@tearleads/client-sdk 0.1.64 → 0.1.66

package/data/documents/shared/sync/documentSyncUpdateIsolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncUpdateIsolation.js","sourceRoot":"","sources":["documentSyncUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAMxD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsC,EACtC,KAAa;IAEb,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC;IAEtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,WAAW,CAAqB;IAChC,iBAAiB,CAAgB;IACjC,cAAc,CAAoB;IAClC,cAAc,CAA2B;IACzC,cAAc,CAAgB;IAC9B,eAAe,CAAgB;IAC/B,UAAU,CAAgB;IAC1B,YAAY,CAAgB;IAC5B,KAAK,CAAmC;IACxC,QAAQ,CAAgB;IACxB,YAAY,CAAgB;IAErC,YAAY,KAMX;QACC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,oBAAoB,CACvC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,MAAM,MAAM,GACV,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,SAAS,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,6BAA6B,cAAc,CAAC,MAAM,2CAA2C;YAC/F,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,gBAAgB,MAAM,iBAAiB,WAAW,WAAW,KAAK,GAAG,CAAC;QACpG,KAAK,CACH,6BAA6B,OAAO,WAAW,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc;YACjB,KAAK,CAAC,cAAc,EAAE,cAAc,KAAK,iBAAiB;gBACxD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc,GAAG,oBAAoB,CACxC,KAAK,CAAC,cAAc,EACpB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,oBAAoB,CACtC,KAAK,CAAC,cAAc,EACpB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,IAAI,gCAAgC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,OAAO,KAAK,CAAC,KAAK,YAAY,gCAAgC;QAC5D,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,OAAO,KAAK,YAAY,gCAAgC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkD;IAElD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CACnE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mFAAmF,CACpF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,8BAA8B,CAAC;YACnC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA+C;IAK/C,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,cAAc,KAAK,iBAAiB;YAC3C,MAAM,CAAC,qBAAqB,KAAK,uBAAuB,EACxD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAAsB,EACtB,OAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,wBAAwB,CAC/D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,0CAA0C,CAAC;gBACzC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,IACE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChC,+BAA+B,GAAG,UAAU,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,WAAW,KAAK,cAAc;gBAAE,SAAS;YAC7C,IACE,MAAM,CAAC,UAAU,CAAC,UAAU;gBAC5B,+BAA+B,GAAG,UAAU,EAC5C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwB,EACxB,YAAwE;IAExE,IAAI,kBAAkB,GAAa,IAAI,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;YAClD,kBAAkB,GAAG,SAAS,CAAC;YAC/B,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhD,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C,sBAAsB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,IAAI,KAAK,CACd,mDAAmD,iBAAiB,EAAE,CACvE;YACD,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,eAAe;YACf,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,gBAAgB;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kCAAkC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,UAAU,YAAY,qCAAqC,EAAE,CAAC;QAChE,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IACE,gCAAgC,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,eAAe;KAChB,CAAC,EACF,CAAC;QACD,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,KAAK,CAAC,gBAAgB,EACtB,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc,CACnD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,4BAA4B,CAAC;gBACjC,eAAe;gBACf,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,8BAA8B,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,cAAc,CAAC,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,6BAA6B,CAAC;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createDocument,\n  exportFullHistorySnapshot,\n  importSnapshot,\n  importUpdates,\n  LoroImportUnresolvedDependenciesError,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type {\n  DecryptedDocumentSyncUpdate,\n  SyncRemoteDocumentResult,\n} from \"../types\";\n\ntype DocumentSyncUpdateIsolationStage =\n  | \"content_key\"\n  | \"decrypt\"\n  | \"encrypted_record\"\n  | \"loro_import\"\n  | \"loro_metadata\"\n  | \"plaintext_integrity\"\n  | \"write_header\";\n\ntype SyncResponseUpdate = DocumentSyncResponse[\"updates\"][number];\ntype SyncDocument = Awaited<ReturnType<typeof createDocument>>;\n\nconst MAX_EXACT_ISOLATION_CANDIDATES = 8;\nconst MAX_EXACT_ISOLATION_RETRY_BYTES = 8 * 1024 * 1024;\n\nexport type IncomingDocumentSyncUpdateValidator = (\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n) => void | Promise<void>;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction optionalHeaderField(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): unknown {\n  const header = update?.writeHeader;\n  return header && typeof header === \"object\"\n    ? Reflect.get(header, field)\n    : undefined;\n}\n\nfunction optionalHeaderString(\n  update: SyncResponseUpdate | undefined,\n  field: string,\n): string | null {\n  const value = optionalHeaderField(update, field);\n  return typeof value === \"string\" ? value : null;\n}\n\nfunction optionalHeaderEpoch(\n  update: SyncResponseUpdate | undefined,\n): number | null {\n  const value = optionalHeaderField(update, \"contentKeyEpoch\");\n  return typeof value === \"number\" && Number.isSafeInteger(value)\n    ? value\n    : null;\n}\n\nexport class DocumentSyncUpdateIsolationError extends Error {\n  readonly attribution: \"batch\" | \"update\";\n  readonly authorFingerprint: string | null;\n  readonly batchUpdateIds: readonly string[];\n  readonly checkpointKind: \"rotate_baseline\" | null;\n  readonly ciphertextHash: string | null;\n  readonly contentKeyEpoch: number | null;\n  readonly documentId: string | null;\n  readonly metadataHash: string | null;\n  readonly stage: DocumentSyncUpdateIsolationStage;\n  readonly updateId: string | null;\n  readonly writerUserId: string | null;\n\n  constructor(input: {\n    batchUpdateIds?: readonly string[] | undefined;\n    cause: unknown;\n    responseUpdate?: SyncResponseUpdate | undefined;\n    stage: DocumentSyncUpdateIsolationStage;\n    updateId: string | null;\n  }) {\n    const causeMessage = errorMessage(input.cause);\n    const writerUserId = optionalHeaderString(\n      input.responseUpdate,\n      \"writerUserId\",\n    );\n    const author =\n      writerUserId ?? input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const fingerprint = input.responseUpdate?.authorFingerprint ?? \"unknown\";\n    const epoch = optionalHeaderEpoch(input.responseUpdate) ?? \"unknown\";\n    const batchUpdateIds =\n      input.updateId === null ? (input.batchUpdateIds ?? []) : [];\n    const subject =\n      input.updateId === null\n        ? `response batch containing ${batchUpdateIds.length} updates; exact update and writer unknown`\n        : `update ${input.updateId} from writer ${author} (fingerprint ${fingerprint}, epoch ${epoch})`;\n    super(\n      `Document sync quarantined ${subject} during ${input.stage}: ${causeMessage}`,\n      { cause: input.cause },\n    );\n    this.name = \"DocumentSyncUpdateIsolationError\";\n    this.attribution = input.updateId === null ? \"batch\" : \"update\";\n    this.authorFingerprint = input.responseUpdate?.authorFingerprint ?? null;\n    this.batchUpdateIds = [...batchUpdateIds];\n    this.checkpointKind =\n      input.responseUpdate?.checkpointKind === \"rotate_baseline\"\n        ? \"rotate_baseline\"\n        : null;\n    this.ciphertextHash = optionalHeaderString(\n      input.responseUpdate,\n      \"ciphertextHash\",\n    );\n    this.contentKeyEpoch = optionalHeaderEpoch(input.responseUpdate);\n    this.documentId = input.responseUpdate?.documentId ?? null;\n    this.metadataHash = optionalHeaderString(\n      input.responseUpdate,\n      \"metadataHash\",\n    );\n    this.stage = input.stage;\n    this.updateId = input.updateId;\n    this.writerUserId = writerUserId;\n  }\n}\n\nexport function isolateDocumentSyncBatchError(input: {\n  cause: unknown;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateIds: readonly string[];\n}): DocumentSyncUpdateIsolationError {\n  return new DocumentSyncUpdateIsolationError({\n    batchUpdateIds: input.updateIds,\n    cause: input.cause,\n    stage: input.stage,\n    updateId: null,\n  });\n}\n\nexport function isolateDocumentSyncUpdateError(input: {\n  cause: unknown;\n  responseUpdate?: SyncResponseUpdate | undefined;\n  stage: DocumentSyncUpdateIsolationStage;\n  updateId: string;\n}): DocumentSyncUpdateIsolationError {\n  return input.cause instanceof DocumentSyncUpdateIsolationError\n    ? input.cause\n    : new DocumentSyncUpdateIsolationError(input);\n}\n\nexport function isDocumentSyncUpdateIsolationError(\n  error: unknown,\n): error is DocumentSyncUpdateIsolationError {\n  return error instanceof DocumentSyncUpdateIsolationError;\n}\n\nfunction responseUpdatesById(\n  updates: readonly SyncResponseUpdate[] | undefined,\n): ReadonlyMap<string, SyncResponseUpdate> {\n  return new Map((updates ?? []).map((update) => [update.id, update]));\n}\n\nfunction firstDuplicateUpdateId(\n  updates: readonly { readonly id: string }[],\n): string | null {\n  const seen = new Set<string>();\n  for (const update of updates) {\n    if (seen.has(update.id)) return update.id;\n    seen.add(update.id);\n  }\n  return null;\n}\n\nfunction assertImportedUpdatesMatchValidatedHistory(input: {\n  document: SyncDocument;\n  responseById: ReadonlyMap<string, SyncResponseUpdate>;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): void {\n  const collisions = input.updates.filter(\n    (update) =>\n      !updateMatchesDocumentHistory(input.document, update.updateData),\n  );\n  if (collisions.length === 0) return;\n  const cause = new Error(\n    \"incoming Loro update reuses an already-covered frontier with different operations\",\n  );\n  const [collision] = collisions;\n  if (input.updates.length === 1 && collision) {\n    throw isolateDocumentSyncUpdateError({\n      cause,\n      responseUpdate: input.responseById.get(collision.id),\n      stage: \"loro_import\",\n      updateId: collision.id,\n    });\n  }\n  throw isolateDocumentSyncBatchError({\n    cause,\n    stage: \"loro_import\",\n    updateIds: input.updates.map((update) => update.id),\n  });\n}\n\nasync function createValidationDocument(snapshot: Uint8Array) {\n  const document = await createDocument(crypto.randomUUID());\n  try {\n    importSnapshot(document, snapshot);\n    return document;\n  } catch (error) {\n    document.free();\n    throw error;\n  }\n}\n\nfunction splitDocumentSyncUpdates(\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): {\n  checkpoints: DecryptedDocumentSyncUpdate[];\n  ordinaryUpdates: DecryptedDocumentSyncUpdate[];\n} {\n  const checkpoints: DecryptedDocumentSyncUpdate[] = [];\n  const ordinaryUpdates: DecryptedDocumentSyncUpdate[] = [];\n  for (const update of updates) {\n    if (\n      update.checkpointKind === \"rotate_baseline\" &&\n      update.checkpointPayloadKind === \"full_history_snapshot\"\n    ) {\n      checkpoints.push(update);\n    } else {\n      ordinaryUpdates.push(update);\n    }\n  }\n  return { checkpoints, ordinaryUpdates };\n}\n\n/** Applies checkpoints with the snapshot API before batching ordinary deltas. */\nexport function importDecryptedDocumentSyncUpdates(\n  document: SyncDocument,\n  updates: readonly DecryptedDocumentSyncUpdate[],\n): void {\n  const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(updates);\n  for (const checkpoint of checkpoints) {\n    importSnapshot(document, checkpoint.updateData);\n  }\n  if (ordinaryUpdates.length > 0) {\n    importUpdates(\n      document,\n      ordinaryUpdates.map((update) => update.updateData),\n    );\n  }\n}\n\nasync function validateDecryptedUpdateBatch(input: {\n  currentSnapshot: Uint8Array;\n  responseById?: ReadonlyMap<string, SyncResponseUpdate> | undefined;\n  updates: readonly DecryptedDocumentSyncUpdate[];\n}): Promise<void> {\n  const document = await createValidationDocument(input.currentSnapshot);\n  try {\n    const { checkpoints, ordinaryUpdates } = splitDocumentSyncUpdates(\n      input.updates,\n    );\n    for (const checkpoint of checkpoints) {\n      importSnapshot(document, checkpoint.updateData);\n    }\n    if (ordinaryUpdates.length > 0) {\n      importUpdates(\n        document,\n        ordinaryUpdates.map((update) => update.updateData),\n      );\n    }\n    if (input.responseById) {\n      // Validate against the completed scratch history, not only the live\n      // pre-page frontier. If two updates in this page reuse one peer/counter\n      // with different operations, Loro accepts one and treats the other as a\n      // no-op; only the accepted history can match both when they are equal.\n      assertImportedUpdatesMatchValidatedHistory({\n        document,\n        responseById: input.responseById,\n        updates: input.updates,\n      });\n    }\n  } finally {\n    document.free();\n  }\n}\n\nfunction exactIsolationRetryExceedsBudget(input: {\n  candidates: readonly DecryptedDocumentSyncUpdate[];\n  currentSnapshot: Uint8Array;\n}): boolean {\n  if (input.candidates.length > MAX_EXACT_ISOLATION_CANDIDATES) return true;\n\n  let retryBytes = 0;\n  for (const candidateIndex of input.candidates.keys()) {\n    if (\n      input.currentSnapshot.byteLength >\n      MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n    ) {\n      return true;\n    }\n    retryBytes += input.currentSnapshot.byteLength;\n    for (const [updateIndex, update] of input.candidates.entries()) {\n      if (updateIndex === candidateIndex) continue;\n      if (\n        update.updateData.byteLength >\n        MAX_EXACT_ISOLATION_RETRY_BYTES - retryBytes\n      ) {\n        return true;\n      }\n      retryBytes += update.updateData.byteLength;\n    }\n  }\n  return false;\n}\n\n/** @internal Exported only to exercise the bounded exact-attribution policy. */\nexport async function findUniqueRepairingCandidate<T>(\n  candidates: readonly T[],\n  repairsBatch: (candidate: T, candidateIndex: number) => Promise<boolean>,\n): Promise<T | null> {\n  let repairingCandidate: T | null = null;\n  let repairingCandidateCount = 0;\n  for (const [candidateIndex, candidate] of candidates.entries()) {\n    if (await repairsBatch(candidate, candidateIndex)) {\n      repairingCandidate = candidate;\n      repairingCandidateCount += 1;\n    }\n  }\n  return repairingCandidateCount === 1 ? repairingCandidate : null;\n}\n\n/**\n * Proves that a decrypted response can be imported before the live document or\n * any durable sync frontier is mutated. On failure, retries the page without\n * each candidate so valid sibling dependencies remain in the same batch while\n * the update whose removal repairs the batch is attributed exactly.\n */\nexport async function validateDocumentSyncUpdateImports(input: {\n  currentDocument: Awaited<ReturnType<typeof createDocument>>;\n  decryptedUpdates: readonly DecryptedDocumentSyncUpdate[];\n  responseUpdates?: readonly SyncResponseUpdate[] | undefined;\n}): Promise<void> {\n  if (input.decryptedUpdates.length === 0) return;\n\n  const duplicateUpdateId =\n    firstDuplicateUpdateId(input.decryptedUpdates) ??\n    firstDuplicateUpdateId(input.responseUpdates ?? []);\n  if (duplicateUpdateId !== null) {\n    throw isolateDocumentSyncBatchError({\n      cause: new Error(\n        `Document sync response update id is duplicated: ${duplicateUpdateId}`,\n      ),\n      stage: \"encrypted_record\",\n      updateIds: (input.responseUpdates ?? input.decryptedUpdates).map(\n        (update) => update.id,\n      ),\n    });\n  }\n\n  const currentSnapshot = exportFullHistorySnapshot(input.currentDocument);\n  const responseById = responseUpdatesById(input.responseUpdates);\n  let batchError: unknown;\n  try {\n    await validateDecryptedUpdateBatch({\n      currentSnapshot,\n      responseById,\n      updates: input.decryptedUpdates,\n    });\n    return;\n  } catch (error) {\n    if (isDocumentSyncUpdateIsolationError(error)) throw error;\n    batchError = error;\n  }\n\n  // A delta can be valid but depend on a parent omitted from this response\n  // page. Removing that delta would make an empty retry succeed and falsely\n  // identify its authenticated writer as poison, so dependency gaps remain\n  // anonymous at batch scope.\n  if (batchError instanceof LoroImportUnresolvedDependenciesError) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  if (\n    exactIsolationRetryExceedsBudget({\n      candidates: input.decryptedUpdates,\n      currentSnapshot,\n    })\n  ) {\n    throw isolateDocumentSyncBatchError({\n      cause: batchError,\n      stage: \"loro_import\",\n      updateIds: input.decryptedUpdates.map((update) => update.id),\n    });\n  }\n\n  // Rebuild from the same immutable snapshot for every candidate: a failed\n  // import may partially mutate its scratch document. Checkpoints participate\n  // alongside ordinary updates so an incompatibility between the two kinds\n  // cannot falsely blame the ordinary writer. Keeping every other update in\n  // one batch also preserves out-of-order sibling dependencies.\n  const isolatedUpdate = await findUniqueRepairingCandidate(\n    input.decryptedUpdates,\n    async (_update, candidateIndex) => {\n      const withoutCandidate = input.decryptedUpdates.filter(\n        (_, updateIndex) => updateIndex !== candidateIndex,\n      );\n      try {\n        await validateDecryptedUpdateBatch({\n          currentSnapshot,\n          updates: withoutCandidate,\n        });\n        return true;\n      } catch {\n        // This candidate is either valid and required by a sibling, or another\n        // poison update remains. Continue without attributing it.\n        return false;\n      }\n    },\n  );\n  if (isolatedUpdate) {\n    throw isolateDocumentSyncUpdateError({\n      cause: batchError,\n      responseUpdate: responseById.get(isolatedUpdate.id),\n      stage: \"loro_import\",\n      updateId: isolatedUpdate.id,\n    });\n  }\n\n  // Multiple bad updates or a batch-level incompatibility may have zero or\n  // multiple removals that repair the page. Fail closed without falsely naming\n  // a valid writer; no live or durable state has changed.\n  throw isolateDocumentSyncBatchError({\n    cause: batchError,\n    stage: \"loro_import\",\n    updateIds: input.decryptedUpdates.map((update) => update.id),\n  });\n}\n"]}

package/data/documents/shared/{mutationAcknowledgement.js → sync/mutationAcknowledgement.js}

@@ -1,4 +1,4 @@
-import { advanceLocallyAcknowledgedAccessManifestHeadsAtomically, locallyAuthoredAccessManifestHead, } from "../../persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { advanceLocallyAcknowledgedAccessManifestHeadsAtomically, locallyAuthoredAccessManifestHead, } from "../../../persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js";
 /** Advances a document head only after its response was matched to this plan. */
 export async function acknowledgeDocumentMutation(input) {
     await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({

package/data/documents/shared/sync/mutationAcknowledgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutationAcknowledgement.js","sourceRoot":"","sources":["mutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,iFAAiF,CAAC;AAGzF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../../persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../sqlite/sqlSchema\";\n\n/** Advances a document head only after its response was matched to this plan. */\nexport async function acknowledgeDocumentMutation(input: {\n  readonly execSql: ExecSql;\n  readonly plan: Parameters<typeof locallyAuthoredAccessManifestHead>[0];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [locallyAuthoredAccessManifestHead(input.plan)],\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/documents/shared/{pullContinuation.js → sync/pullContinuation.js}

@@ -1,4 +1,4 @@
-import { isWalLsnString, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, } from "../../../internal/validators/util/index.js";
+import { isWalLsnString, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, } from "../../../../internal/validators/util/index.js";
 export function documentSyncPullContinuationsEqual(left, right) {
     if (!left || !right)
         return left == null && right == null;

package/data/documents/shared/{syncPagination.d.ts → sync/syncPagination.d.ts}

@@ -1,6 +1,6 @@
-import type { DocumentSyncResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentSyncResponse } from "../../../../internal/validators/response/index.js";
+import type { DocumentSyncApi, DocumentSyncPlan, DocumentSyncSubmitFailure } from "../types.js";
 import type { DocumentSyncCommitLsnMode, DocumentSyncPullContinuation } from "./pullContinuation.js";
-import type { DocumentSyncApi, DocumentSyncPlan, DocumentSyncSubmitFailure } from "./types.js";
 export type { DocumentSyncCommitLsnMode, DocumentSyncPullContinuation, } from "./pullContinuation.js";
 export { documentSyncPullContinuationsEqual } from "./pullContinuation.js";
 export declare class InvalidDocumentSyncPullContinuationError extends Error {

package/data/documents/shared/{syncPagination.js → sync/syncPagination.js}

@@ -1,4 +1,4 @@
-import { parseWalLsn } from "../../../internal/validators/util/index.js";
+import { parseWalLsn } from "../../../../internal/validators/util/index.js";
 export { documentSyncPullContinuationsEqual } from "./pullContinuation.js";
 export class InvalidDocumentSyncPullContinuationError extends Error {
     constructor(message) {

package/data/documents/shared/sync/syncPagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncPagination.js","sourceRoot":"","sources":["syncPagination.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAezD,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAmBD,MAAM,UAAU,oBAAoB,CAClC,QAA8B;IAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,YAAsD,EACtD,QAA4B;IAE5B,IAAI,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,YAAY,CAAC,aAAa,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC;QACjE,CAAC,CAAC,YAAY,CAAC,SAAS;QACxB,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAI7B;IACC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,wCAAwC,CAChD,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACpE,MAAM,IAAI,wCAAwC,CAChD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wCAAwC,CAChD,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IACvC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wCAAwC,CAChD,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,wCAAwC,CAChD,iDAAiD,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAA8B;IACrD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAIrC;IACC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IACE,KAAK,CAAC,qBAAqB,KAAK,SAAS;QACzC,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,qBAAqB,EAC3D,CAAC;QACD,MAAM,IAAI,wCAAwC,CAChD,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IAC7D,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QACjC,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,wCAAwC,CAChD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,IAAI,wCAAwC,CAChD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,UAAU,KAAK,IAAI;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAIxC;IACC,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACrD,KAAK,CAAC,IAAI,CAAC,UAAU,EACrB,KAAK,CAAC,IAAI,CAAC,OAAO,EAClB;gBACE,qCAAqC,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;gBAChE,YAAY,EAAE,KAAK;aACpB,CACF,CAAC;YACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport type {\n  DocumentSyncApi,\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n} from \"../types\";\nimport type {\n  DocumentSyncCommitLsnMode,\n  DocumentSyncPullContinuation,\n} from \"./pullContinuation\";\n\nexport type {\n  DocumentSyncCommitLsnMode,\n  DocumentSyncPullContinuation,\n} from \"./pullContinuation\";\nexport { documentSyncPullContinuationsEqual } from \"./pullContinuation\";\n\nexport class InvalidDocumentSyncPullContinuationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidDocumentSyncPullContinuationError\";\n  }\n}\n\ntype DocumentSyncPageSubmission =\n  | {\n      readonly ok: true;\n      readonly response: DocumentSyncResponse;\n    }\n  | DocumentSyncSubmitFailure\n  | null;\n\ntype DocumentSyncSubmission =\n  | {\n      readonly ok: true;\n      readonly pullComplete: boolean;\n      readonly response: DocumentSyncResponse;\n    }\n  | DocumentSyncSubmitFailure\n  | null;\n\nexport function readPullContinuation(\n  response: DocumentSyncResponse,\n): DocumentSyncPullContinuation | null {\n  const cursor = requirePullPage(response).nextCursor;\n  if (cursor === null) return null;\n  if (response.commitLsn === null) {\n    throw new Error(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  return {\n    commitLsn: response.commitLsn,\n    commitLsnMode: response.commitLsnMode,\n    cursor,\n  };\n}\n\nexport function resolvePullContinuationMinLsn(\n  continuation: DocumentSyncPullContinuation | undefined,\n  fallback: string | undefined,\n): string | undefined {\n  if (!continuation) return fallback;\n  if (continuation.commitLsnMode === \"untracked\" || fallback === undefined) {\n    return continuation.commitLsn;\n  }\n  return parseWalLsn(continuation.commitLsn) >= parseWalLsn(fallback)\n    ? continuation.commitLsn\n    : fallback;\n}\n\nfunction assertPageCheckpoint(input: {\n  readonly minLsn: string | undefined;\n  readonly nextCursor: string | null;\n  readonly response: DocumentSyncResponse;\n}): void {\n  if (input.response.commitLsnMode === \"untracked\") {\n    if (input.response.commitLsn !== \"0/0\") {\n      throw new InvalidDocumentSyncPullContinuationError(\n        \"Document sync continuation untracked LSN is invalid\",\n      );\n    }\n    return;\n  }\n  if (input.response.commitLsn === null) {\n    if (input.minLsn === undefined && input.nextCursor === null) return;\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  let responseLsn: bigint;\n  try {\n    responseLsn = parseWalLsn(input.response.commitLsn);\n  } catch {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN is invalid\",\n    );\n  }\n  if (input.minLsn === undefined) return;\n  let minimumLsn: bigint;\n  try {\n    minimumLsn = parseWalLsn(input.minLsn);\n  } catch {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync minimum commit LSN is invalid\",\n    );\n  }\n  if (responseLsn < minimumLsn) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN regressed\",\n    );\n  }\n}\n\nfunction requirePullPage(response: DocumentSyncResponse) {\n  if (response.pullPage === undefined) {\n    throw new Error(\"Document sync response is missing pull page metadata\");\n  }\n  return response.pullPage;\n}\n\nasync function submitDocumentSyncPage(input: {\n  readonly expectedCommitLsnMode?: DocumentSyncCommitLsnMode | undefined;\n  readonly plan: DocumentSyncPlan;\n  readonly submit: () => Promise<DocumentSyncPageSubmission>;\n}): Promise<DocumentSyncSubmission> {\n  const page = await input.submit();\n  if (!page?.ok) return page;\n  if (\n    input.expectedCommitLsnMode !== undefined &&\n    page.response.commitLsnMode !== input.expectedCommitLsnMode\n  ) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation commit LSN mode changed\",\n    );\n  }\n  const nextCursor = requirePullPage(page.response).nextCursor;\n  assertPageCheckpoint({\n    minLsn: input.plan.request.minLsn,\n    nextCursor,\n    response: page.response,\n  });\n  if (nextCursor !== null && page.response.commitLsn === null) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync pull continuation is missing its checkpoint\",\n    );\n  }\n  if (nextCursor !== null && nextCursor === input.plan.request.pullCursor) {\n    throw new InvalidDocumentSyncPullContinuationError(\n      \"Document sync continuation cursor did not advance\",\n    );\n  }\n  return {\n    ok: true,\n    pullComplete: nextCursor === null,\n    response: page.response,\n  };\n}\n\nexport async function submitDocumentSync(input: {\n  apiClient: DocumentSyncApi;\n  expectedCommitLsnMode?: DocumentSyncCommitLsnMode | undefined;\n  plan: DocumentSyncPlan;\n}): Promise<DocumentSyncSubmission> {\n  return submitDocumentSyncPage({\n    expectedCommitLsnMode: input.expectedCommitLsnMode,\n    plan: input.plan,\n    submit: async () => {\n      const result = await input.apiClient.syncDocumentResult(\n        input.plan.documentId,\n        input.plan.request,\n        {\n          expectedPaymentRequiredOrganizationId: input.plan.organizationId,\n          reportErrors: false,\n        },\n      );\n      return result.ok ? { ok: true, response: result.data } : result;\n    },\n  });\n}\n"]}

package/data/documents/shared/{syncResponseAuthorization.js → sync/syncResponseAuthorization.js}

@@ -1,6 +1,6 @@
-import { computeDocumentContentKeyTargetHash, makeVerifiedDocumentKekTargets, } from "../../../internal/crypto/index.js";
-import { resolveEventContainerPaths } from "../../keyingProjectionVerification/document/documentDependencyPaths.js";
-import { sortDocumentTargets } from "./readers.js";
+import { computeDocumentContentKeyTargetHash, makeVerifiedDocumentKekTargets, } from "../../../../internal/crypto/index.js";
+import { resolveEventContainerPaths } from "../../../keyingProjectionVerification/document/documentDependencyPaths.js";
+import { sortDocumentTargets } from "../readers.js";
 export async function documentWriteAuthorizationForHeader(input) {
     const source = input.plan.documentWriterAuthorization;
     if (!source) {

package/data/documents/shared/sync/syncResponseAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncResponseAuthorization.js","sourceRoot":"","sources":["syncResponseAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EAEnC,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAWzD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACxD,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,IACE,CAAC,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IACE,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;QAC/D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CACxC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,MAAM,CAAC,qBAAqB,CAClE,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IACE,CAAC,IAAI;YACL,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YAC7C,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc;YACvD,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EAC7D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;IAC3D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;QACxD,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,qBAAqB,EAAE,KAAK,CAAC,UAAU;QACvC,0BAA0B,EAAE,OAAO,CAAC,GAAG,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CACvC;QACD,6BAA6B,EAAE,OAAO,CAAC,GAAG,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CACzC;QACD,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,yBAAyB;QACzB,kBAAkB;QAClB,gBAAgB;QAChB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computeDocumentContentKeyTargetHash,\n  type DocumentContentKeyTarget,\n  makeVerifiedDocumentKekTargets,\n} from \"@tearleads/crypto\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport { resolveEventContainerPaths } from \"../../../keyingProjectionVerification/document/documentDependencyPaths\";\nimport { sortDocumentTargets } from \"../readers\";\nimport type { DocumentSyncPlan } from \"../types\";\n\nexport async function documentWriteAuthorizationForHeader(input: {\n  readonly allowMissingAuthorization: boolean;\n  readonly dependencyManifestHashes: readonly string[];\n  readonly authorizationTargets: readonly DocumentContentKeyTarget[];\n  readonly contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  readonly manifestHash: string;\n  readonly plan: Pick<\n    DocumentSyncPlan,\n    \"documentId\" | \"organizationId\" | \"documentWriterAuthorization\"\n  >;\n  readonly targetHash: string;\n}) {\n  const source = input.plan.documentWriterAuthorization;\n  if (!source) {\n    if (input.allowMissingAuthorization) {\n      return null;\n    }\n    throw new Error(\n      \"Document sync response lacks verified writer-authorization material\",\n    );\n  }\n  const documentManifest = source.documentManifestByHash.get(\n    input.manifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\n      \"Document sync response write manifest is not in verified history\",\n    );\n  }\n  if (input.contentKeyBundle.documentId !== input.plan.documentId) {\n    throw new Error(\n      \"Document sync response content-key bundle belongs to another document\",\n    );\n  }\n\n  const targets = sortDocumentTargets(input.authorizationTargets);\n  if (\n    (await computeDocumentContentKeyTargetHash(targets)) !== input.targetHash\n  ) {\n    throw new Error(\"Document sync response write targets are not canonical\");\n  }\n  const linkedContainerIds = new Set(documentManifest.state.linkedContainerIds);\n  if (\n    targets.length !== linkedContainerIds.size ||\n    targets.some((target) => !linkedContainerIds.has(target.containerId))\n  ) {\n    throw new Error(\n      \"Document sync response write targets do not match the signed link set\",\n    );\n  }\n\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash: source.containerPathByManifestHash,\n    dependencyManifestHashes: input.dependencyManifestHashes,\n  });\n  // A writer needs one committed target, and can be unable to read another\n  // linked container. Validate the targets that are cited without inventing\n  // paths for uncited targets or dropping signed ancestor evidence.\n  for (const target of targets) {\n    const path = dependencyContainerPaths.find(\n      (candidate) =>\n        candidate.at(-1)?.manifestHash === target.containerManifestHash,\n    );\n    if (!path) continue;\n    const leaf = path.at(-1);\n    if (\n      !leaf ||\n      leaf.state.containerId !== target.containerId ||\n      leaf.state.organizationId !== input.plan.organizationId ||\n      leaf.state.containerKeyEpochId !== target.containerKeyEpochId\n    ) {\n      throw new Error(\n        \"Document sync response write target lacks a verified container path\",\n      );\n    }\n  }\n  const authorizingContainerPaths = dependencyContainerPaths;\n  const documentKekTargets = makeVerifiedDocumentKekTargets({\n    documentId: input.contentKeyBundle.documentId,\n    documentKeyTargetHash: input.targetHash,\n    linkedContainerKeyEpochIds: targets.map(\n      (target) => target.containerKeyEpochId,\n    ),\n    linkedContainerManifestHashes: targets.map(\n      (target) => target.containerManifestHash,\n    ),\n    linkSetManifestHash: input.manifestHash,\n    targets,\n  });\n  return {\n    authorizingContainerPaths,\n    documentKekTargets,\n    documentManifest,\n    principalPolicies: source.principalPolicies,\n  };\n}\n"]}

package/data/documents/shared/{syncResponses.d.ts → sync/syncResponses.d.ts}

@@ -1,6 +1,6 @@
-import { type DocumentSyncResponse } from "../../../internal/validators/response/index.js";
+import { type DocumentSyncResponse } from "../../../../internal/validators/response/index.js";
 export { submitDocumentSync } from "./syncPagination.js";
-import type { DocumentSyncPlan, DocumentSyncSubmitFailure, DocumentWriterPublicKeyResolver, PersistedDocumentSyncState } from "./types.js";
+import type { DocumentSyncPlan, DocumentSyncSubmitFailure, DocumentWriterPublicKeyResolver, PersistedDocumentSyncState } from "../types.js";
 export declare class DocumentSyncResponseUpdateContentKeyError extends Error {
     constructor(message: string);
 }

package/data/documents/shared/{syncResponses.js → sync/syncResponses.js}

@@ -1,9 +1,9 @@
-import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, verifyWriteHeader, } from "../../../internal/crypto/index.js";
-import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
-import { DOCUMENT_NOT_FOUND_ERROR_CODE, DOCUMENT_SYNC_ERROR_CODES, } from "../../../internal/validators/response/index.js";
-import { parseWalLsn } from "../../../internal/validators/util/index.js";
-import { throwKeyingVerificationShapeFailure } from "../../keyingProjectionVerification/error.js";
-import { readRecordPositiveInteger, readRecordString, readWriteHeader, serializeCanonical, serializedPersistedDocumentState, } from "./readers.js";
+import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, verifyWriteHeader, } from "../../../../internal/crypto/index.js";
+import { isPlainObject as isPlainRecord } from "../../../../internal/validators/isPlainObject.js";
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, DOCUMENT_SYNC_ERROR_CODES, } from "../../../../internal/validators/response/index.js";
+import { parseWalLsn } from "../../../../internal/validators/util/index.js";
+import { throwKeyingVerificationShapeFailure } from "../../../keyingProjectionVerification/error.js";
+import { readRecordPositiveInteger, readRecordString, readWriteHeader, serializeCanonical, serializedPersistedDocumentState, } from "../readers.js";
 export { submitDocumentSync } from "./syncPagination.js";
 import { documentWriteAuthorizationForHeader } from "./syncResponseAuthorization.js";
 // Remote-primary databases without a portable WAL position use the zero LSN

package/data/documents/shared/sync/syncResponses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncResponses.js","sourceRoot":"","sources":["syncResponses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AAClG,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQtD,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAElF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAClE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,wCAAwC,CAC/C,IAAsB,EACtB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IACE,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2CAA2C,CAAC,KAQ1D;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC;IACF,MAAM,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;QACxE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM;QACN,IAAI;KACL,CAAC,CAAC;IACH,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,qCAAqC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,8CAA8C,CAAC;QACnD,MAAM;QACN,gBAAgB;QAChB,IAAI;QACJ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gDAAgD,CAAC,KAOzD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,IAAI,yCAAyC,CACjD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yCAAyC,CACjD,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACrC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAErD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,0CAA0C,CACrE,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,IACE,cAAc;QACd,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,IACE,YAAY;QACZ,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,2CAA2C,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5E,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;QACnC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC7C,MAAM,CAAC,eAAe,KAAK,+BAA+B;QAC1D,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,iBAAiB;QACxD,CAAC,wBAAwB;YACvB,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC9C,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,2BAA2B;gBAC9D,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,MAA+C;IAE/C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CACtC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qCAAqC,CAAC,KAGpD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAC;IACH,IAAI,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAM7D;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;QACzD,2BAA2B,EAAE,MAAM,CAAC,oBAAoB;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,yBAAyB,EAAE,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC;QACrE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,0BAA0B,EAAE,qBAAqB;YAC/C,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,IAAI,CAAC,2BAA2B;QACpC,cAAc,EAAE;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;QACD,MAAM;QACN,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,kBAAkB,EAAE,qBAAqB;YACvC,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,IAAI,CAAC,kBAAkB;QAC3B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,6CAA6C,CACpD,IAAsB,EACtB,QAA8B;IAE9B,IACE,QAAQ,CAAC,aAAa,KAAK,WAAW;QACtC,QAAQ,CAAC,SAAS,KAAK,oBAAoB,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CACxB,IAAI,CAAC,MAAM,EACX,qCAAqC,CACtC,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IACE,CAAC,CACC,QAAQ,CAAC,SAAS,KAAK,oBAAoB;QAC3C,QAAQ,CAAC,aAAa,KAAK,WAAW,CACvC;QACD,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAClE,MAAM,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,yBAAyB,CAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAC3B,OAAO,EACP,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,qDAAqD;AACrD,SAAS,yCAAyC,CAChD,IAAsB,EACtB,QAA8B;IAE9B,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,WAAW,GAAG,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgD;IAEhD,OAAO,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oCAAoC,CAC3C,IAAsB,EACtB,QAA8B;IAE9B,IACE,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpD,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,CAAC,eAAe,IAAI,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8CAA8C,CAC3D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,wBAAwB,GAAG,oCAAoC,CACnE,IAAI,EACJ,QAAQ,CACT,CAAC;IACF,IACE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC9D,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,wCAAwC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,6CAA6C,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9D,yCAAyC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,2CAA2C,CAAC;QAC1C,wBAAwB;QACxB,IAAI;QACJ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IAEF,OAAO,gCAAgC,CAAC;QACtC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAsB,EACtB,QAA8B,EAC9B,OAEC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,8CAA8C,CACzD,IAAI,EACJ,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yCAAyC;YAAE,MAAM,KAAK,CAAC;QAC5E,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,UAAU,CACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,UAAU,oCAAoC,CAClD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,6BAA6B,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  verifyWriteHeader,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  DOCUMENT_SYNC_ERROR_CODES,\n  type DocumentSyncResponse,\n} from \"@tearleads/validators/response\";\nimport { parseWalLsn } from \"@tearleads/validators/util\";\nimport { throwKeyingVerificationShapeFailure } from \"../../../keyingProjectionVerification/error\";\nimport {\n  readRecordPositiveInteger,\n  readRecordString,\n  readWriteHeader,\n  serializeCanonical,\n  serializedPersistedDocumentState,\n} from \"../readers\";\n\nexport { submitDocumentSync } from \"./syncPagination\";\n\nimport type {\n  DocumentSyncPlan,\n  DocumentSyncSubmitFailure,\n  DocumentWriterPublicKeyResolver,\n  PersistedDocumentSyncState,\n} from \"../types\";\nimport { documentWriteAuthorizationForHeader } from \"./syncResponseAuthorization\";\n\n// Remote-primary databases without a portable WAL position use the zero LSN\n// as an explicit \"checkpoint not tracked\" sentinel. It is accepted only when\n// the response declares that mode, letting a local record carrying a checkpoint\n// from another backend move to that primary without weakening tracked checks.\n// This protects against replica lag, not a server that falsely declares its own\n// consistency capability; the authenticated server remains the source of data.\nconst UNTRACKED_COMMIT_LSN = \"0/0\";\n\nexport class DocumentSyncResponseUpdateContentKeyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DocumentSyncResponseUpdateContentKeyError\";\n  }\n}\n\nfunction assertAcceptedOutgoingUpdateIdsMatchPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const expected = plan.request.outgoingUpdates.map((update) => update.id);\n  const accepted = response.acceptedOutgoingUpdateIds;\n  const expectedSorted = [...expected].sort();\n  const acceptedSorted = [...accepted].sort();\n  if (\n    expectedSorted.length !== acceptedSorted.length ||\n    expectedSorted.some((id, index) => id !== acceptedSorted[index])\n  ) {\n    throw new Error(\"Document sync response accepted update mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseUpdateMatchesPlan(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n}): Promise<void> {\n  const { plan, update } = input;\n  if (update.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response update document mismatch\");\n  }\n  const header = readWriteHeader(\n    update.writeHeader,\n    \"Document sync response write header\",\n  );\n  await assertDocumentSyncResponseUpdateHashes({ update });\n  const contentKeyBundle = assertDocumentSyncResponseUpdateContentKeyBundle({\n    contentKeyBundlesByEpoch: input.contentKeyBundlesByEpoch,\n    header,\n    plan,\n  });\n  assertDocumentSyncResponseWriteHeaderFields({ header, plan, update });\n  await assertDocumentSyncResponseNonceDomain({ header, plan });\n  await assertDocumentSyncResponseWriteHeaderSignature({\n    header,\n    contentKeyBundle,\n    plan,\n    resolveWriterPublicKey: input.resolveWriterPublicKey,\n    update,\n  });\n}\n\nfunction assertDocumentSyncResponseUpdateContentKeyBundle(input: {\n  contentKeyBundlesByEpoch: ReadonlyMap<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >;\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): DocumentSyncResponse[\"contentKeyBundle\"] {\n  const { header, plan } = input;\n  if (header.contentKeyEpoch > plan.contentKeyEpoch) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response includes a future content-key epoch\",\n    );\n  }\n\n  const bundle = input.contentKeyBundlesByEpoch.get(header.contentKeyEpoch);\n  if (!bundle) {\n    throw new DocumentSyncResponseUpdateContentKeyError(\n      \"Document sync response content-key bundle missing\",\n    );\n  }\n  if (\n    bundle.documentId !== plan.documentId ||\n    bundle.contentKeyEpoch !== header.contentKeyEpoch\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n  return bundle;\n}\n\nasync function assertDocumentSyncResponseUpdateHashes(input: {\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { update } = input;\n  const ciphertextHash = await computeDocumentContentRecordCiphertextHash(\n    update.encryptedData,\n  );\n  if (\n    ciphertextHash !==\n    readRecordString(update.writeHeader, \"ciphertextHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response ciphertext hash mismatch\");\n  }\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(update.checkpointKind === undefined\n      ? {}\n      : { checkpointKind: update.checkpointKind }),\n    ...(update.checkpointPayloadKind === undefined\n      ? {}\n      : { checkpointPayloadKind: update.checkpointPayloadKind }),\n    documentId: update.documentId,\n    partialEndVersionVector: update.partialEndVersionVector,\n    partialStartVersionVector: update.partialStartVersionVector,\n    plaintextHash: update.plaintextHash,\n    ...(update.sourceVersionVector === undefined\n      ? {}\n      : { sourceVersionVector: update.sourceVersionVector }),\n    updateId: update.id,\n  });\n  if (\n    metadataHash !==\n    readRecordString(update.writeHeader, \"metadataHash\", \"write header\")\n  ) {\n    throw new Error(\"Document sync response metadata hash mismatch\");\n  }\n}\n\nfunction assertDocumentSyncResponseWriteHeaderFields(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): void {\n  const { header, plan, update } = input;\n  const mustMatchCurrentBoundary = isAcceptedOutgoingSyncUpdate(plan, update);\n\n  if (\n    header.version !== 1 ||\n    header.objectKind !== \"document\" ||\n    header.objectId !== plan.documentId ||\n    header.organizationId !== plan.organizationId ||\n    header.encryptionSuite !== CONTENT_RECORD_ENCRYPTION_SUITE ||\n    header.writerKeyFingerprint !== update.authorFingerprint ||\n    (mustMatchCurrentBoundary &&\n      (header.contentKeyEpoch !== plan.contentKeyEpoch ||\n        header.accessManifestHash !== plan.expectedLinkSetManifestHash ||\n        header.targetHash !== plan.expectedTargetHash))\n  ) {\n    throw new Error(\"Document sync response write header mismatch\");\n  }\n}\n\nfunction isAcceptedOutgoingSyncUpdate(\n  plan: DocumentSyncPlan,\n  update: DocumentSyncResponse[\"updates\"][number],\n): boolean {\n  return plan.request.outgoingUpdates.some(\n    (outgoingUpdate) => outgoingUpdate.id === update.id,\n  );\n}\n\nasync function assertDocumentSyncResponseNonceDomain(input: {\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n}): Promise<void> {\n  const { header, plan } = input;\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: plan.organizationId,\n    objectKind: \"document\",\n    objectId: plan.documentId,\n    contentKeyEpoch: header.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: header.contentRecordId,\n  });\n  if (nonceDomainHash !== header.nonceDomainHash) {\n    throw new Error(\"Document sync response nonce domain mismatch\");\n  }\n}\n\nasync function assertDocumentSyncResponseWriteHeaderSignature(input: {\n  contentKeyBundle: DocumentSyncResponse[\"contentKeyBundle\"];\n  header: WriteHeader;\n  plan: DocumentSyncPlan;\n  resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  update: DocumentSyncResponse[\"updates\"][number];\n}): Promise<void> {\n  const { header, plan, update } = input;\n  const writerPublicKey = await input.resolveWriterPublicKey({\n    writerSigningKeyFingerprint: header.writerKeyFingerprint,\n    writerUserId: header.writerUserId,\n  });\n  if (!writerPublicKey) {\n    throw new Error(\"Document sync response writer public key missing\");\n  }\n\n  const documentAuthorization = await documentWriteAuthorizationForHeader({\n    allowMissingAuthorization: isAcceptedOutgoingSyncUpdate(plan, update),\n    authorizationTargets: update.authorizationTargets,\n    dependencyManifestHashes: header.dependencyManifestHashes,\n    contentKeyBundle: input.contentKeyBundle,\n    manifestHash: header.accessManifestHash,\n    plan,\n    targetHash: header.targetHash,\n  });\n  const verified = await verifyWriteHeader({\n    authorizationMembership: \"referenced\",\n    expectedAccessManifestHash: documentAuthorization\n      ? header.accessManifestHash\n      : plan.expectedLinkSetManifestHash,\n    expectedObject: {\n      objectKind: \"document\",\n      objectId: plan.documentId,\n      organizationId: plan.organizationId,\n    },\n    header,\n    ...(documentAuthorization ? { documentAuthorization } : {}),\n    expectedTargetHash: documentAuthorization\n      ? header.targetHash\n      : plan.expectedTargetHash,\n    writerPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n}\n\nfunction assertDocumentSyncCommitCheckpointMatchesPlan(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  if (\n    response.commitLsnMode === \"untracked\" &&\n    response.commitLsn !== UNTRACKED_COMMIT_LSN\n  ) {\n    throw new Error(\n      \"Document sync response untracked commit LSN must use the 0/0 sentinel\",\n    );\n  }\n  if (\n    response.commitLsn === UNTRACKED_COMMIT_LSN &&\n    response.commitLsnMode !== \"untracked\"\n  ) {\n    throw new Error(\n      \"Document sync response 0/0 commit LSN must be declared untracked\",\n    );\n  }\n  if (response.commitLsn !== null) {\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\");\n  }\n  if (plan.minLsn === undefined) {\n    return;\n  }\n  const minLsn = parseWalLsn(\n    plan.minLsn,\n    \"Document sync requested minimum LSN\",\n  );\n  if (response.commitLsn === null) {\n    throw new Error(\"Document sync response commit LSN is missing\");\n  }\n  if (\n    !(\n      response.commitLsn === UNTRACKED_COMMIT_LSN &&\n      response.commitLsnMode === \"untracked\"\n    ) &&\n    parseWalLsn(response.commitLsn, \"Document sync response commit LSN\") <\n      minLsn\n  ) {\n    throw new Error(\"Document sync response commit LSN is stale\");\n  }\n}\n\nfunction documentSyncManifestEpoch(plan: DocumentSyncPlan): number {\n  if (!isPlainRecord(plan.documentManifest.state)) {\n    throw new Error(\"Document sync manifest state is invalid\");\n  }\n\n  return readRecordPositiveInteger(\n    plan.documentManifest.state,\n    \"epoch\",\n    \"Document sync manifest state\",\n  );\n}\n\n// The one load-bearing epoch check: no returned update may claim an\n// accessEpoch newer than the current manifest epoch.\nfunction assertDocumentSyncAccessEpochsNotInFuture(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): void {\n  const currentAccessEpoch = documentSyncManifestEpoch(plan);\n  for (const update of response.updates) {\n    if (update.accessEpoch > currentAccessEpoch) {\n      throw new Error(\"Document sync response includes a future access epoch\");\n    }\n  }\n}\n\nfunction contentKeyBundleCanonical(\n  bundle: DocumentSyncResponse[\"contentKeyBundle\"],\n): string {\n  return serializeCanonical(bundle, \"content-key bundle\");\n}\n\nfunction documentSyncContentKeyBundlesByEpoch(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n): ReadonlyMap<number, DocumentSyncResponse[\"contentKeyBundle\"]> {\n  if (\n    contentKeyBundleCanonical(response.contentKeyBundle) !==\n    contentKeyBundleCanonical(plan.sourceContentKeyBundle)\n  ) {\n    throw new Error(\"Document sync response content-key bundle mismatch\");\n  }\n\n  const bundleByEpoch = new Map<\n    number,\n    DocumentSyncResponse[\"contentKeyBundle\"]\n  >();\n  const bundles = [response.contentKeyBundle, ...response.contentKeyBundles];\n\n  for (const bundle of bundles) {\n    if (bundle.documentId !== plan.documentId) {\n      throw new Error(\n        \"Document sync response content-key bundle document mismatch\",\n      );\n    }\n    if (\n      !Number.isInteger(bundle.contentKeyEpoch) ||\n      bundle.contentKeyEpoch <= 0\n    ) {\n      throw new Error(\n        \"Document sync response content-key bundle epoch mismatch\",\n      );\n    }\n\n    // The current epoch travels only as contentKeyBundle; the array carries\n    // each older epoch once.\n    if (bundleByEpoch.has(bundle.contentKeyEpoch)) {\n      throw new Error(\"Document sync response repeats a content-key epoch\");\n    }\n    bundleByEpoch.set(bundle.contentKeyEpoch, bundle);\n  }\n\n  return bundleByEpoch;\n}\n\nasync function persistedDocumentSyncStateFromResponseInternal(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  if (response.documentId !== plan.documentId) {\n    throw new Error(\"Document sync response document id mismatch\");\n  }\n  const contentKeyBundlesByEpoch = documentSyncContentKeyBundlesByEpoch(\n    plan,\n    response,\n  );\n  if (\n    serializeCanonical(response.documentKekTargets, \"KEK targets\") !==\n    serializeCanonical(plan.documentKekTargets, \"KEK targets\")\n  ) {\n    throw new Error(\"Document sync response KEK target mismatch\");\n  }\n  assertAcceptedOutgoingUpdateIdsMatchPlan(plan, response);\n  assertDocumentSyncCommitCheckpointMatchesPlan(plan, response);\n  assertDocumentSyncAccessEpochsNotInFuture(plan, response);\n\n  await Promise.all(\n    response.updates.map((update) =>\n      assertDocumentSyncResponseUpdateMatchesPlan({\n        contentKeyBundlesByEpoch,\n        plan,\n        resolveWriterPublicKey: options.resolveWriterPublicKey,\n        update,\n      }),\n    ),\n  );\n\n  return serializedPersistedDocumentState({\n    contentKeyBundle: response.contentKeyBundle,\n    documentId: plan.documentId,\n    documentKekTargets: response.documentKekTargets,\n    documentManifestBundle: plan.documentManifest,\n  });\n}\n\nexport async function persistedDocumentSyncStateFromResponse(\n  plan: DocumentSyncPlan,\n  response: DocumentSyncResponse,\n  options: {\n    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;\n  },\n): Promise<PersistedDocumentSyncState> {\n  try {\n    return await persistedDocumentSyncStateFromResponseInternal(\n      plan,\n      response,\n      options,\n    );\n  } catch (error) {\n    if (error instanceof DocumentSyncResponseUpdateContentKeyError) throw error;\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function isRetryableDocumentSyncConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.stateStale\n  );\n}\n\n// The wipe gate is deliberately strict — coded 404s only, which is the right\n// failure mode for a destructive action. A bare 404 proves nothing about the\n// document: proxy/tunnel error pages, deploy-skew route misses, and\n// container-level lookups all produce one.\nexport function isUpstreamDeletedDocumentSyncFailure(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 404 && failure.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n  );\n}\n"]}

package/data/documents/shared/{syncSubmitFailure.d.ts → sync/syncSubmitFailure.d.ts}

@@ -1,4 +1,4 @@
-import type { ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import type { ReferencedPrincipalStateResponse } from "../../../../internal/validators/response/index.js";
 export interface DocumentSyncSubmitFailure {
     readonly code?: string | undefined;
     readonly message: string;

package/data/documents/shared/types.d.ts

@@ -4,10 +4,10 @@ import type { ContainerManifestRef, DocumentContentKeyTargetEnvelope, DocumentCr
 import type { ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentLinkSetMutationResponse, DocumentPurgeProofResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListDocumentAttachmentsResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerRekeyApi } from "../../containers/shared/types.js";
 import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer, DocumentWriterProjectionAuthorization as WriterAuthorization } from "../../keyingProjectionVerification/index.js";
-import type { DocumentRecord } from "../../sqlite/documentPersistence.js";
+import type { DocumentRecord } from "../../sqlite/documentPersistence/index.js";
 import type { ExecSql } from "../../sqlite/sqlSchema.js";
-import type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
-export type { DocumentSyncSubmitFailure } from "./syncSubmitFailure.js";
+import type { DocumentSyncSubmitFailure } from "./sync/syncSubmitFailure.js";
+export type { DocumentSyncSubmitFailure } from "./sync/syncSubmitFailure.js";
 export declare const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT = "tearleads.document.loro-update";
 export declare const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN = "tearleads.document.content-record-key-info";
 export declare const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN = "tearleads.document.content-record-plaintext-hash-key-info";

package/data/documents/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF,MAAM,CAAC,MAAM,qCAAqC,GAChD,gCAAgC,CAAC;AACnC,MAAM,CAAC,MAAM,uCAAuC,GAClD,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,sDAAsD,GACjE,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAC7C,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,iCAAiC,GAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAsB9C,MAAM,UAAU,yBAAyB,CACvC,KAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yEAAyE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iFAAiF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,CAAC;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,MAAM;YACT,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,MAAM;gBACT,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  DocumentContentKeyTarget,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentUnlinkAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n  DocumentCreateRequest,\n  DocumentLinkSetMutationRequest,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentPurgeProofResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n} from \"../../containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n  DocumentWriterProjectionAuthorization as WriterAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { requireProjectionUserKeyResolver } from \"../../keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport type { DocumentSyncSubmitFailure } from \"./syncSubmitFailure\";\n\nexport const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT =\n  \"tearleads.document.loro-update\";\nexport const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-plaintext-hash-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.document.content-record-aad\";\nexport const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.document.content-record-hkdf-salt\");\nexport const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([\n  \"ciphertext\",\n  \"contentKeyEpoch\",\n  \"contentRecordId\",\n  \"encryptionSuite\",\n  \"format\",\n  \"iv\",\n  \"metadataHash\",\n  \"nonceDomainHash\",\n  \"version\",\n]);\nexport const TEXT_ENCODER = new TextEncoder();\ninterface ProjectionVerificationBase {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport type ProjectionVerificationOptions = ProjectionVerificationBase &\n  (\n    | {\n        readonly execSql: ExecSql;\n        readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n        readonly trustedLocalProjection?: undefined;\n      }\n    | {\n        readonly execSql?: ExecSql | undefined;\n        readonly resolveProjectionUserKey?: undefined;\n        readonly trustedLocalProjection: true;\n      }\n  );\n\nexport function resolveProjectionVerifier(\n  input: ProjectionVerificationOptions,\n  label: string,\n): ProjectionUserKeyResolver | null {\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        `${label} cannot combine projection key verification with local projection trust`,\n      );\n    }\n    return requireProjectionUserKeyResolver(\n      input.resolveProjectionUserKey,\n      label,\n    );\n  }\n  if (input.trustedLocalProjection === true) {\n    return null;\n  }\n  throw new Error(\n    `${label} requires projection key verification or an explicitly trusted local projection`,\n  );\n}\n\nexport function projectionVerificationOptions(\n  input: ProjectionVerificationOptions,\n): ProjectionVerificationOptions {\n  const warm = input.warmReferencedPrincipalPolicies;\n  const shared = {\n    ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n    ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),\n  };\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        \"Projection use cannot combine key verification with local projection trust\",\n      );\n    }\n    return {\n      execSql: input.execSql,\n      ...shared,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    };\n  }\n  if (input.trustedLocalProjection === true) {\n    return input.execSql\n      ? {\n          execSql: input.execSql,\n          ...shared,\n          trustedLocalProjection: true,\n        }\n      : { ...shared, trustedLocalProjection: true };\n  }\n\n  throw new Error(\n    \"Projection use requires key verification or an explicitly trusted local projection\",\n  );\n}\n\nexport type DocumentCreateAuthor = ContainerMutationAuthor;\n\nexport interface BuildDocumentCreatePlanInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  contentKeyEpoch?: number;\n  documentId?: string;\n  eventId?: string;\n  signedAt?: string;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n}\n\nexport interface DocumentCreatePlan {\n  body: DocumentLinkAccessEventBody;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  request: DocumentCreateRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentCreatePlan {\n  contentKey: Uint8Array;\n  plan: DocumentCreatePlan;\n}\n\nexport interface DocumentCreateApi {\n  // Lets idempotent create inspect an expected already-exists conflict.\n  createDocumentResult(\n    input: DocumentCreateRequest,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentCreateResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  // Result-returning variant used by the create path so a terminal projection\n  // fetch failure (e.g. a 402 billing block or a 403 after access revocation)\n  // can be persisted to the write queue instead of collapsing to a silent\n  // null.\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  // Needed to adopt an existing remote document on a create conflict: the\n  // committed manifest, content-key bundle and KEK targets are refetched here\n  // (the create response that carried them was lost).\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  evictContainerWriterProjection(containerId: string): void;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nexport interface CreateRemoteDocumentResult {\n  contentKey: Uint8Array;\n  documentId: string;\n  persistedState: PersistedDocumentCreateState;\n  // `plan` and `response` are absent when the result was adopted from an\n  // existing remote document on a create conflict: there is no fresh create\n  // response, and the local plan does not match the committed manifest (the\n  // first attempt used a different content key). Consumers read only\n  // documentId/writerProjection/persistedState.\n  plan?: DocumentCreatePlan | undefined;\n  response?: DocumentCreateResponse | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport type DocumentLinkSetMutationOperation = \"link\" | \"unlink\";\nexport type DocumentLinkSetMutationBody =\n  | DocumentLinkAccessEventBody\n  | DocumentUnlinkAccessEventBody;\n\nexport interface DocumentLinkSetTargetState {\n  readonly currentTargets: readonly DocumentContentKeyTarget[];\n  readonly linkedContainerIds: readonly string[];\n  readonly target: DocumentContentKeyTarget;\n  readonly targets: readonly DocumentContentKeyTarget[];\n}\n\nexport interface BuildDocumentLinkSetMutationPlanInput {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  eventId?: string | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  signedAt?: string | undefined;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DocumentLinkSetMutationPlan {\n  body: DocumentLinkSetMutationBody;\n  contentKeyEpoch: number;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentLinkSetMutationPlan {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  plan: DocumentLinkSetMutationPlan;\n}\n\nexport interface DocumentLinkSetEventPlan {\n  authorizingContainerPathRefs: ContainerManifestRef[][];\n  body: DocumentLinkSetMutationBody;\n  event: AccessEvent;\n  eventHash: string;\n}\n\n/**\n * What a failed link-set mutation could tell the caller: the HTTP status (or\n * null for network/local failures) and a short message. Threaded up to the\n * move-intent queue so a permission failure reads as one, instead of the\n * generic \"rejected or unavailable\".\n */\nexport type DocumentLinkSetMutationFailure = Pick<\n  DocumentSyncSubmitFailure,\n  \"code\" | \"message\" | \"status\"\n>;\n\nexport type DocumentLinkSetFailureHandler = (\n  failure: DocumentLinkSetMutationFailure,\n) => void;\n\ntype DocumentLinkSetMutationResult =\n  | { readonly data: DocumentLinkSetMutationResponse; readonly ok: true }\n  | (DocumentLinkSetMutationFailure & { readonly ok: false });\n\nexport interface DocumentLinkSetMutationApi {\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n  linkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n  unlinkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n}\n\nexport interface RelinkRemoteDocumentResult {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  documentId: string;\n  linkedContainerIds: readonly string[];\n  persistedState: PersistedDocumentCreateState;\n  plan: DocumentLinkSetMutationPlan;\n  response: DocumentLinkSetMutationResponse;\n}\n\nexport interface DocumentSyncPreparedUpdate {\n  checkpointKind?: DocumentOutgoingUpdate[\"checkpointKind\"] | undefined;\n  checkpointPayloadKind?:\n    | DocumentOutgoingUpdate[\"checkpointPayloadKind\"]\n    | undefined;\n  ciphertextHash: string;\n  contentRecordId?: string | undefined;\n  encryptedData: string;\n  id: string;\n  metadataHash: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  plaintextHash: string;\n  signedAt?: string | undefined;\n  sourceVersionVector?: string | undefined;\n}\n\nexport interface DocumentEncryptedPendingUpdate {\n  contentRecordId: string;\n  encryptedData: string;\n  metadataHash: string;\n  ciphertextHash: string;\n  plaintextHash: string;\n}\n\nexport interface ParsedDocumentEncryptedUpdate {\n  ciphertext: Uint8Array;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  iv: Uint8Array;\n}\n\nexport interface DecryptedDocumentSyncUpdate {\n  checkpointKind?: \"rotate_baseline\";\n  checkpointPayloadKind?: \"full_history_snapshot\";\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  sourceVersionVector?: string;\n  updateData: Uint8Array;\n}\n\nexport interface BuildDocumentSyncPlanInput {\n  author: DocumentCreateAuthor;\n  authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];\n  containerRekeys?: DocumentSyncRequest[\"containerRekeys\"];\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentId?: string | undefined;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  historyMode?: \"raw\" | undefined;\n  inlineRekeyCommitId?: string | undefined;\n  localVersionVector: string | null;\n  minLsn?: string | undefined;\n  outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;\n  pullCursor?: string | undefined;\n  signedAt?: string | undefined;\n}\n\nexport interface DocumentSyncPlan {\n  contentKeyEpoch: number;\n  documentId: string;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  documentWriterAuthorization?: WriterAuthorization | undefined;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  minLsn?: string | undefined;\n  organizationId: string;\n  request: DocumentSyncRequest;\n  sourceContentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n}\n\nexport interface MaterializedDocumentSyncPlan {\n  contentKey: Uint8Array;\n  /**\n   * True when the plan carries a re-wrapped content-key bundle at the next\n   * epoch to heal a stale bundle (a linked container's KEK rotated under it).\n   * On submit success the caller must evict this document's cached writer\n   * projection so later passes see the healed state instead of re-healing.\n   */\n  healedStaleContentKeyBundle: boolean;\n  /**\n   * Pending-queue ids a heal deliberately did NOT submit (superseded rotation\n   * checkpoints). On heal success they are reported as settled — the\n   * committed covering baseline subsumes their content, and resubmitting them\n   * post-heal could mask it as the latest baseline at the healed epoch.\n   */\n  heldBackPendingUpdateIds: readonly string[];\n  plan: DocumentSyncPlan;\n  writerProjection: DocumentWriterProjectionResponse;\n  /** Synthetic baseline id; its ack does not settle a pending queue row. */\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nexport interface SyncRemoteDocumentResult {\n  contentKey: Uint8Array;\n  decryptedUpdates: DecryptedDocumentSyncUpdate[];\n  /**\n   * Pending updates whose persisted re-key bound is exhausted. Non-zero means\n   * a terminal failure was just recorded for them — callers must not treat\n   * the pass as clean and clear it.\n   */\n  exhaustedPendingUpdateCount: number;\n  /**\n   * True only when this bounded pass made durable progress but left pending\n   * work. Headless hosts should refresh the queue and schedule another\n   * pass. Terminal exhaustion reports false and uses the failure callback.\n   */\n  hasDeferredPendingUpdates: boolean;\n  /** Verified page progress was persisted, but remote pages remain. */\n  hasIncompletePull: boolean;\n  persistedState: PersistedDocumentSyncState;\n  plan: DocumentSyncPlan;\n  rekeyedPendingUpdateIds: readonly string[];\n  response: DocumentSyncResponse;\n  settledPendingUpdateIds: readonly string[];\n  acceptedRecoveryBaseline: boolean;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DocumentSyncRequestResultOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n\nexport interface DocumentSyncApi {\n  rekeyContainer: ContainerRekeyApi[\"rekeyContainer\"];\n  /**\n   * Optional status-bearing rekey. Present on the real client; an adapter that\n   * omits it still repairs, but a permanent refusal cannot then be told from a\n   * transient one and is reported as a plain abandon.\n   */\n  rekeyContainerResult?: ContainerRekeyApi[\"rekeyContainerResult\"];\n  /**\n   * Optional. A repair that must carry descendant rekeys reads each one's\n   * projection; without this such a repair is refused and the pass abandons.\n   */\n  getContainerWriterProjection?: ContainerRekeyApi[\"getContainerWriterProjection\"];\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentPurgeProof?(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  syncDocumentResult(\n    documentId: string,\n    input: DocumentSyncRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<\n    | {\n        readonly data: DocumentSyncResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n}\n\nexport type DocumentWriterPublicKeyResolver = (input: {\n  writerSigningKeyFingerprint: string;\n  writerUserId: string;\n}) => Promise<Uint8Array | null>;\n\nexport type PersistedDocumentCreateState = Pick<\n  DocumentRecord,\n  | \"documentId\"\n  | \"contentKeyBundle\"\n  | \"documentKekTargets\"\n  | \"documentManifestBundle\"\n>;\n\nexport type PersistedDocumentSyncState = PersistedDocumentCreateState;\n\nexport interface UnwrappedContainerKek {\n  containerId: string;\n  /**\n   * Null for keyring-recovered historical keys, which carry key material and\n   * the epoch id committing to it but no epoch record to hash.\n   *\n   * Such a key still satisfies a parent wrap: the epoch-record fingerprint is\n   * a selector for choosing among envelopes, not the security boundary, so a\n   * null hash falls back to selecting on the epoch id while AEAD authenticates\n   * (see `containerKekPath.ts`). That is what lets a descendant pinned to a\n   * rotated parent be opened rather than stranded.\n   */\n  keyEpochHash: string | null;\n  keyMaterial: Uint8Array;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF,MAAM,CAAC,MAAM,qCAAqC,GAChD,gCAAgC,CAAC;AACnC,MAAM,CAAC,MAAM,uCAAuC,GAClD,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,sDAAsD,GACjE,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAC7C,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,iCAAiC,GAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAsB9C,MAAM,UAAU,yBAAyB,CACvC,KAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yEAAyE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iFAAiF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,CAAC;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,MAAM;YACT,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,MAAM;gBACT,sBAAsB,EAAE,IAAI;aAC7B;YACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytesResponse } from \"@tearleads/api-client\";\nimport type {\n  AccessEvent,\n  AccessManifest,\n  DocumentContentKeyTarget,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentUnlinkAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerManifestRef,\n  DocumentContentKeyTargetEnvelope,\n  DocumentCreateRequest,\n  DocumentLinkSetMutationRequest,\n  DocumentOutgoingUpdate,\n  DocumentSyncRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentPurgeProofResponse,\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n} from \"../../containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n  DocumentWriterProjectionAuthorization as WriterAuthorization,\n} from \"../../keyingProjectionVerification\";\nimport { requireProjectionUserKeyResolver } from \"../../keyingProjectionVerification\";\nimport type { DocumentRecord } from \"../../sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { DocumentSyncSubmitFailure } from \"./sync/syncSubmitFailure\";\n\nexport type { DocumentSyncSubmitFailure } from \"./sync/syncSubmitFailure\";\n\nexport const DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT =\n  \"tearleads.document.loro-update\";\nexport const DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN =\n  \"tearleads.document.content-record-plaintext-hash-key-info\";\nexport const DOCUMENT_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.document.content-record-aad\";\nexport const DOCUMENT_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.document.content-record-hkdf-salt\");\nexport const DOCUMENT_ENCRYPTED_UPDATE_KEYS = new Set([\n  \"ciphertext\",\n  \"contentKeyEpoch\",\n  \"contentRecordId\",\n  \"encryptionSuite\",\n  \"format\",\n  \"iv\",\n  \"metadataHash\",\n  \"nonceDomainHash\",\n  \"version\",\n]);\nexport const TEXT_ENCODER = new TextEncoder();\ninterface ProjectionVerificationBase {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport type ProjectionVerificationOptions = ProjectionVerificationBase &\n  (\n    | {\n        readonly execSql: ExecSql;\n        readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n        readonly trustedLocalProjection?: undefined;\n      }\n    | {\n        readonly execSql?: ExecSql | undefined;\n        readonly resolveProjectionUserKey?: undefined;\n        readonly trustedLocalProjection: true;\n      }\n  );\n\nexport function resolveProjectionVerifier(\n  input: ProjectionVerificationOptions,\n  label: string,\n): ProjectionUserKeyResolver | null {\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        `${label} cannot combine projection key verification with local projection trust`,\n      );\n    }\n    return requireProjectionUserKeyResolver(\n      input.resolveProjectionUserKey,\n      label,\n    );\n  }\n  if (input.trustedLocalProjection === true) {\n    return null;\n  }\n  throw new Error(\n    `${label} requires projection key verification or an explicitly trusted local projection`,\n  );\n}\n\nexport function projectionVerificationOptions(\n  input: ProjectionVerificationOptions,\n): ProjectionVerificationOptions {\n  const warm = input.warmReferencedPrincipalPolicies;\n  const shared = {\n    ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n    ...(warm ? { warmReferencedPrincipalPolicies: warm } : {}),\n  };\n  if (input.resolveProjectionUserKey) {\n    if (input.trustedLocalProjection === true) {\n      throw new Error(\n        \"Projection use cannot combine key verification with local projection trust\",\n      );\n    }\n    return {\n      execSql: input.execSql,\n      ...shared,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    };\n  }\n  if (input.trustedLocalProjection === true) {\n    return input.execSql\n      ? {\n          execSql: input.execSql,\n          ...shared,\n          trustedLocalProjection: true,\n        }\n      : { ...shared, trustedLocalProjection: true };\n  }\n\n  throw new Error(\n    \"Projection use requires key verification or an explicitly trusted local projection\",\n  );\n}\n\nexport type DocumentCreateAuthor = ContainerMutationAuthor;\n\nexport interface BuildDocumentCreatePlanInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  contentKeyEpoch?: number;\n  documentId?: string;\n  eventId?: string;\n  signedAt?: string;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n}\n\nexport interface DocumentCreatePlan {\n  body: DocumentLinkAccessEventBody;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  request: DocumentCreateRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentCreatePlan {\n  contentKey: Uint8Array;\n  plan: DocumentCreatePlan;\n}\n\nexport interface DocumentCreateApi {\n  // Lets idempotent create inspect an expected already-exists conflict.\n  createDocumentResult(\n    input: DocumentCreateRequest,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentCreateResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  // Result-returning variant used by the create path so a terminal projection\n  // fetch failure (e.g. a 402 billing block or a 403 after access revocation)\n  // can be persisted to the write queue instead of collapsing to a silent\n  // null.\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  // Needed to adopt an existing remote document on a create conflict: the\n  // committed manifest, content-key bundle and KEK targets are refetched here\n  // (the create response that carried them was lost).\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  evictContainerWriterProjection(containerId: string): void;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n}\n\nexport interface CreateRemoteDocumentResult {\n  contentKey: Uint8Array;\n  documentId: string;\n  persistedState: PersistedDocumentCreateState;\n  // `plan` and `response` are absent when the result was adopted from an\n  // existing remote document on a create conflict: there is no fresh create\n  // response, and the local plan does not match the committed manifest (the\n  // first attempt used a different content key). Consumers read only\n  // documentId/writerProjection/persistedState.\n  plan?: DocumentCreatePlan | undefined;\n  response?: DocumentCreateResponse | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport type DocumentLinkSetMutationOperation = \"link\" | \"unlink\";\nexport type DocumentLinkSetMutationBody =\n  | DocumentLinkAccessEventBody\n  | DocumentUnlinkAccessEventBody;\n\nexport interface DocumentLinkSetTargetState {\n  readonly currentTargets: readonly DocumentContentKeyTarget[];\n  readonly linkedContainerIds: readonly string[];\n  readonly target: DocumentContentKeyTarget;\n  readonly targets: readonly DocumentContentKeyTarget[];\n}\n\nexport interface BuildDocumentLinkSetMutationPlanInput {\n  blobRewraps: DocumentLinkAccessEventBody[\"blobRewraps\"];\n  author: DocumentCreateAuthor;\n  contentKeyEpoch: number;\n  eventId?: string | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  signedAt?: string | undefined;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  targetEnvelopes: readonly DocumentContentKeyTargetEnvelope[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DocumentLinkSetMutationPlan {\n  body: DocumentLinkSetMutationBody;\n  contentKeyEpoch: number;\n  documentId: string;\n  event: AccessEvent;\n  eventHash: string;\n  manifest: AccessManifest;\n  manifestHash: string;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  state: DocumentLinkSetManifestState;\n  targetHash: string;\n  targets: DocumentContentKeyTarget[];\n}\n\nexport interface MaterializedDocumentLinkSetMutationPlan {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  plan: DocumentLinkSetMutationPlan;\n}\n\nexport interface DocumentLinkSetEventPlan {\n  authorizingContainerPathRefs: ContainerManifestRef[][];\n  body: DocumentLinkSetMutationBody;\n  event: AccessEvent;\n  eventHash: string;\n}\n\n/**\n * What a failed link-set mutation could tell the caller: the HTTP status (or\n * null for network/local failures) and a short message. Threaded up to the\n * move-intent queue so a permission failure reads as one, instead of the\n * generic \"rejected or unavailable\".\n */\nexport type DocumentLinkSetMutationFailure = Pick<\n  DocumentSyncSubmitFailure,\n  \"code\" | \"message\" | \"status\"\n>;\n\nexport type DocumentLinkSetFailureHandler = (\n  failure: DocumentLinkSetMutationFailure,\n) => void;\n\ntype DocumentLinkSetMutationResult =\n  | { readonly data: DocumentLinkSetMutationResponse; readonly ok: true }\n  | (DocumentLinkSetMutationFailure & { readonly ok: false });\n\nexport interface DocumentLinkSetMutationApi {\n  getBlobBytes(blobId: string): Promise<BlobBytesResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n  getContainerWriterProjectionResult(\n    containerId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: ContainerWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  primeDocumentWriterProjection(\n    documentId: string,\n    projection: DocumentWriterProjectionResponse,\n  ): void;\n  linkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n  unlinkDocumentResult(\n    documentId: string,\n    input: DocumentLinkSetMutationRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentLinkSetMutationResult>;\n}\n\nexport interface RelinkRemoteDocumentResult {\n  contentKey: Uint8Array;\n  contentKeyRotated: boolean;\n  documentId: string;\n  linkedContainerIds: readonly string[];\n  persistedState: PersistedDocumentCreateState;\n  plan: DocumentLinkSetMutationPlan;\n  response: DocumentLinkSetMutationResponse;\n}\n\nexport interface DocumentSyncPreparedUpdate {\n  checkpointKind?: DocumentOutgoingUpdate[\"checkpointKind\"] | undefined;\n  checkpointPayloadKind?:\n    | DocumentOutgoingUpdate[\"checkpointPayloadKind\"]\n    | undefined;\n  ciphertextHash: string;\n  contentRecordId?: string | undefined;\n  encryptedData: string;\n  id: string;\n  metadataHash: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  plaintextHash: string;\n  signedAt?: string | undefined;\n  sourceVersionVector?: string | undefined;\n}\n\nexport interface DocumentEncryptedPendingUpdate {\n  contentRecordId: string;\n  encryptedData: string;\n  metadataHash: string;\n  ciphertextHash: string;\n  plaintextHash: string;\n}\n\nexport interface ParsedDocumentEncryptedUpdate {\n  ciphertext: Uint8Array;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  iv: Uint8Array;\n}\n\nexport interface DecryptedDocumentSyncUpdate {\n  checkpointKind?: \"rotate_baseline\";\n  checkpointPayloadKind?: \"full_history_snapshot\";\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  sourceVersionVector?: string;\n  updateData: Uint8Array;\n}\n\nexport interface BuildDocumentSyncPlanInput {\n  author: DocumentCreateAuthor;\n  authorizingContainerPathRefs?: readonly (readonly ContainerManifestRef[])[];\n  containerRekeys?: DocumentSyncRequest[\"containerRekeys\"];\n  contentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n  documentId?: string | undefined;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  historyMode?: \"raw\" | undefined;\n  inlineRekeyCommitId?: string | undefined;\n  localVersionVector: string | null;\n  minLsn?: string | undefined;\n  outgoingUpdates?: readonly DocumentSyncPreparedUpdate[] | undefined;\n  pullCursor?: string | undefined;\n  signedAt?: string | undefined;\n}\n\nexport interface DocumentSyncPlan {\n  contentKeyEpoch: number;\n  documentId: string;\n  documentKekTargets: DocumentSyncResponse[\"documentKekTargets\"];\n  documentManifest: DocumentCreateResponse[\"accessManifest\"];\n  documentWriterAuthorization?: WriterAuthorization | undefined;\n  expectedLinkSetManifestHash: string;\n  expectedTargetHash: string;\n  minLsn?: string | undefined;\n  organizationId: string;\n  request: DocumentSyncRequest;\n  sourceContentKeyBundle: DocumentCreateResponse[\"contentKeyBundle\"];\n}\n\nexport interface MaterializedDocumentSyncPlan {\n  contentKey: Uint8Array;\n  /**\n   * True when the plan carries a re-wrapped content-key bundle at the next\n   * epoch to heal a stale bundle (a linked container's KEK rotated under it).\n   * On submit success the caller must evict this document's cached writer\n   * projection so later passes see the healed state instead of re-healing.\n   */\n  healedStaleContentKeyBundle: boolean;\n  /**\n   * Pending-queue ids a heal deliberately did NOT submit (superseded rotation\n   * checkpoints). On heal success they are reported as settled — the\n   * committed covering baseline subsumes their content, and resubmitting them\n   * post-heal could mask it as the latest baseline at the healed epoch.\n   */\n  heldBackPendingUpdateIds: readonly string[];\n  plan: DocumentSyncPlan;\n  writerProjection: DocumentWriterProjectionResponse;\n  /** Synthetic baseline id; its ack does not settle a pending queue row. */\n  staleRecoveryBaselineUpdateId?: string;\n}\n\nexport interface SyncRemoteDocumentResult {\n  contentKey: Uint8Array;\n  decryptedUpdates: DecryptedDocumentSyncUpdate[];\n  /**\n   * Pending updates whose persisted re-key bound is exhausted. Non-zero means\n   * a terminal failure was just recorded for them — callers must not treat\n   * the pass as clean and clear it.\n   */\n  exhaustedPendingUpdateCount: number;\n  /**\n   * True only when this bounded pass made durable progress but left pending\n   * work. Headless hosts should refresh the queue and schedule another\n   * pass. Terminal exhaustion reports false and uses the failure callback.\n   */\n  hasDeferredPendingUpdates: boolean;\n  /** Verified page progress was persisted, but remote pages remain. */\n  hasIncompletePull: boolean;\n  persistedState: PersistedDocumentSyncState;\n  plan: DocumentSyncPlan;\n  rekeyedPendingUpdateIds: readonly string[];\n  response: DocumentSyncResponse;\n  settledPendingUpdateIds: readonly string[];\n  acceptedRecoveryBaseline: boolean;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DocumentSyncRequestResultOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n  readonly reportErrors?: boolean | undefined;\n}\n\nexport interface DocumentSyncApi {\n  rekeyContainer: ContainerRekeyApi[\"rekeyContainer\"];\n  /**\n   * Optional status-bearing rekey. Present on the real client; an adapter that\n   * omits it still repairs, but a permanent refusal cannot then be told from a\n   * transient one and is reported as a plain abandon.\n   */\n  rekeyContainerResult?: ContainerRekeyApi[\"rekeyContainerResult\"];\n  /**\n   * Optional. A repair that must carry descendant rekeys reads each one's\n   * projection; without this such a repair is refused and the pass abandons.\n   */\n  getContainerWriterProjection?: ContainerRekeyApi[\"getContainerWriterProjection\"];\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentPurgeProof?(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: DocumentSyncRequestResultOptions,\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getDocumentWriterProjectionResult(\n    documentId: string,\n    options?: DocumentSyncRequestResultOptions | undefined,\n  ): Promise<\n    | {\n        readonly data: DocumentWriterProjectionResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n  syncDocumentResult(\n    documentId: string,\n    input: DocumentSyncRequest,\n    options?: DocumentSyncRequestResultOptions,\n  ): Promise<\n    | {\n        readonly data: DocumentSyncResponse;\n        readonly ok: true;\n      }\n    | DocumentSyncSubmitFailure\n  >;\n}\n\nexport type DocumentWriterPublicKeyResolver = (input: {\n  writerSigningKeyFingerprint: string;\n  writerUserId: string;\n}) => Promise<Uint8Array | null>;\n\nexport type PersistedDocumentCreateState = Pick<\n  DocumentRecord,\n  | \"documentId\"\n  | \"contentKeyBundle\"\n  | \"documentKekTargets\"\n  | \"documentManifestBundle\"\n>;\n\nexport type PersistedDocumentSyncState = PersistedDocumentCreateState;\n\nexport interface UnwrappedContainerKek {\n  containerId: string;\n  /**\n   * Null for keyring-recovered historical keys, which carry key material and\n   * the epoch id committing to it but no epoch record to hash.\n   *\n   * Such a key still satisfies a parent wrap: the epoch-record fingerprint is\n   * a selector for choosing among envelopes, not the security boundary, so a\n   * null hash falls back to selecting on the epoch id while AEAD authenticates\n   * (see `containerKekPath.ts`). That is what lets a descendant pinned to a\n   * rotated parent be opened rather than stranded.\n   */\n  keyEpochHash: string | null;\n  keyMaterial: Uint8Array;\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/accessManifestCheckpointEnforcement.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { advanceKeyingCheckpointsAtomically, validateKeyingCheckpointsAtomically, } from "../../persistence/keyingCheckpointAdvancePersistence.js";
+import { advanceKeyingCheckpointsAtomically, validateKeyingCheckpointsAtomically, } from "../../persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
 function objectKey(manifest) {
     const { objectKind, organizationId, objectId } = manifest.checkpoint;
     return JSON.stringify([objectKind, organizationId, objectId]);

package/data/keyingProjectionVerification/checkpoints/accessManifestCheckpointEnforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,sDAAsD,CAAC;AAK9D,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAYtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../../persistence/keyingCheckpointAdvancePersistence\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n"]}
+{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wEAAwE,CAAC;AAKhF,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAYtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../../persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/checkpointContext.d.ts

@@ -1,6 +1,6 @@
 import { type AccessManifestCheckpoint, type VerifiedAccessManifestCheckpointEvidence, type VerifiedContainerAccessManifest, type VerifiedPrincipalPolicySelection } from "../../../internal/crypto/index.js";
 import type { AccessManifestBundleWireResponse } from "../../../internal/validators/response/index.js";
-import type { DocumentPurgeCheckpoint } from "../../persistence/documentPurgeCheckpointPersistence.js";
+import type { DocumentPurgeCheckpoint } from "../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence.js";
 import type { VerifiedManifestBundle } from "../../persistence/verifiedManifestBundlePersistence.js";
 import type { PrincipalPolicyCheckpointEvidence } from "../../principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../../sqlite/sqlSchema.js";

package/data/keyingProjectionVerification/checkpoints/checkpointContext.js

@@ -1,6 +1,6 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
 import { rememberVerifiedContainerHeads } from "../../containers/shared/heldContainerHeads.js";
-import { PrincipalAuthorizationCheckpointUnavailableError } from "../../persistence/principalAuthorizationCheckpoints.js";
+import { PrincipalAuthorizationCheckpointUnavailableError } from "../../persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js";
 import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
 import { projectionLifetimeGuard } from "../projectionLifetimes.js";
 import { assertProjectionVerificationCurrent } from "../types.js";

package/data/keyingProjectionVerification/checkpoints/checkpointContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F,OAAO,EAAE,gDAAgD,EAAE,MAAM,qDAAqD,CAAC;AAIvH,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAgB/C,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,EAAE;QACzB,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,aAAoE,EACpE,cAGC;IAED,KAAK,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ;YACV,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { rememberVerifiedContainerHeads } from \"../../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/documentPurgeCheckpointPersistence\";\nimport { PrincipalAuthorizationCheckpointUnavailableError } from \"../../persistence/principalAuthorizationCheckpoints\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { projectionLifetimeGuard } from \"../projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"../types\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];\n  // Served bundles whose manifests verified, stored at finalization.\n  readonly verifiedBundles: VerifiedManifestBundle[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    authorizationPolicies: [],\n    verifiedBundles: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\n/**\n * Records each served bundle whose manifest this verification produced, so\n * the transaction finalizing the checkpoints also stores it for later\n * citation. A bundle the projection carried but verification never reached\n * is skipped.\n */\nexport function observeVerifiedProjectionBundles(\n  context: ProjectionCheckpointContext,\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<\n    string,\n    { readonly checkpoint: AccessManifestCheckpoint }\n  >,\n): void {\n  for (const [manifestHash, bundle] of bundlesByHash) {\n    const verified = verifiedByHash.get(manifestHash);\n    if (verified)\n      context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });\n  }\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}
+{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F,OAAO,EAAE,gDAAgD,EAAE,MAAM,uEAAuE,CAAC;AAIzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAgB/C,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,EAAE;QACzB,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,aAAoE,EACpE,cAGC;IAED,KAAK,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ;YACV,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { rememberVerifiedContainerHeads } from \"../../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence\";\nimport { PrincipalAuthorizationCheckpointUnavailableError } from \"../../persistence/keyingCheckpoints/principalAuthorizationCheckpoints\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { projectionLifetimeGuard } from \"../projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"../types\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];\n  // Served bundles whose manifests verified, stored at finalization.\n  readonly verifiedBundles: VerifiedManifestBundle[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    authorizationPolicies: [],\n    verifiedBundles: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\n/**\n * Records each served bundle whose manifest this verification produced, so\n * the transaction finalizing the checkpoints also stores it for later\n * citation. A bundle the projection carried but verification never reached\n * is skipped.\n */\nexport function observeVerifiedProjectionBundles(\n  context: ProjectionCheckpointContext,\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<\n    string,\n    { readonly checkpoint: AccessManifestCheckpoint }\n  >,\n): void {\n  for (const [manifestHash, bundle] of bundlesByHash) {\n    const verified = verifiedByHash.get(manifestHash);\n    if (verified)\n      context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });\n  }\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/manifestCheckpointVerification.js

@@ -1,5 +1,5 @@
 import { verifyAccessManifestLocalCheckpoint, } from "../../../internal/crypto/index.js";
-import { loadAccessManifestCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { loadAccessManifestCheckpoint } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
 /**
  * The local checkpoint for one object, read once per verification: every
  * checkpoint-enforced element of a served path reads its own checkpoint,

package/data/keyingProjectionVerification/checkpoints/manifestCheckpointVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifestCheckpointVerification.js","sourceRoot":"","sources":["manifestCheckpointVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAG7F;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,KAMhD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,OAAO,CACL,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QACjD,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QACzD,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAEtD,KAKD;IACC,MAAM,eAAe,GAAG,MAAM,iCAAiC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;KAC7C,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,eAAe;QAC5C,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,uBAAuB,CAAC;YACtB,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe;SAChB,CAAC,CACH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAQpD;IACC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU;YAC3B,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;SAClE;QACD,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  type VerifiedAccessManifestCheckpointEvidence,\n  verifyAccessManifestLocalCheckpoint,\n} from \"@tearleads/crypto\";\nimport { loadAccessManifestCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * The local checkpoint for one object, read once per verification: every\n * checkpoint-enforced element of a served path reads its own checkpoint,\n * and the atomic advance re-validates every checkpoint at commit.\n */\nasync function loadLocalAccessManifestCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly objectId: string;\n  readonly objectKind: AccessManifest[\"objectKind\"];\n  readonly organizationId: string;\n}): Promise<AccessManifestCheckpoint | null> {\n  const key = JSON.stringify([\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  ]);\n  const cached = input.localCheckpoints.get(key);\n  if (cached !== undefined) return cached;\n  const loaded = await loadAccessManifestCheckpoint(\n    input.execSql,\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  );\n  input.localCheckpoints.set(key, loaded);\n  return loaded;\n}\n\ninterface ManifestCheckpointVerificationInput<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n> {\n  readonly checkpointPredecessors: readonly TManifest[];\n  readonly localCheckpoint: AccessManifestCheckpoint | null;\n}\n\nfunction isCheckpointPredecessor(input: {\n  readonly candidate: VerifiedAccessManifestCheckpointEvidence;\n  readonly current: AccessManifest;\n  readonly localCheckpoint: AccessManifestCheckpoint;\n}): boolean {\n  const candidate = input.candidate.checkpoint;\n  return (\n    candidate.objectKind === input.current.objectKind &&\n    candidate.organizationId === input.current.organizationId &&\n    candidate.objectId === input.current.objectId &&\n    candidate.epoch > input.localCheckpoint.epoch &&\n    candidate.epoch < input.current.epoch\n  );\n}\n\nexport async function loadManifestCheckpointVerification<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n>(input: {\n  readonly current: AccessManifest;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<string, TManifest>;\n}): Promise<ManifestCheckpointVerificationInput<TManifest>> {\n  const localCheckpoint = await loadLocalAccessManifestCheckpoint({\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    objectId: input.current.objectId,\n    objectKind: input.current.objectKind,\n    organizationId: input.current.organizationId,\n  });\n  const checkpointPredecessors = localCheckpoint\n    ? [...input.verifiedManifests.values()]\n        .filter((candidate) =>\n          isCheckpointPredecessor({\n            candidate,\n            current: input.current,\n            localCheckpoint,\n          }),\n        )\n        .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)\n    : [];\n  return { checkpointPredecessors, localCheckpoint };\n}\n\nexport async function verifyCachedManifestCheckpoint(input: {\n  readonly current: VerifiedAccessManifestCheckpointEvidence;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<\n    string,\n    VerifiedAccessManifestCheckpointEvidence\n  >;\n}): Promise<void> {\n  const checkpoint = await loadManifestCheckpointVerification({\n    current: input.current.manifest,\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    verifiedManifests: input.verifiedManifests,\n  });\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: checkpoint.checkpointPredecessors,\n    current: {\n      ...input.current.checkpoint,\n      previousManifestHash: input.current.manifest.previousManifestHash,\n    },\n    localCheckpoint: checkpoint.localCheckpoint,\n  });\n}\n"]}
+{"version":3,"file":"manifestCheckpointVerification.js","sourceRoot":"","sources":["manifestCheckpointVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,iEAAiE,CAAC;AAG/G;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,KAMhD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,OAAO,CACL,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QACjD,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QACzD,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAEtD,KAKD;IACC,MAAM,eAAe,GAAG,MAAM,iCAAiC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;KAC7C,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,eAAe;QAC5C,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,uBAAuB,CAAC;YACtB,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe;SAChB,CAAC,CACH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAQpD;IACC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU;YAC3B,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;SAClE;QACD,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  type VerifiedAccessManifestCheckpointEvidence,\n  verifyAccessManifestLocalCheckpoint,\n} from \"@tearleads/crypto\";\nimport { loadAccessManifestCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * The local checkpoint for one object, read once per verification: every\n * checkpoint-enforced element of a served path reads its own checkpoint,\n * and the atomic advance re-validates every checkpoint at commit.\n */\nasync function loadLocalAccessManifestCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly objectId: string;\n  readonly objectKind: AccessManifest[\"objectKind\"];\n  readonly organizationId: string;\n}): Promise<AccessManifestCheckpoint | null> {\n  const key = JSON.stringify([\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  ]);\n  const cached = input.localCheckpoints.get(key);\n  if (cached !== undefined) return cached;\n  const loaded = await loadAccessManifestCheckpoint(\n    input.execSql,\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  );\n  input.localCheckpoints.set(key, loaded);\n  return loaded;\n}\n\ninterface ManifestCheckpointVerificationInput<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n> {\n  readonly checkpointPredecessors: readonly TManifest[];\n  readonly localCheckpoint: AccessManifestCheckpoint | null;\n}\n\nfunction isCheckpointPredecessor(input: {\n  readonly candidate: VerifiedAccessManifestCheckpointEvidence;\n  readonly current: AccessManifest;\n  readonly localCheckpoint: AccessManifestCheckpoint;\n}): boolean {\n  const candidate = input.candidate.checkpoint;\n  return (\n    candidate.objectKind === input.current.objectKind &&\n    candidate.organizationId === input.current.organizationId &&\n    candidate.objectId === input.current.objectId &&\n    candidate.epoch > input.localCheckpoint.epoch &&\n    candidate.epoch < input.current.epoch\n  );\n}\n\nexport async function loadManifestCheckpointVerification<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n>(input: {\n  readonly current: AccessManifest;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<string, TManifest>;\n}): Promise<ManifestCheckpointVerificationInput<TManifest>> {\n  const localCheckpoint = await loadLocalAccessManifestCheckpoint({\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    objectId: input.current.objectId,\n    objectKind: input.current.objectKind,\n    organizationId: input.current.organizationId,\n  });\n  const checkpointPredecessors = localCheckpoint\n    ? [...input.verifiedManifests.values()]\n        .filter((candidate) =>\n          isCheckpointPredecessor({\n            candidate,\n            current: input.current,\n            localCheckpoint,\n          }),\n        )\n        .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)\n    : [];\n  return { checkpointPredecessors, localCheckpoint };\n}\n\nexport async function verifyCachedManifestCheckpoint(input: {\n  readonly current: VerifiedAccessManifestCheckpointEvidence;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<\n    string,\n    VerifiedAccessManifestCheckpointEvidence\n  >;\n}): Promise<void> {\n  const checkpoint = await loadManifestCheckpointVerification({\n    current: input.current.manifest,\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    verifiedManifests: input.verifiedManifests,\n  });\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: checkpoint.checkpointPredecessors,\n    current: {\n      ...input.current.checkpoint,\n      previousManifestHash: input.current.manifest.previousManifestHash,\n    },\n    localCheckpoint: checkpoint.localCheckpoint,\n  });\n}\n"]}

package/data/keyingProjectionVerification/documentPurge/documentPurgeCheckpointCurrency.js

@@ -1,7 +1,7 @@
-import { validateAccessManifestCheckpointEvidence } from "../../persistence/keyingCheckpointEvidence.js";
-import { accessManifestObjectKey, loadAccessManifestCheckpoint, } from "../../persistence/keyingCheckpointPersistence.js";
-import { PrincipalAuthorizationCheckpointUnavailableError, validatePrincipalAuthorizationCheckpoints, } from "../../persistence/principalAuthorizationCheckpoints.js";
-import { ensurePrincipalPolicyTables } from "../../persistence/principalPolicyPersistence.js";
+import { validateAccessManifestCheckpointEvidence } from "../../persistence/keyingCheckpoints/keyingCheckpointEvidence.js";
+import { accessManifestObjectKey, loadAccessManifestCheckpoint, } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
+import { PrincipalAuthorizationCheckpointUnavailableError, validatePrincipalAuthorizationCheckpoints, } from "../../persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js";
+import { ensurePrincipalPolicyTables } from "../../persistence/principalPolicy/principalPolicyPersistence.js";
 import { registerClientSQLiteCommitGuard } from "../../sqlite/sqliteCommitGuards.js";
 import { getClientSQLitePersistenceRuntime } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { runSerializedSqlMutation } from "../../sqlite/sqlSchema.js";