAkB,GAAG,SAAS,CAAC;YAC/B,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhD,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C,sBAAsB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CACd,mDAAmD,iBAAiB,EAAE,CACvE;YACD,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,eAAe;YACf,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,gBAAgB;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kCAAkC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,UAAU,YAAY,qCAAqC,EAAE,CAAC;QAChE,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IACE,gCAAgC,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,eAAe;KAChB,CAAC,EACF,CAAC;QACD,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,KAAK,CAAC,gBAAgB,EACtB,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc,CACnD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,4BAA4B,CAAC;gBACjC,eAAe;gBACf,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,cAAc,CAAC,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createDocument,\n  exportFullHistorySnapshot,\n  importSnapshot,\n  importUpdates,\n  LoroImportUnresolvedDependenciesError,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type {\n  DecryptedDocumentSyncUpdate,\n  SyncRemoteDocumentResult,\n} from \"./types\";\n\ntype DocumentSyncUpdateIsolationStage =\n  | \"content_key\"\n  | \"decrypt\"\n  | \"encrypted_record\"\n  | \"loro_import\"\n  | \"loro_metadata\"\n  | \"plaintext_integrity\"\n  | \"write_header\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype SyncDocument = Awaited<ReturnType<typeof createDocument>>;\n\nconst MAX_EXACT_ISOLATION_CANDIDATES = 8;\nconst MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;\n\nexport type IncomingDocumentSyncUpdateValidator = (\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n) => void | Promise<void>;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction optionalHeaderField(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): unknown {\n  const header = update?.writeHeader;\n  return header && typeof header === \"object\"\n    ? Reflect.get(header, field)\n    : undefined;\n}\n\nfunction optionalHeaderString(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): string | null {\n  const value = optionalHeaderField(update, field);\n  return typeof value === \"string\" ? value : null;\n}\n\nfunction optionalHeaderEpoch(\n  update: SyncResponseUpdate | undefined,\n): number | null {\n  const value = optionalHeaderField(update, \"contentKeyEpoch\");\n  return typeof value === \"number\" && Number.isSafeInteger(value)\n    ? value\n    : null;\n}\n\nexport class DocumentSyncUpdateIsolationError extends Error {\n  readonly attribution: \"batch\" | \"update\";\n  readonly authorFingerprint: string | null;\n  readonly batchUpdateIds: readonly string[];\n  readonly checkpointKind: \"rotate_baseline\" | null;\n  readonly ciphertextHash: string | null;\n  readonly contentKeyEpoch: number | null;\n  readonly documentId: string | null;\n  readonly metadataHash: string | null;\n  readonly stage: DocumentSyncUpdateIsolationStage;\n  readonly updateId: string | null;\n  readonly writerUserId: string | null;\n\n  constructor(input: {\n    batchUpdateIds?: readonly string[] | undefined;\n    cause: unknown;\n    responseUpdate?: SyncResponseUpdate | undefined;\n    stage: DocumentSyncUpdateIsolationStage;\n    updateId: string | null;\n  }) {\n    const causeMessage = errorMessage(input.cause);\n    const writerUserId = optionalHeaderString(\n      input.responseUpdate,\n      \"writerUserId\",\n    );\n    const author =\n      writerUserId ?? input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const fingerprint = input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const epoch = optionalHeaderEpoch(input.responseUpdate) ?? \"unknown\";\n    const batchUpdateIds =\n      input.updateId === null ? (input.batchUpdateIds ?? []) : [];\n    const subject =\n      input.updateId === null\n        ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`\n        : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;\n    super(\n      `Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`,\n      { cause: input.cause },\n    );\n    this.name = \"DocumentSyncUpdateIsolationError\";\n    this.attribution = input.updateId === null ? \"batch\" : \"update\";\n    this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;\n    this.batchUpdateIds = [...batchUpdateIds];\n    this.checkpointKind =\n      input.responseUpdate?.checkpointKind === \"rotate_baseline\"\n        ? \"rotate_baseline\"\n        : null;\n    this.ciphertextHash = optionalHeaderString(\n      input.responseUpdate,\n      \"ciphertextHash\",\n    );\n    this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);\n    this.documentId = input.responseUpdate?.documentId ?? null;\n    this.metadataHash = optionalHeaderString(\n      input.responseUpdate,\n      \"metadataHash\",\n    );\n    this.stage = input.stage;\n    this.updateId = input.updateId;\n    this.writerUserId = writerUserId;\n  }\n}\n\nexport function isolateDocumentSyncBatchError(input: {\n  cause: unknown;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateIds: readonly string[];\n}): DocumentSyncUpdateIsolationError {\n  return new DocumentSyncUpdateIsolationError({\n    batchUpdateIds: input.updateIds,\n    cause: input.cause,\n    stage: input.stage,\n    updateId: null,\n  });\n}\n\nexport function isolateDocumentSyncUpdateError(input: {\n  cause: unknown;\n  responseUpdate?: SyncResponseUpdate | undefined;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateId: string;\n}): DocumentSyncUpdateIsolationError {\n  return input.cause instanceof DocumentSyncUpdateIsolationError\n    ? input.cause\n    : new DocumentSyncUpdateIsolationError(input);\n}\n\nexport function isDocumentSyncUpdateIsolationError(\n  error: unknown,\n): error is DocumentSyncUpdateIsolationError {\n  return error instanceof DocumentSyncUpdateIsolationError;\n}\n\nfunction responseUpdatesById(\n  updates: readonly SyncResponseUpdate[] | undefined,\n): ReadonlyMap<string, SyncResponseUpdate> {\n  return new Map((updates ?? []).map((update) => [update.id, update]));\n}\n\nfunction firstDuplicateUpdateId(\n  updates: readonly { readonly id: string }[],\n): string | null {\n  const seen = new Set<string>();\n  for (const update of updates) {\n    if (seen.has(update.id)) return update.id;\n    seen.add(update.id);\n  }\n  return null;\n}\n\nfunction assertImportedUpdatesMatchValidatedHistory(input: {\n  document: SyncDocument;\n  responseById: ReadonlyMap<string, SyncResponseUpdate>;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): void {\n  const collisions = input.updates.filter(\n    (update) =>\n      !updateMatchesDocumentHistory(input.document, update.updateData),\n  );\n  if (collisions.length === 0) return;\n  const cause = new Error(\n    \"incoming Loro update reuses an already-covered frontier with different operations\",\n  );\n  const [collision] = collisions;\n  if (input.updates.length === 1 && collision) {\n    throw isolateDocumentSyncUpdateError({\n      cause,\n      responseUpdate: input.responseById.get(collision.id),\n      stage: \"loro_import\",\n      updateId: collision.id,\n    });\n  }\n  throw isolateDocumentSyncBatchError({\n    cause,\n    stage: \"loro_import\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nasync function createValidationDocument(snapshot: Uint8Array) {\n  const document = await createDocument(crypto.randomUUID());\n  try {\n    importSnapshot(document, snapshot);\n    return document;\n  } catch (error) {\n    document.free();\n    throw error;\n  }\n}\n\nfunction splitDocumentSyncUpdates(\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): {\n  checkpoints: DecryptedDocumentSyncUpdate[];\n  ordinaryUpdates: DecryptedDocumentSyncUpdate[];\n} {\n  const checkpoints: DecryptedDocumentSyncUpdate[] = [];\n  const ordinaryUpdates: DecryptedDocumentSyncUpdate[] = [];\n  for (const update of updates) {\n    if (\n      update.checkpointKind === \"rotate_baseline\" &&\n      update.checkpointPayloadKind === \"full_history_snapshot\"\n    ) {\n      checkpoints.push(update);\n    } else {\n      ordinaryUpdates.push(update);\n    }\n  }\n  return { checkpoints, ordinaryUpdates };\n}\n\n/** Applies checkpoints with the snapshot API before batching ordinary deltas. */\nexport function importDecryptedDocumentSyncUpdates(\n  document: SyncDocument,\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): void {\n  const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);\n  for (const checkpoint of checkpoints) {\n    importSnapshot(document, checkpoint.updateData);\n  }\n  if (ordinaryUpdates.length > 0) {\n    importUpdates(\n      document,\n      ordinaryUpdates.map((update) => update.updateData),\n    );\n  }\n}\n\nasync function validateDecryptedUpdateBatch(input: {\n  currentSnapshot: Uint8Array;\n  responseById?: ReadonlyMap<string, SyncResponseUpdate> | undefined;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): Promise<void> {\n  const document = await createValidationDocument(input.currentSnapshot);\n  try {\n    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(\n      input.updates,\n    );\n    for (const checkpoint of checkpoints) {\n      importSnapshot(document, checkpoint.updateData);\n    }\n    if (ordinaryUpdates.length > 0) {\n      importUpdates(\n        document,\n        ordinaryUpdates.map((update) => update.updateData),\n      );\n    }\n    if (input.responseById) {\n      // Validate against the completed scratch history, not only the live\n      // pre-page frontier. If two updates in this page reuse one peer/counter\n      // with different operations, Loro accepts one and treats the other as a\n      // no-op; only the accepted history can match both when they are equal.\n      assertImportedUpdatesMatchValidatedHistory({\n        document,\n        responseById: input.responseById,\n        updates: input.updates,\n      });\n    }\n  } finally {\n    document.free();\n  }\n}\n\nfunction exactIsolationRetryExceedsBudget(input: {\n  candidates: readonly DecryptedDocumentSyncUpdate[];\n  currentSnapshot: Uint8Array;\n}): boolean {\n  if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES) return true;\n\n  let retryBytes = 0;\n  for (const candidateIndex of input.candidates.keys()) {\n    if (\n      input.currentSnapshot.byteLength >\n      MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n    ) {\n      return true;\n    }\n    retryBytes += input.currentSnapshot.byteLength;\n    for (const [updateIndex, update] of input.candidates.entries()) {\n      if (updateIndex === candidateIndex) continue;\n      if (\n        update.updateData.byteLength >\n        MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n      ) {\n        return true;\n      }\n      retryBytes += update.updateData.byteLength;\n    }\n  }\n  return false;\n}\n\n/** @internal Exported only to exercise the bounded exact-attribution policy. */\nexport async function findUniqueRepairingCandidate<T>(\n  candidates: readonly T[],\n  repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>,\n): Promise<T | null> {\n  let repairingCandidate: T | null = null;\n  let repairingCandidateCount = 0;\n  for (const [candidateIndex, candidate] of candidates.entries()) {\n    if (await repairsBatch(candidate, candidateIndex)) {\n      repairingCandidate = candidate;\n      repairingCandidateCount += 1;\n    }\n  }\n  return repairingCandidateCount === 1 ? repairingCandidate : null;\n}\n\n/**\n * Proves that a decrypted response can be imported before the live document or\n * any durable sync frontier is mutated. On failure, retries the page without\n * each candidate so valid sibling dependencies remain in the same batch while\n * the update whose removal repairs the batch is attributed exactly.\n */\nexport async function validateDocumentSyncUpdateImports(input: {\n  currentDocument: Awaited<ReturnType<typeof createDocument>>;\n  decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];\n  responseUpdates?: readonly SyncResponseUpdate[] | undefined;\n}): Promise<void> {\n  if (input.decryptedUpdates.length === 0) return;\n\n  const duplicateUpdateId =\n    firstDuplicateUpdateId(input.decryptedUpdates) ??\n    firstDuplicateUpdateId(input.responseUpdates ?? []);\n  if (duplicateUpdateId !== null) {\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\n        `Document sync response update id is duplicated: ${duplicateUpdateId}`,\n      ),\n      stage: \"encrypted_record\",\n      updateIds: (input.responseUpdates ?? input.decryptedUpdates).map(\n        (update) => update.id,\n      ),\n    });\n  }\n\n  const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);\n  const responseById = responseUpdatesById(input.responseUpdates);\n  let batchError: unknown;\n  try {\n    await validateDecryptedUpdateBatch({\n      currentSnapshot,\n      responseById,\n      updates: input.decryptedUpdates,\n    });\n    return;\n  } catch (error) {\n    if (isDocumentSyncUpdateIsolationError(error)) throw error;\n    batchError = error;\n  }\n\n  // A delta can be valid but depend on a parent omitted from this response\n  // page. Removing that delta would make an empty retry succeed and falsely\n  // identify its authenticated writer as poison, so dependency gaps remain\n  // anonymous at batch scope.\n  if (batchError instanceof LoroImportUnresolvedDependenciesError) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  if (\n    exactIsolationRetryExceedsBudget({\n      candidates: input.decryptedUpdates,\n      currentSnapshot,\n    })\n  ) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  // Rebuild from the same immutable snapshot for every candidate: a failed\n  // import may partially mutate its scratch document. Checkpoints participate\n  // alongside ordinary updates so an incompatibility between the two kinds\n  // cannot falsely blame the ordinary writer. Keeping every other update in\n  // one batch also preserves out-of-order sibling dependencies.\n  const isolatedUpdate = await findUniqueRepairingCandidate(\n    input.decryptedUpdates,\n    async (_update, candidateIndex) => {\n      const withoutCandidate = input.decryptedUpdates.filter(\n        (_, updateIndex) => updateIndex !== candidateIndex,\n      );\n      try {\n        await validateDecryptedUpdateBatch({\n          currentSnapshot,\n          updates: withoutCandidate,\n        });\n        return true;\n      } catch {\n        // This candidate is either valid and required by a sibling, or another\n        // poison update remains. Continue without attributing it.\n        return false;\n      }\n    },\n  );\n  if (isolatedUpdate) {\n    throw isolateDocumentSyncUpdateError({\n      cause: batchError,\n      responseUpdate: responseById.get(isolatedUpdate.id),\n      stage: \"loro_import\",\n      updateId: isolatedUpdate.id,\n    });\n  }\n\n  // Multiple bad updates or a batch-level incompatibility may have zero or\n  // multiple removals that repair the page. Fail closed without falsely naming\n  // a valid writer; no live or durable state has changed.\n  throw isolateDocumentSyncBatchError({\n    cause: batchError,\n    stage: \"loro_import\",\n    updateIds: input.decryptedUpdates.map((update) => update.id),\n  });\n}\n"]}

package/data/documents/shared/keyringRebuild.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyringRebuild.js","sourceRoot":"","sources":["keyringRebuild.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AAEjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAyC,EACzC,mBAA2B,EAC3B,MAAc;IAOd,MAAM,QAAQ,GAAG,KAAK;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CACvE,CAAC;IACF,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CACzC,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAC7C,CAAC;IACF,OAAO;QACL,WAAW;QACX,UAAU,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC;QAC/D,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAwC,EACxC,UAA2C;IAM3C,IAAI,OAAgB,CAAC;IACrB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,4BAA4B,CAAC;oBACtC,iBAAiB,EAAE,IAAI,CAAC,WAAW;oBACnC,iBAAiB,EAAE,SAAS;oBAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC;gBACF,eAAe;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,KAOvC;IACC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3E,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,kBAAkB,EAClB,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,2BAA2B,EAC3B,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAClD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,uBAAuB,CAC5B,CAAC;AACJ,CAAC;AAiBD,MAAM,oCAAoC,GAGtC;IACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,0EAA0E,KAAK,EAAE;IACnF,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,0DAA0D,KAAK,sBAAsB;IACvF,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,uCAAuC,KAAK,mEAAmE;IACjH,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,uCAAuC,KAAK,kEAAkE;CACjH,CAAC;AAEF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE5C;IACA;IAFX,YACW,iBAAyB,EACzB,MAAuC,EAChD,KAAe;QAEf,KAAK,CACH,oCAAoC,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,EAC/D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAC5C,CAAC;QAPO,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,WAAM,GAAN,MAAM,CAAiC;QAOhD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,IAAI,YAAqB,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;YACrD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,iBAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,GAAG;SACxB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,sCAAsC;QACtC,YAAY,KAAK,IAAI,KAAK,CACxB,iEAAiE,KAAK,CAAC,mBAAmB,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,MAAM,uCAAuC,CAAC;gBACjD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,cAAc,EAAE,IAAI,CAAC,uBAAuB;oBAC5C,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAqBlD;IACC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,GAC5D,oBAAoB,CAClB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAC/B,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,8BAA8B,CACtC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAC7B,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC3C,8BAA8B,CAAC;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;KACN,CAAC,CAAC;IAEL,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,CAAC,UAA8B,EAAE,EAAE,CAC1D,oBAAoB,CAAC;QACnB,OAAO;QACP,UAAU;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;KACrD,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,IAAI,gBAAyB,CAAC;IAC9B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACzD,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC;QAC5B,yEAAyE;QACzE,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GACV,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,gBAAgB,CACpB,WAAW,EACX,KAAK,CAAC,mBAAmB,IAAI,IAAI,GAAG,EAAE,CACvC;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAChE,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC,eAAe,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,8BAA8B,CAAC;YAC7B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAChD,aAAa;YACb,cAAc,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;YACtC,aAAa;YACb,qBAAqB;YACrB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QACvC,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,yEAAyE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;QACpD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["import type {\n  ContainerKekKeyringEntry,\n  ContainerKeyWrap,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekMaterialId,\n  unwrapContainerKekParentWrap,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekLogEpochResponse } from \"@tearleads/validators/response\";\nimport { unwrapKeyEnvelopesWithPrincipalPolicies } from \"../../principals/principalPolicyCrypto\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { normalizeContainerKeyWrap } from \"./readers\";\n\n/**\n * Splits an epoch's envelopes into the anchor kinds this requester could use:\n * their own direct envelope, principal envelopes their policies may resolve,\n * and parent-container envelopes. Anything else is not an identity anchor and\n * is dropped, so it never produces a misleading failure.\n */\nfunction partitionAnchorWraps(\n  wraps: readonly Record<string, unknown>[],\n  containerKeyEpochId: string,\n  userId: string,\n): {\n  directWraps: ContainerKeyWrap[];\n  epochWraps: ContainerKeyWrap[];\n  parentWraps: ContainerKeyWrap[];\n  principalWraps: ContainerKeyWrap[];\n} {\n  const forEpoch = wraps\n    .map((wrap) => normalizeContainerKeyWrap(wrap))\n    .filter((wrap) => wrap.containerKeyEpochId === containerKeyEpochId);\n  const directWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"user\" && wrap.recipientId === userId,\n  );\n  const principalWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"group\",\n  );\n  const parentWraps = forEpoch.filter(\n    (wrap) => wrap.recipientKind === \"container\",\n  );\n  return {\n    directWraps,\n    epochWraps: [...directWraps, ...principalWraps, ...parentWraps],\n    parentWraps,\n    principalWraps,\n  };\n}\n\n/**\n * Opens the first parent-container envelope whose parent epoch key the caller\n * supplied. Reports whether any key was available, so a missing parent key is\n * distinguishable from a corrupt envelope.\n */\nasync function openParentAnchor(\n  parentWraps: readonly ContainerKeyWrap[],\n  parentKeys: ReadonlyMap<string, Uint8Array>,\n): Promise<{\n  failure: unknown;\n  key: Uint8Array | null;\n  keyWasAvailable: boolean;\n}> {\n  let failure: unknown;\n  let keyWasAvailable = false;\n  for (const wrap of parentWraps) {\n    const parentKey = parentKeys.get(wrap.recipientKeyEpochId);\n    if (!parentKey) {\n      continue;\n    }\n    keyWasAvailable = true;\n    try {\n      return {\n        failure: undefined,\n        key: await unwrapContainerKekParentWrap({\n          parentContainerId: wrap.recipientId,\n          parentKeyMaterial: parentKey,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        }),\n        keyWasAvailable,\n      };\n    } catch (error) {\n      failure = error;\n    }\n  }\n  return { failure, key: null, keyWasAvailable };\n}\n\n/**\n * Every anchor kind was tried; report the most specific reason. A wrap that\n * was actually attempted and failed is corruption; one that could not be\n * attempted names the key that was missing.\n */\nfunction throwMostSpecificAnchorFailure(input: {\n  containerKeyEpoch: number;\n  directFailure: unknown;\n  hadParentWraps: boolean;\n  parentFailure: unknown;\n  parentKeyWasAvailable: boolean;\n  principalFailure: unknown;\n}): never {\n  if (input.directFailure !== undefined || input.parentFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"corrupt-envelope\",\n      input.directFailure ?? input.parentFailure,\n    );\n  }\n  if (input.principalFailure !== undefined) {\n    throw new HistoricalWrapUnavailableError(\n      input.containerKeyEpoch,\n      \"principal-key-unreachable\",\n      input.principalFailure,\n    );\n  }\n  throw new HistoricalWrapUnavailableError(\n    input.containerKeyEpoch,\n    input.hadParentWraps && !input.parentKeyWasAvailable\n      ? \"parent-key-unavailable\"\n      : \"no-addressed-envelope\",\n  );\n}\n\n/**\n * Raised when the requester holds no envelope they can open for a historical\n * epoch. Distinct from corruption: the log is intact, the caller simply is\n * not an anchor for this epoch.\n */\nexport type HistoricalWrapUnavailableReason =\n  /** No envelope at this epoch is addressed to the requester at all. */\n  | \"no-addressed-envelope\"\n  /** A direct user envelope exists for the requester but did not open. */\n  | \"corrupt-envelope\"\n  /** Only principal-addressed envelopes, whose key epoch is unreachable. */\n  | \"principal-key-unreachable\"\n  /** Only a parent-container envelope, and the parent KEK was not supplied. */\n  | \"parent-key-unavailable\";\n\nconst HISTORICAL_WRAP_UNAVAILABLE_MESSAGES: Record<\n  HistoricalWrapUnavailableReason,\n  (epoch: number) => string\n> = {\n  \"no-addressed-envelope\": (epoch) =>\n    `Container KEK log has no envelope addressed to this requester at epoch ${epoch}`,\n  \"corrupt-envelope\": (epoch) =>\n    `Container KEK log envelope for this requester at epoch ${epoch} could not be opened`,\n  \"principal-key-unreachable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is addressed to a principal key epoch this client cannot resolve`,\n  \"parent-key-unavailable\": (epoch) =>\n    `Container KEK log envelope at epoch ${epoch} is inherited from a parent container whose KEK was not supplied`,\n};\n\nexport class HistoricalWrapUnavailableError extends Error {\n  constructor(\n    readonly containerKeyEpoch: number,\n    readonly reason: HistoricalWrapUnavailableReason,\n    cause?: unknown,\n  ) {\n    super(\n      HISTORICAL_WRAP_UNAVAILABLE_MESSAGES[reason](containerKeyEpoch),\n      cause === undefined ? undefined : { cause },\n    );\n    this.name = \"HistoricalWrapUnavailableError\";\n  }\n}\n\n/**\n * The first candidate envelope that both decrypts AND matches the epoch's\n * material-id commitment.\n *\n * Candidates are tried ONE AT A TIME. An envelope can be AEAD-valid and still\n * carry the WRONG key — a stale or misaddressed wrap — so decrypting a batch\n * together would let that one envelope answer for the whole group and mask a\n * later envelope that would have opened the epoch. The reported failure is the\n * first real decrypt failure, since a commitment mismatch is a wrong envelope\n * rather than an unreachable one.\n */\nasync function firstCommittedAnchor(input: {\n  attempt: (\n    wraps: ContainerKeyWrap[],\n  ) => Promise<{ failure: unknown; key: Uint8Array | null }>;\n  candidates: ContainerKeyWrap[];\n  containerId: string;\n  containerKeyEpoch: number;\n  containerKeyEpochId: string;\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  let firstFailure: unknown;\n  for (const candidate of input.candidates) {\n    const result = await input.attempt([candidate]);\n    if (result.key === null) {\n      firstFailure ??= result.failure;\n      continue;\n    }\n    const materialId = await computeContainerKekMaterialId({\n      containerId: input.containerId,\n      keyEpoch: input.containerKeyEpoch,\n      keyMaterial: result.key,\n    });\n    if (materialId === input.containerKeyEpochId) {\n      return result;\n    }\n    // An envelope that decrypts to the WRONG key is a misaddressed or stale\n    // envelope, not an unreachable principal. Recording it keeps the reported\n    // reason `corrupt-envelope`; dropping it silently would let the epoch\n    // report as unaddressed, which points a repair at the wrong problem.\n    //\n    // Only reachable when the server files a wrap under an epoch id its\n    // material does not hash to — the addressing filter already rejects a\n    // wrap whose epoch id simply differs.\n    firstFailure ??= new Error(\n      `Container KEK envelope decrypts to material that is not epoch ${input.containerKeyEpochId}`,\n    );\n  }\n  return { failure: firstFailure, key: null };\n}\n\n/**\n * Opens one group of envelopes with the requester's CURRENT policies, folding\n * failure into a value rather than throwing.\n *\n * The caller tries several groups in order, and a failure in one is not the\n * end of the search — so the failure has to travel back alongside the miss\n * instead of unwinding the whole recovery.\n */\nasync function unwrapWrapsWithCurrentPolicies(input: {\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<{ failure: unknown; key: Uint8Array | null }> {\n  if (input.wraps.length === 0) {\n    return { failure: undefined, key: null };\n  }\n  try {\n    return {\n      failure: undefined,\n      key: await unwrapKeyEnvelopesWithPrincipalPolicies({\n        envelopes: input.wraps.map((wrap) => ({\n          keyFingerprint: wrap.recipientKeyFingerprint,\n          kemCipherText: wrap.kemCipherText,\n          wrappedKey: wrap.wrappedKey,\n        })),\n        execSql: input.execSql,\n        secretKey: input.secretKey,\n      }),\n    };\n  } catch (error) {\n    return { failure: error, key: null };\n  }\n}\n\n/**\n * The severed-bridge backstop: recovers one historical epoch's KEK from the\n * requester's own retained recipient envelope served in the kek-log. Wraps\n * are written by that epoch's rotator and never deleted, so this path is\n * independent of every later rotation — it works even when the bridge chain\n * above the epoch is destroyed. The recovered key is verified against the\n * epoch id's material commitment before use.\n *\n * Scope bound: a direct user envelope is recoverable from identity keys\n * alone, so a pristine client anchors on it. A group- or organization-\n * addressed envelope additionally requires the current principal secret key.\n * Principal rotation rematerializes every retained container grant against\n * the new principal head, so a current reader never needs an older principal\n * key to use this recovery path. Unreachable principal keys fail closed with\n * `HistoricalWrapUnavailableError` rather than appearing to be corruption.\n */\nexport async function recoverKeyringEntryFromWraps(input: {\n  containerId: string;\n  epoch: Pick<\n    ContainerKekLogEpochResponse,\n    \"containerKeyEpoch\" | \"containerKeyEpochId\" | \"wraps\"\n  >;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n  /**\n   * Parent container KEKs by epoch id. An inherited-only child has no direct\n   * or principal envelope of its own; its anchor is the parent-container\n   * wrap, which opens under the parent epoch's KEK. Recover the parent's\n   * epoch first (recursively, through the parent's own log) and pass it here.\n   */\n  parentKeysByEpochId?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * The requester's user id. Direct user envelopes are matched against it, so\n   * another member's envelope is never mistaken for an anchor — attempting it\n   * would only produce a misleading failure.\n   */\n  userId: string;\n}): Promise<ContainerKekKeyringEntry> {\n  const { directWraps, epochWraps, parentWraps, principalWraps } =\n    partitionAnchorWraps(\n      input.epoch.wraps,\n      input.epoch.containerKeyEpochId,\n      input.userId,\n    );\n  if (epochWraps.length === 0) {\n    throw new HistoricalWrapUnavailableError(\n      input.epoch.containerKeyEpoch,\n      \"no-addressed-envelope\",\n    );\n  }\n\n  const attempt = (wraps: typeof epochWraps) =>\n    unwrapWrapsWithCurrentPolicies({\n      execSql: input.execSql,\n      secretKey: input.secretKey,\n      wraps,\n    });\n\n  // A direct envelope is decryptable from identity keys alone, so its failure\n  // means corruption — not an unreachable principal key. Neither failure ends\n  // the search: a parent-container wrap may still anchor this epoch.\n  //\n  // Candidates are tried ONE AT A TIME, and each must match the epoch's\n  // material-id commitment rather than merely decrypt. An envelope can be\n  // AEAD-valid and still carry the WRONG key — a stale or misaddressed wrap —\n  // so batching would let that one envelope answer for the whole group and\n  // mask a later envelope that would have opened the epoch.\n  const attemptCommitted = (candidates: ContainerKeyWrap[]) =>\n    firstCommittedAnchor({\n      attempt,\n      candidates,\n      containerId: input.containerId,\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      containerKeyEpochId: input.epoch.containerKeyEpochId,\n    });\n\n  const direct = await attemptCommitted(directWraps);\n  let keyMaterial = direct.key;\n  const directFailure = direct.failure;\n  let principalFailure: unknown;\n  if (keyMaterial === null) {\n    const principal = await attemptCommitted(principalWraps);\n    keyMaterial = principal.key;\n    // Preserve the current-policy failure in case no inherited anchor opens.\n    principalFailure = principal.failure;\n  }\n  // The inherited-only path: a parent-container envelope opens under the\n  // parent epoch's KEK, which the caller recovers from the parent's own log.\n  const parent =\n    keyMaterial === null\n      ? await openParentAnchor(\n          parentWraps,\n          input.parentKeysByEpochId ?? new Map(),\n        )\n      : { failure: undefined, key: null, keyWasAvailable: false };\n  keyMaterial ??= parent.key;\n  const parentFailure = parent.failure;\n  const parentKeyWasAvailable = parent.keyWasAvailable;\n  if (keyMaterial === null) {\n    throwMostSpecificAnchorFailure({\n      containerKeyEpoch: input.epoch.containerKeyEpoch,\n      directFailure,\n      hadParentWraps: parentWraps.length > 0,\n      parentFailure,\n      parentKeyWasAvailable,\n      principalFailure,\n    });\n  }\n  const expectedId = await computeContainerKekMaterialId({\n    containerId: input.containerId,\n    keyEpoch: input.epoch.containerKeyEpoch,\n    keyMaterial,\n  });\n  if (expectedId !== input.epoch.containerKeyEpochId) {\n    throw new Error(\n      `Container KEK log wrap does not match its committed epoch id at epoch ${input.epoch.containerKeyEpoch}`,\n    );\n  }\n  return {\n    containerKeyEpochId: input.epoch.containerKeyEpochId,\n    keyMaterial,\n  };\n}\n\nexport { fetchContainerKekLog } from \"./containerKekLogFetch\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"./keyringLogWalk\";\nexport { rebuildKeyringEntriesFromLog } from \"./keyringLogWalk\";\n"]}

package/data/documents/shared/mutationAcknowledgement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutationAcknowledgement.js","sourceRoot":"","sources":["mutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,4DAA4D,CAAC;AAGpE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/** Advances a document head only after its response was matched to this plan. */\nexport async function acknowledgeDocumentMutation(input: {\n  readonly execSql: ExecSql;\n  readonly plan: Parameters<typeof locallyAuthoredAccessManifestHead>[0];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [locallyAuthoredAccessManifestHead(input.plan)],\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/documents/shared/projection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projection.js","sourceRoot":"","sources":["projection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAGL,2CAA2C,GAC5C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,4CAA4C,EAC5C,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,oBAAoB,EACpB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,SAAS,wBAAwB,CAC/B,IAAuB,EACvB,KAAwB,EACxB,OAAe;IAEf,IACE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,mDAAmD,CAAC,KAG5D;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CACT,KAAK,EACL,UAAU,EACX,IAAI,KAAK,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,gBAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,gBAAgB,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,iBAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,4BAA4B,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0CAA0C,CACjD,OAA4C,EAC5C,gBAAkD;IAElD,yEAAyE;IACzE,kEAAkE;IAClE,IACE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,wBAAwB,CACtB,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAChE,0CAA0C,CAAC,gBAAgB,CAAC,EAC5D,mEAAmE,CACpE,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,6BAA6B,CAClE,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,EAC1E,6DAA6D,CAC9D,CAAC;IACF,wBAAwB,CACtB,mBAAmB,CACjB,gBAAgB,CAAC,kBAAkB,CAAC,0BAA0B,CAC/D,EACD,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EACxE,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CACvD,gBAAkD,EAClD,qBAA8B;IAE9B,MAAM,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC3D,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;QAC3E,sEAAsE;QACtE,uCAAuC;QACvC,IACE,CAAC,qBAAqB;YACtB,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAC5C,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY;gBACnB,gBAAgB,CAAC,gBAAgB,CAAC,mBAAmB,CACxD,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,IACE,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB;YACzD,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CACrE,mBAAmB,CACjB,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CACvE,CACF,CAAC;IACF,IAAI,qBAAqB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gDAAgD,CAC7D,gBAAkD,EAClD,KAgBC;IAED,MAAM,wBAAwB,GAAG,yBAAyB,CACxD,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,IACE,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACrC,wBAAwB,KAAK,IAAI,EACjC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,2CAA2C,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;YACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,wBAAwB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,KAAK,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,qBAAqB,KAAK,IAAI,CAAC;IAC9E,IAAI,qBAAqB,IAAI,KAAK,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,gBAAgB,CAAC,gBAAgB;QACzC,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;IACxC,IACE,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAC1C,gBAAgB,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU;QAC7D,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,KAAK,UAAU,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,gBAAgB,CAAC,kBAAkB,CAAC,mBAAmB;QACvD,gBAAgB,CAAC,gBAAgB,CAAC,YAAY,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,0CAA0C,CAC9C,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IAEF,MAAM,OAAO,GAAG,qBAAqB;QACnC,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QACzE,CAAC,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GACvB,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrD,IACE,mBAAmB;QACnB,gBAAgB,CAAC,kBAAkB,CAAC,qBAAqB,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,0CAA0C,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACtE,mDAAmD,CAAC;QAClD,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,GAAG,KAA0E;IAE7E,IAAI,CAAC;QACH,OAAO,MAAM,gDAAgD,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import type {\n  DocumentContentKeyTarget,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { computeDocumentContentKeyTargetHash } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type PrincipalPolicyCache,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { throwKeyingVerificationShapeFailure } from \"../../keyingProjectionVerification/error\";\nimport { errorMessage } from \"../../shared/errorMessage\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  currentDocumentTargets,\n  deriveDocumentTargetFromProjection,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"./projectionTargets\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  normalizeDocumentKekTargetResponse,\n  sortDocumentTargets,\n  targetEnvelopeReference,\n  targetKey,\n  uniqueSortedStrings,\n} from \"./readers\";\n\nexport { unwrapContainerKekPath } from \"./containerKekPath\";\nexport { ContainerKekHistoryUnavailableError } from \"./containerKekPathHistory\";\nexport {\n  buildRotatedDocumentContentKeyBundle,\n  collectContainerKeksForDocumentSync,\n  DocumentContentKeyUnavailableError,\n  DocumentHistoryUnavailableError,\n  unwrapDocumentContentKeyFromBundle,\n  unwrapDocumentContentKeyFromWriterProjection,\n  unwrapDocumentContentKeyTarget,\n  wrapDocumentContentKeyForCreate,\n} from \"./projectionContentKeys\";\nexport {\n  authorizingContainerPathRefs,\n  authorizingContainerPathRefsForLinkSet,\n  containerPathRefs,\n  currentDocumentTargets,\n  deriveDocumentCreateTargets,\n  deriveDocumentTargetFromProjection,\n  mergeTargetEnvelopes,\n  readLinkedContainerIdsFromDocumentManifest,\n  verifiedDocumentWrapTargets,\n} from \"./projectionTargets\";\n\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { resolveProjectionVerifier } from \"./types\";\n\nfunction assertSortedStringsEqual(\n  left: readonly string[],\n  right: readonly string[],\n  message: string,\n): void {\n  if (\n    left.length !== right.length ||\n    left.some((value, index) => value !== right[index])\n  ) {\n    throw new Error(message);\n  }\n}\n\nfunction assertAuthorizingContainerPathsMatchDocumentTargets(input: {\n  targets: readonly DocumentContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  if (input.writerProjection.authorizingContainerPaths.length === 0) {\n    throw new Error(\"Document writer projection authorization paths missing\");\n  }\n\n  const targetKeys = new Set(input.targets.map(targetKey));\n  for (const [\n    index,\n    projection,\n  ] of input.writerProjection.authorizingContainerPaths.entries()) {\n    let projectionTarget: DocumentContentKeyTarget;\n    try {\n      projectionTarget = deriveDocumentTargetFromProjection(projection);\n    } catch (error) {\n      throw new Error(\n        `Document writer projection authorization path[${index}] is invalid: ${errorMessage(error)}`,\n      );\n    }\n\n    if (targetKeys.has(targetKey(projectionTarget))) {\n      continue;\n    }\n\n    // Bind server-supplied KEK paths to committed document targets before\n    // using any unwrapped path KEK for document content-key material.\n    throw new Error(\n      `Document writer projection authorization path[${index}] is not a document target`,\n    );\n  }\n}\n\nfunction assertDocumentTargetsCoverLinkedContainers(\n  targets: readonly DocumentContentKeyTarget[],\n  writerProjection: DocumentWriterProjectionResponse,\n): void {\n  // One target per linked container: a second epoch for the same container\n  // would let a re-wrap land on a KEK a revoked member still holds.\n  if (\n    new Set(targets.map((target) => target.containerId)).size !== targets.length\n  ) {\n    throw new Error(\n      \"Document writer projection targets name a linked container more than once\",\n    );\n  }\n  assertSortedStringsEqual(\n    uniqueSortedStrings(targets.map((target) => target.containerId)),\n    readLinkedContainerIdsFromDocumentManifest(writerProjection),\n    \"Document writer projection targets do not match linked containers\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerManifestHashes,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerManifestHash)),\n    \"Document writer projection target manifest summary mismatch\",\n  );\n  assertSortedStringsEqual(\n    uniqueSortedStrings(\n      writerProjection.documentKekTargets.linkedContainerKeyEpochIds,\n    ),\n    uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)),\n    \"Document writer projection target KEK summary mismatch\",\n  );\n}\n\nasync function assertProjectionContentKeyBundleConsistent(\n  writerProjection: DocumentWriterProjectionResponse,\n  staleContentKeyBundle: boolean,\n): Promise<void> {\n  const { manifestHash } = writerProjection.documentManifest;\n  if (writerProjection.contentKeyBundle.linkSetManifestHash !== manifestHash) {\n    // A stale bundle may lag the link-set head, but it must still descend\n    // from this document's manifest chain.\n    if (\n      !staleContentKeyBundle ||\n      !writerProjection.documentManifestHistory.some(\n        (bundle) =>\n          bundle.manifestHash ===\n          writerProjection.contentKeyBundle.linkSetManifestHash,\n      )\n    ) {\n      throw new Error(\"Document writer projection link manifest mismatch\");\n    }\n  }\n\n  if (!staleContentKeyBundle) {\n    if (\n      writerProjection.documentKekTargets.documentKeyTargetHash !==\n      writerProjection.contentKeyBundle.targetHash\n    ) {\n      throw new Error(\"Document writer projection target hash mismatch\");\n    }\n    return;\n  }\n\n  // The stale bundle cannot match the current targets; pin it to its own\n  // canonical hash instead so a tampered envelope set still fails closed.\n  const staleBundleTargetHash = await computeDocumentContentKeyTargetHash(\n    sortDocumentTargets(\n      writerProjection.contentKeyBundle.targets.map(targetEnvelopeReference),\n    ),\n  );\n  if (staleBundleTargetHash !== writerProjection.contentKeyBundle.targetHash) {\n    throw new Error(\n      \"Document writer projection stale bundle target hash is not canonical\",\n    );\n  }\n}\n\nasync function assertDocumentWriterProjectionConsistentInternal(\n  writerProjection: DocumentWriterProjectionResponse,\n  input: ProjectionVerificationOptions & {\n    /**\n     * Accept a projection whose content-key bundle is marked stale (wrapped\n     * to superseded KEK targets after e.g. a revoke rotation). Document sync\n     * opts in to heal the bundle. Attachment reads opt in because their DEK\n     * is independent and opens through verified retained container KEKs.\n     */\n    allowStaleContentKeyBundle?: boolean | undefined;\n    execSql?: ExecSql | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    onVerifiedAuthorization?:\n      | ((authorization: DocumentWriterProjectionAuthorization) => void)\n      | undefined;\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    stillCurrent?: (() => boolean) | undefined;\n    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n  },\n): Promise<DocumentContentKeyTarget[]> {\n  const resolveProjectionUserKey = resolveProjectionVerifier(\n    input,\n    \"Document writer projection\",\n  );\n  if (\n    input.trustedLocalProjection !== true &&\n    resolveProjectionUserKey !== null\n  ) {\n    const authorization = await verifyDocumentWriterProjectionAuthorization({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: writerProjection,\n      resolveUserKey: resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    input.onVerifiedAuthorization?.(authorization);\n  }\n\n  const staleContentKeyBundle = writerProjection.contentKeyBundleStale === true;\n  if (staleContentKeyBundle && input.allowStaleContentKeyBundle !== true) {\n    throw new Error(\"Document writer projection content-key bundle is stale\");\n  }\n\n  const manifestIdentity = await assertDocumentManifestBundleConsistent({\n    bundle: writerProjection.documentManifest,\n    label: \"Document writer projection manifest\",\n  });\n  const { documentId } = manifestIdentity;\n  if (\n    writerProjection.documentId !== documentId ||\n    writerProjection.documentKekTargets.documentId !== documentId ||\n    writerProjection.contentKeyBundle.documentId !== documentId\n  ) {\n    throw new Error(\"Document writer projection document id mismatch\");\n  }\n  if (\n    writerProjection.documentKekTargets.linkSetManifestHash !==\n    writerProjection.documentManifest.manifestHash\n  ) {\n    throw new Error(\"Document writer projection link manifest mismatch\");\n  }\n  await assertProjectionContentKeyBundleConsistent(\n    writerProjection,\n    staleContentKeyBundle,\n  );\n\n  const targets = staleContentKeyBundle\n    ? normalizeDocumentKekTargetResponse(writerProjection.documentKekTargets)\n    : currentDocumentTargets(writerProjection);\n  const canonicalTargetHash =\n    await computeDocumentContentKeyTargetHash(targets);\n  if (\n    canonicalTargetHash !==\n    writerProjection.documentKekTargets.documentKeyTargetHash\n  ) {\n    throw new Error(\"Document writer projection target hash is not canonical\");\n  }\n\n  assertDocumentTargetsCoverLinkedContainers(targets, writerProjection);\n  assertAuthorizingContainerPathsMatchDocumentTargets({\n    targets,\n    writerProjection,\n  });\n\n  return targets;\n}\n\nexport async function assertDocumentWriterProjectionConsistent(\n  ...input: Parameters<typeof assertDocumentWriterProjectionConsistentInternal>\n): ReturnType<typeof assertDocumentWriterProjectionConsistentInternal> {\n  try {\n    return await assertDocumentWriterProjectionConsistentInternal(...input);\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}