@tearleads/client-sdk 0.1.76 → 0.1.78

package/workflows/sync/remoteReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPersistence/documentPendingUpdatePersistence\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentPersistence/documentSyncFailurePersistence\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/schema/documentPlacementIntentSchema\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/schema/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/schema/organizationReadModelSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/readModel/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}
+{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,kFAAkF,CAAC;AAC1F,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/container-contents/documentContainerProjectionPersistence\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPersistence/documentPendingUpdatePersistence\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentPersistence/documentSyncFailurePersistence\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/schema/documentPlacementIntentSchema\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/schema/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/schema/organizationReadModelSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/readModel/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}

package/data/containers/containerMetadataDocument.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerMetadataDocument.js","sourceRoot":"","sources":["containerMetadataDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAWzD,MAAM,UAAU,uBAAuB,CAAC,QAAuB;IAC7D,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,YAAoB;IAEpB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,cAAc,CAAC,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,WAAmB,EACnB,KAA6B;IAK7B,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,CAAC;IAC/D,2BAA2B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,GAAG;QACH,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAA8B,EAC9B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,IAAI,EACF,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI;QACV,IAAI,EACF,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC5D,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAA8B,EAC9B,KAA6B;IAE7B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import { createDocument, exportAllUpdates } from \"@tearleads/loro\";\nimport { getScopedPeerSeed } from \"../sync/crdtPeerSeed\";\n\ninterface ContainerMetadataValue {\n  icon: string | null;\n  name: string;\n}\n\nexport type ContainerMetadataDocument = Awaited<\n  ReturnType<typeof createDocument>\n>;\n\nexport function getDefaultContainerName(parentId: string | null): string {\n  return parentId === null ? \"/\" : \"Untitled\";\n}\n\nexport async function createContainerMetadataDocument(\n  _containerId: string,\n): Promise<ContainerMetadataDocument> {\n  // A single static scope for all container-metadata docs: they are separate\n  // CRDTs, so they can share one device peer, and a per-container scope would\n  // hold a distinct device-peer lock (and cache entry) per container for the\n  // tab's lifetime, accumulating without bound as containers are browsed.\n  return createDocument(await getScopedPeerSeed(\"container-metadata\"));\n}\n\nexport async function createInitializedContainerMetadataDocument(\n  containerId: string,\n  value: ContainerMetadataValue,\n): Promise<{\n  doc: ContainerMetadataDocument;\n  initialUpdate: Uint8Array;\n}> {\n  const doc = await createContainerMetadataDocument(containerId);\n  writeContainerMetadataValue(doc, value);\n\n  return {\n    doc,\n    initialUpdate: exportAllUpdates(doc),\n  };\n}\n\nexport function readContainerMetadataValue(\n  doc: ContainerMetadataDocument,\n  defaultName: string,\n): ContainerMetadataValue {\n  const metadata = doc.getMap(\"container\");\n  const storedName = metadata.get(\"name\");\n  const storedIcon = metadata.get(\"icon\");\n\n  return {\n    icon:\n      typeof storedIcon === \"string\" && storedIcon.length > 0\n        ? storedIcon\n        : null,\n    name:\n      typeof storedName === \"string\" && storedName.trim().length > 0\n        ? storedName\n        : defaultName,\n  };\n}\n\nexport function writeContainerMetadataValue(\n  doc: ContainerMetadataDocument,\n  value: ContainerMetadataValue,\n): void {\n  const metadata = doc.getMap(\"container\");\n\n  metadata.set(\"name\", value.name);\n\n  if (value.icon) {\n    metadata.set(\"icon\", value.icon);\n    return;\n  }\n\n  metadata.delete(\"icon\");\n}\n"]}

package/data/documents/blob/shared/blobSourceSnapshot.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"blobSourceSnapshot.js","sourceRoot":"","sources":["blobSourceSnapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKxD,KAAK,UAAU,SAAS,CAAC,KAAiB;IACxC,OAAO,UAAU,CACf,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAC/D,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAsB,EACtB,SAAiB;IAEjB,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAE7C,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,4BAA4B,CAAC;YAC9C,UAAU;YACV,UAAU;YACV,SAAS;YACT,mBAAmB,EAAE,MAAM,CAAC,UAAU;SACvC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,UAAU,GAAG,SAAS;YAC9B,MAAM;SACP,CAAC,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,qBAAqB,CACtC,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,SAAS,CACnB,CAAC;IACF,MAAM,UAAU,GAAG,4BAA4B,CAAC;QAC9C,UAAU;QACV,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,mBAAmB,EAAE,QAAQ,CAAC,UAAU;KACzC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,UAAU;QACV,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC,SAAS;QACvC,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,kCAAkC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import {\n  blobChunkPlaintextByteLength,\n  bytesToHex,\n  computeBlobChunkCount,\n  createIncrementalSha256,\n  normalizeBlobChunkSize,\n} from \"@tearleads/crypto\";\nimport type { BlobByteSource, BlobBytes } from \"../../../blobs/blobContracts\";\nimport { asWebCryptoBytes } from \"../../shared/readers\";\nimport type { BlobSourceSnapshot } from \"./types\";\n\nexport type { BlobSourceSnapshot } from \"./types\";\n\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n  return bytesToHex(\n    new Uint8Array(\n      await crypto.subtle.digest(\"SHA-256\", asWebCryptoBytes(bytes)),\n    ),\n  );\n}\n\nfunction assertSourceByteLength(byteLength: number): void {\n  if (!Number.isSafeInteger(byteLength) || byteLength < 0) {\n    throw new Error(\n      \"Blob source byte length must be a non-negative safe integer\",\n    );\n  }\n}\n\nasync function readExactSourceBytes(input: {\n  readonly byteLength: number;\n  readonly offset: number;\n  readonly source: BlobByteSource;\n}): Promise<BlobBytes> {\n  const bytes = await input.source.read(input.offset, input.byteLength);\n  if (bytes.byteLength !== input.byteLength) {\n    throw new Error(\"Blob source returned an unexpected byte length\");\n  }\n  const copy = new Uint8Array(bytes.byteLength);\n  copy.set(bytes);\n  return copy;\n}\n\nexport async function inspectBlobSource(\n  source: BlobByteSource,\n  chunkSize: number,\n): Promise<BlobSourceSnapshot> {\n  assertSourceByteLength(source.byteLength);\n  normalizeBlobChunkSize(chunkSize);\n  const chunkCount = computeBlobChunkCount(source.byteLength, chunkSize);\n  const chunkSha256: string[] = [];\n  const objectHash = createIncrementalSha256();\n\n  for (let chunkIndex = 0; chunkIndex < chunkCount; chunkIndex += 1) {\n    const byteLength = blobChunkPlaintextByteLength({\n      chunkCount,\n      chunkIndex,\n      chunkSize,\n      plaintextByteLength: source.byteLength,\n    });\n    const bytes = await readExactSourceBytes({\n      byteLength,\n      offset: chunkIndex * chunkSize,\n      source,\n    });\n    objectHash.update(bytes);\n    chunkSha256.push(await sha256Hex(bytes));\n  }\n\n  return {\n    byteLength: source.byteLength,\n    chunkSha256,\n    chunkSize,\n    sha256: bytesToHex(objectHash.digest()),\n  };\n}\n\nexport async function readVerifiedBlobSourceChunk(input: {\n  readonly chunkIndex: number;\n  readonly snapshot: BlobSourceSnapshot;\n  readonly source: BlobByteSource;\n}): Promise<BlobBytes> {\n  const { chunkIndex, snapshot, source } = input;\n  if (source.byteLength !== snapshot.byteLength) {\n    throw new Error(\"Blob source byte length changed after inspection\");\n  }\n  const chunkCount = computeBlobChunkCount(\n    snapshot.byteLength,\n    snapshot.chunkSize,\n  );\n  const byteLength = blobChunkPlaintextByteLength({\n    chunkCount,\n    chunkIndex,\n    chunkSize: snapshot.chunkSize,\n    plaintextByteLength: snapshot.byteLength,\n  });\n  const bytes = await readExactSourceBytes({\n    byteLength,\n    offset: chunkIndex * snapshot.chunkSize,\n    source,\n  });\n  if ((await sha256Hex(bytes)) !== snapshot.chunkSha256[chunkIndex]) {\n    throw new Error(\n      `Blob plaintext chunk ${chunkIndex} changed after source inspection`,\n    );\n  }\n  return bytes;\n}\n"]}

package/data/documents/blob/shared/chunkedBlobCrypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunkedBlobCrypto.js","sourceRoot":"","sources":["chunkedBlobCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,+BAA+B,EAC/B,qBAAqB,EACrB,8BAA8B,EAC9B,mCAAmC,EACnC,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,gCAAgC,EAChC,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AA4BnE,KAAK,UAAU,2BAA2B,CACxC,KAAiC,EACjC,QAA4B;IAE5B,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,CAAC,SAAS,IAAI,6BAA6B,CACjD,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IACpD,MAAM,SAAS,GAAG,qBAAqB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,SAAS;QACT,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,mCAAmC,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,eAAe;YACf,eAAe,EAAE,+BAA+B;YAChD,eAAe;SAChB,CAAC;QACF,uBAAuB,CAAC;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,mBAAmB;YAC/B,UAAU,EAAE,SAAS;YACrB,SAAS;YACT,eAAe;SAChB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,eAAe;QACf,eAAe;QACf,WAAW,EAAE,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,mBAAmB;YAC/B,UAAU,EAAE,SAAS;YACrB,SAAS;YACT,eAAe;YACf,eAAe;YACf,eAAe,EAAE,+BAA+B;YAChD,MAAM,EAAE,2BAA2B;YACnC,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC;YACzB,YAAY;YACZ,eAAe;YACf,OAAO,EAAE,4BAA4B;SACtC,CAAC;QACF,YAAY;QACZ,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS;QACT,mBAAmB;QACnB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAA8B,EAC9B,UAAkB,EAClB,SAAoB;IAEpB,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;QACjD,cAAc,EAAE,gCAAgC,CAAC;YAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,UAAU;YACV,wBAAwB,EAAE,SAAS,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC;KACH,EACD,OAAO,CAAC,SAAS,EACjB,SAAS,CACV,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAsB,EACtB,QAA4B,EAC5B,OAA8B;IAE9B,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,UAAU;YACV,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAKjC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,8BAA8B,CAAC;QAChD,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;QAChD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,eAAe,EAAE,QAAQ,CAAC,MAAM;QAChC,MAAM;QACN,GAAG,0BAA0B,CAAC;YAC5B,UAAU;YACV,SAAS,EAAE,OAAO,CAAC,SAAS,GAAG,iBAAiB;YAChD,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,KAAK,CAAC,YAAY,CAAC,UAAU;gBAC3B,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;oBAClD,UAAU;oBACV,QAAQ;oBACR,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC1D,CAAC;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,CAAC,SAAS,IAAI,6BAA6B,CACjD,CAAC;IACF,MAAM,QAAQ,GACZ,KAAK,CAAC,cAAc,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnE,IACE,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,mBAAmB;QACnD,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC;QAC9B,OAAO;QACP,MAAM;QACN,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  AES_256_KEY_BYTES,\n  AES_GCM_TAG_BYTES,\n  assertAesGcmIv,\n  BLOB_CHUNK_SIZE_BYTES,\n  BLOB_ENCRYPTED_BYTES_FORMAT,\n  BLOB_ENCRYPTED_BYTES_VERSION,\n  blobContentMetadataHash,\n  bytesToHex,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeBlobChunkCount,\n  computeBlobEncryptedByteLength,\n  computeContentRecordNonceDomainHash,\n  createAesGcmIv,\n  createIncrementalSha256,\n  deriveBlobChunkIv,\n  encodeBlobEnvelopeV2Header,\n  normalizeBlobChunkSize,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { BlobContentKeyBundleRequest } from \"@tearleads/validators/request\";\nimport type { BlobByteSource, BlobBytes } from \"../../../blobs/blobContracts\";\nimport { importContentKeyMaterial } from \"../../shared/contentRecordKeys\";\nimport {\n  contentRecordAdditionalDataBytes,\n  deriveBlobBaseIv,\n  deriveBlobContentRecordKey,\n} from \"./blobRecordCrypto\";\nimport {\n  type BlobSourceSnapshot,\n  inspectBlobSource,\n  readVerifiedBlobSourceChunk,\n} from \"./blobSourceSnapshot\";\nimport { createEncryptedUploadParts } from \"./encryptedUploadParts\";\nimport type { BlobEncryptionPlan } from \"./types\";\n\nexport const DEFAULT_BLOB_CHUNK_SIZE_BYTES = BLOB_CHUNK_SIZE_BYTES;\n\ninterface PrepareBlobEncryptionInput {\n  readonly blobId: string;\n  readonly chunkSize?: number | undefined;\n  readonly contentKey: Uint8Array;\n  readonly contentKeyBundle: BlobContentKeyBundleRequest;\n  readonly nonceSeed?: Uint8Array | undefined;\n  readonly organizationId: string;\n  readonly source: BlobByteSource;\n  readonly sourceSnapshot?: BlobSourceSnapshot | undefined;\n}\n\ninterface BlobEncryptionContext {\n  readonly baseIv: BlobBytes;\n  readonly blobId: string;\n  readonly chunkSize: number;\n  readonly contentKeyEpoch: number;\n  readonly contentRecordId: string;\n  readonly headerBytes: BlobBytes;\n  readonly metadataHash: string;\n  readonly nonceDomainHash: string;\n  readonly organizationId: string;\n  readonly partCount: number;\n  readonly plaintextByteLength: number;\n  readonly recordKey: CryptoKey;\n}\n\nasync function createBlobEncryptionContext(\n  input: PrepareBlobEncryptionInput,\n  snapshot: BlobSourceSnapshot,\n): Promise<BlobEncryptionContext> {\n  const chunkSize = normalizeBlobChunkSize(\n    input.chunkSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES,\n  );\n  const plaintextByteLength = input.source.byteLength;\n  const partCount = computeBlobChunkCount(plaintextByteLength, chunkSize);\n  const contentRecordId = input.blobId;\n  const { contentKeyEpoch } = input.contentKeyBundle;\n  const nonceSeed = new Uint8Array(input.nonceSeed ?? createAesGcmIv());\n  const baseIv = await deriveBlobBaseIv({\n    chunkSize,\n    nonceSeed,\n    plaintextSha256: snapshot.sha256,\n  });\n\n  const [nonceDomainHash, metadataHash] = await Promise.all([\n    computeContentRecordNonceDomainHash({\n      version: 1,\n      organizationId: input.organizationId,\n      objectKind: \"blob\",\n      objectId: input.blobId,\n      contentKeyEpoch,\n      encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n      contentRecordId,\n    }),\n    blobContentMetadataHash({\n      blobId: input.blobId,\n      byteLength: plaintextByteLength,\n      chunkCount: partCount,\n      chunkSize,\n      contentKeyEpoch,\n    }),\n  ]);\n  const contentKeyMaterial = await importContentKeyMaterial(input.contentKey);\n  const recordKey = await deriveBlobContentRecordKey({\n    blobId: input.blobId,\n    contentKeyEpoch,\n    contentKeyMaterial,\n    contentRecordId,\n    organizationId: input.organizationId,\n    usage: \"encrypt\",\n  });\n  return {\n    baseIv,\n    blobId: input.blobId,\n    chunkSize,\n    contentKeyEpoch,\n    contentRecordId,\n    headerBytes: encodeBlobEnvelopeV2Header({\n      blobId: input.blobId,\n      byteLength: plaintextByteLength,\n      chunkCount: partCount,\n      chunkSize,\n      contentKeyEpoch,\n      contentRecordId,\n      encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n      format: BLOB_ENCRYPTED_BYTES_FORMAT,\n      iv: bytesToBase64(baseIv),\n      metadataHash,\n      nonceDomainHash,\n      version: BLOB_ENCRYPTED_BYTES_VERSION,\n    }),\n    metadataHash,\n    nonceDomainHash,\n    organizationId: input.organizationId,\n    partCount,\n    plaintextByteLength,\n    recordKey,\n  };\n}\n\nasync function encryptBlobChunk(\n  context: BlobEncryptionContext,\n  chunkIndex: number,\n  plaintext: BlobBytes,\n): Promise<BlobBytes> {\n  return new Uint8Array(\n    await crypto.subtle.encrypt(\n      {\n        name: \"AES-GCM\",\n        iv: deriveBlobChunkIv(context.baseIv, chunkIndex),\n        additionalData: contentRecordAdditionalDataBytes({\n          blobId: context.blobId,\n          chunkCount: context.partCount,\n          chunkIndex,\n          chunkPlaintextByteLength: plaintext.byteLength,\n          chunkSize: context.chunkSize,\n          contentKeyEpoch: context.contentKeyEpoch,\n          contentRecordId: context.contentRecordId,\n          metadataHash: context.metadataHash,\n          nonceDomainHash: context.nonceDomainHash,\n          organizationId: context.organizationId,\n          plaintextByteLength: context.plaintextByteLength,\n        }),\n      },\n      context.recordKey,\n      plaintext,\n    ),\n  );\n}\n\nasync function runEncryptionHashPass(\n  source: BlobByteSource,\n  snapshot: BlobSourceSnapshot,\n  context: BlobEncryptionContext,\n): Promise<string> {\n  const objectHash = createIncrementalSha256();\n  objectHash.update(context.headerBytes);\n  for (let chunkIndex = 0; chunkIndex < context.partCount; chunkIndex += 1) {\n    const plaintext = await readVerifiedBlobSourceChunk({\n      chunkIndex,\n      snapshot,\n      source,\n    });\n    objectHash.update(await encryptBlobChunk(context, chunkIndex, plaintext));\n  }\n  return bytesToHex(objectHash.digest());\n}\n\nfunction createBlobEncryptionPlan(input: {\n  readonly context: BlobEncryptionContext;\n  readonly sha256: string;\n  readonly snapshot: BlobSourceSnapshot;\n  readonly source: BlobByteSource;\n}): BlobEncryptionPlan {\n  const { context, sha256, snapshot, source } = input;\n  const byteLength = computeBlobEncryptedByteLength({\n    chunkCount: context.partCount,\n    headerByteLength: context.headerBytes.byteLength,\n    plaintextByteLength: context.plaintextByteLength,\n  });\n  return {\n    byteLength,\n    chunkSize: context.chunkSize,\n    metadataHash: context.metadataHash,\n    plaintextByteLength: context.plaintextByteLength,\n    plaintextSha256: snapshot.sha256,\n    sha256,\n    ...createEncryptedUploadParts({\n      byteLength,\n      chunkSize: context.chunkSize + AES_GCM_TAG_BYTES,\n      header: context.headerBytes,\n      async encryptChunk(chunkIndex) {\n        const plaintext = await readVerifiedBlobSourceChunk({\n          chunkIndex,\n          snapshot,\n          source,\n        });\n        return encryptBlobChunk(context, chunkIndex, plaintext);\n      },\n    }),\n  };\n}\n\nexport async function prepareBlobEncryption(\n  input: PrepareBlobEncryptionInput,\n): Promise<BlobEncryptionPlan> {\n  if (input.contentKey.byteLength !== AES_256_KEY_BYTES) {\n    throw new Error(\"Blob content key must be 32 bytes\");\n  }\n  if (input.nonceSeed) {\n    assertAesGcmIv(input.nonceSeed, \"Blob nonce seed is invalid\");\n  }\n  const chunkSize = normalizeBlobChunkSize(\n    input.chunkSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES,\n  );\n  const snapshot =\n    input.sourceSnapshot ?? (await inspectBlobSource(input.source, chunkSize));\n  const context = await createBlobEncryptionContext(input, snapshot);\n  if (\n    snapshot.byteLength !== context.plaintextByteLength ||\n    snapshot.chunkSize !== context.chunkSize\n  ) {\n    throw new Error(\"Blob source snapshot does not match encryption layout\");\n  }\n  const sha256 = await runEncryptionHashPass(input.source, snapshot, context);\n  return createBlobEncryptionPlan({\n    context,\n    sha256,\n    snapshot,\n    source: input.source,\n  });\n}\n"]}

package/data/documents/blob/shared/encryptedUploadParts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryptedUploadParts.js","sourceRoot":"","sources":["encryptedUploadParts.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC;IACzD,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;YACtC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,SAAS,CACvD,CAAC;gBACF,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;gBACzD,sEAAsE;gBACtE,yEAAyE;gBACzE,uEAAuE;gBACvE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;gBACnE,IAAI,MAAM,IAAI,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;gBACtE,QAAQ,IAAI,MAAM,CAAC;YACrB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobBytes } from \"../../../blobs/blobContracts\";\n\n/** Repartition the envelope without changing its encryption or buffering the file. */\nexport function createEncryptedUploadParts(input: {\n  readonly byteLength: number;\n  readonly chunkSize: number;\n  readonly header: BlobBytes;\n  readonly encryptChunk: (index: number) => Promise<BlobBytes>;\n}) {\n  // Including the header in the fixed transport size keeps even a maximum-size\n  // envelope within 10,000 parts. R2 requires equal sizes for all nonfinal parts.\n  const partSize = input.chunkSize + input.header.byteLength;\n  const partCount = Math.ceil(input.byteLength / partSize);\n  function getPartByteLength(index: number): number {\n    if (!Number.isInteger(index) || index < 0 || index >= partCount) {\n      throw new Error(\"Blob encryption part index is out of range\");\n    }\n    return Math.min(partSize, input.byteLength - index * partSize);\n  }\n  return {\n    partCount,\n    getPartByteLength,\n    async encryptPart(index: number): Promise<BlobBytes> {\n      const output = new Uint8Array(getPartByteLength(index));\n      const start = index * partSize;\n      const end = start + output.byteLength;\n      if (start < input.header.byteLength) {\n        output.set(\n          input.header.subarray(start, Math.min(end, input.header.byteLength)),\n        );\n      }\n      let position = Math.max(start, input.header.byteLength);\n      while (position < end) {\n        const chunkIndex = Math.floor(\n          (position - input.header.byteLength) / input.chunkSize,\n        );\n        const chunkStart =\n          input.header.byteLength + chunkIndex * input.chunkSize;\n        // Adjacent transport parts can re-read and re-encrypt a shared chunk.\n        // Independent calls keep memory bounded during concurrent upload/resume;\n        // the tradeoff is up to two encryptions per chunk in this upload pass.\n        const chunk = await input.encryptChunk(chunkIndex);\n        const offset = position - chunkStart;\n        const length = Math.min(chunk.byteLength - offset, end - position);\n        if (length <= 0)\n          throw new Error(\"Encrypted blob chunk is shorter than its layout\");\n        output.set(chunk.subarray(offset, offset + length), position - start);\n        position += length;\n      }\n      return output;\n    },\n  };\n}\n"]}

package/data/documents/blob/shared/events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["events.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,+BAA+B,EAC/B,0BAA0B,EAC1B,mCAAmC,EACnC,sBAAsB,EACtB,eAAe,EACf,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAI3D,KAAK,UAAU,2BAA2B,CAGxC,IAAU,EACV,KAOC;IAED,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,iBAAiB;QAClC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,6BAA6B,CAAC;IACpC,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;QACrD,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,mBAAmB,CAAC;YAC5C,KAAK,CAAC,gBAAgB,CAAC,YAAY;YACnC,GAAG,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC;SACF,CAAC;QACF,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CACnC;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAW7C;IACC,OAAO,2BAA2B,CAChC;QACE,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;KAC1D,EACD,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,OAAO,2BAA2B,CAChC;QACE,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;KAC1D,EACD,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC;QACE,OAAO,EAAE,CAAC;QACV,wBAAwB,EAAE,mBAAmB,CAC3C,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CACpC,CACF;QACD,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;QACrD,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,kBAAkB,EAAE,KAAK,CAAC,sBAAsB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,KAAK,CAAC,MAAM;QAC7B,eAAe,EAAE,MAAM,mCAAmC,CAAC;YACzD,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;YACrD,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,+BAA+B;YAChD,eAAe,EAAE,KAAK,CAAC,MAAM;SAC9B,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC1C,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,WAAW;QACX,eAAe,EAAE,MAAM,sBAAsB,CAAC,WAAW,CAAC;KAC3D,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AttachmentBindAccessEventBody,\n  type AttachmentDetachAccessEventBody,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeAccessEventBodyHash,\n  computeContentRecordNonceDomainHash,\n  computeWriteHeaderHash,\n  signAccessEvent,\n  signWriteHeader,\n  type UnsignedAccessEvent,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport type { ContainerManifestRef } from \"@tearleads/validators/request\";\nimport { readCanonicalJson } from \"../../../keying/canonicalJson\";\nimport { uniqueSortedStrings } from \"../../shared/readers\";\nimport type { DocumentCreateAuthor } from \"../../shared/types\";\nimport type { BlobEncryptionPlan, DocumentManifestIdentity } from \"./types\";\n\nasync function signBlobAttachmentBodyEvent<\n  Body extends AttachmentBindAccessEventBody | AttachmentDetachAccessEventBody,\n>(\n  body: Body,\n  input: {\n    author: DocumentCreateAuthor;\n    blobId: string;\n    eventId: string;\n    manifestIdentity: DocumentManifestIdentity;\n    signedAt: string;\n    authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  },\n): Promise<{ body: Body; event: AccessEvent }> {\n  const bodyLabel =\n    body.eventType === \"attachment.bind\"\n      ? \"Blob attachment bind body\"\n      : \"Blob attachment detach body\";\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId,\n    eventType: body.eventType,\n    objectKind: \"blob\",\n    objectId: input.blobId,\n    organizationId: input.manifestIdentity.organizationId,\n    previousManifestHash: null,\n    dependencyManifestHashes: uniqueSortedStrings([\n      input.manifestIdentity.manifestHash,\n      ...input.authorizingContainerPathRefs.flatMap((path) =>\n        path.map((ref) => ref.manifestHash),\n      ),\n    ]),\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, bodyLabel),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt,\n  };\n\n  return {\n    body,\n    event: await signAccessEvent(unsignedEvent, input.author.signerPrivateKey),\n  };\n}\n\nexport async function signBlobAttachmentEvent(input: {\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  eventId: string;\n  expectedBindingId: string | null;\n  manifestIdentity: DocumentManifestIdentity;\n  signedAt: string;\n  slotId: string;\n  authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n}): Promise<{ body: AttachmentBindAccessEventBody; event: AccessEvent }> {\n  return signBlobAttachmentBodyEvent(\n    {\n      eventType: \"attachment.bind\",\n      bindingId: input.bindingId,\n      blobId: input.blobId,\n      documentId: input.documentId,\n      slotId: input.slotId,\n      expectedBindingId: input.expectedBindingId,\n      documentManifestHash: input.manifestIdentity.manifestHash,\n    },\n    input,\n  );\n}\n\nexport async function signBlobAttachmentDetachEvent(input: {\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  eventId: string;\n  manifestIdentity: DocumentManifestIdentity;\n  signedAt: string;\n  slotId: string;\n  authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n}): Promise<{ body: AttachmentDetachAccessEventBody; event: AccessEvent }> {\n  return signBlobAttachmentBodyEvent(\n    {\n      eventType: \"attachment.detach\",\n      bindingId: input.bindingId,\n      blobId: input.blobId,\n      documentId: input.documentId,\n      slotId: input.slotId,\n      documentManifestHash: input.manifestIdentity.manifestHash,\n    },\n    input,\n  );\n}\n\nexport async function signBlobAttachmentWriteHeader(input: {\n  authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  author: DocumentCreateAuthor;\n  blobAccessManifestHash: string;\n  blobId: string;\n  contentKeyEpoch: number;\n  encrypted: BlobEncryptionPlan;\n  manifestIdentity: DocumentManifestIdentity;\n  signedAt: string;\n  targetHash: string;\n}): Promise<{ writeHeader: WriteHeader; writeHeaderHash: string }> {\n  const writeHeader = await signWriteHeader(\n    {\n      version: 1,\n      dependencyManifestHashes: uniqueSortedStrings(\n        input.authorizingContainerPathRefs.flatMap((path) =>\n          path.map((ref) => ref.manifestHash),\n        ),\n      ),\n      organizationId: input.manifestIdentity.organizationId,\n      objectKind: \"blob\",\n      objectId: input.blobId,\n      accessManifestHash: input.blobAccessManifestHash,\n      contentKeyEpoch: input.contentKeyEpoch,\n      targetHash: input.targetHash,\n      encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n      contentRecordId: input.blobId,\n      nonceDomainHash: await computeContentRecordNonceDomainHash({\n        version: 1,\n        organizationId: input.manifestIdentity.organizationId,\n        objectKind: \"blob\",\n        objectId: input.blobId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n        contentRecordId: input.blobId,\n      }),\n      metadataHash: input.encrypted.metadataHash,\n      ciphertextHash: input.encrypted.sha256,\n      writerUserId: input.author.signerUserId,\n      writerDeviceId: input.author.signerDeviceId,\n      writerKeyFingerprint: input.author.signerKeyFingerprint,\n      signedAt: input.signedAt,\n    },\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    writeHeader,\n    writeHeaderHash: await computeWriteHeaderHash(writeHeader),\n  };\n}\n"]}

package/data/documents/blob/shared/projection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projection.js","sourceRoot":"","sources":["projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAE3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6EAA6E,CAAC;AAE3H,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EACL,0CAA0C,EAC1C,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,SAAS,cAAc,CACrB,KAAgD,EAChD,OAA4C;IAE5C,OAAO,eAAe,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,MAAM;KACV,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6CAA6C,CAAC,KAI7D;IACC,OAAO,cAAc,CACnB,KAAK,EACL,2BAA2B,CAAC;QAC1B,kBAAkB,EAAE,0CAA0C,CAC5D,KAAK,CAAC,gBAAgB,CACvB;QACD,aAAa,EAAE,kCAAkC,CAC/C,KAAK,CAAC,gBAAgB,CAAC,kBAAkB,CAC1C;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,KAAK,UAAU,oBAAoB,CACjC,KAIiC;IAEjC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEpD,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,IAAI,cAAc,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACb,gBAAgB,CACd,QAAQ,EACR,WAAW,EACX,4DAA4D,CAC7D,CAAC;gBACF,SAAS;YACX,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAQiC;IAEjC,6BAA6B,CAC3B,KAAK,CAAC,gBAAgB,EACtB,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAC3D,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,mBAAmB,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QACH,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,gBAAgB,EAAE;gBAChB,KAAK,EAAE,2BAA2B;gBAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,OAAO,6BAA6B,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAUiC;IAEjC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,UAAU,GAAsB,IAAI,CAAC;IACzC,MAAM,iBAAiB,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAC7D,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB;QAC9C,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAC3C,CAAC;IAEF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;YACjD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY;YACZ,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;YACvD,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CACd,UAAU,EACV,SAAS,EACT,qDAAqD,CACtD,CAAC;YACF,SAAS;QACX,CAAC;QACD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { BlobContentKeyTargetEnvelopeRequest } from \"@tearleads/validators/request\";\nimport type {\n  BlobContentKeyBundleResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { documentContainerProjections } from \"../../../keyingProjectionVerification/document/documentContainerProjections\";\nimport type { ExecSql } from \"../../../sqlite/sqlSchema\";\nimport { assertDocumentKekPathsCurrent } from \"../../shared/containerKek/containerKekCurrency\";\nimport {\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapContainerKekPath,\n  verifiedDocumentWrapTargets,\n} from \"../../shared/projection\";\nimport { unwrapContentKeyTargetForKind } from \"../../shared/projection/projectionContentKeys\";\nimport {\n  assertEqualBytes,\n  normalizeDocumentKekTargetResponse,\n} from \"../../shared/readers\";\nimport {\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../shared/types\";\nimport { sortBlobTargets } from \"./readers\";\nimport type { BlobContentKeyTarget, BlobEncryptedBytesHeader } from \"./types\";\n\nfunction blobTargetsFor(\n  input: { bindingId: string; documentId: string },\n  targets: readonly DocumentContentKeyTarget[],\n): BlobContentKeyTarget[] {\n  return sortBlobTargets(\n    targets.map((target) => ({\n      bindingId: input.bindingId,\n      documentId: input.documentId,\n      ...target,\n    })),\n  );\n}\n\n/**\n * The targets a blob content key may be wrapped to: the verified current\n * heads of the document's linked containers. The server list only names which\n * containers a bundle must cover.\n */\nexport function verifiedBlobWrapTargetsFromDocumentProjection(input: {\n  bindingId: string;\n  documentId: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}): BlobContentKeyTarget[] {\n  return blobTargetsFor(\n    input,\n    verifiedDocumentWrapTargets({\n      linkedContainerIds: readLinkedContainerIdsFromDocumentManifest(\n        input.writerProjection,\n      ),\n      serverTargets: normalizeDocumentKekTargetResponse(\n        input.writerProjection.documentKekTargets,\n      ),\n      writerProjection: input.writerProjection,\n    }),\n  );\n}\n\n// Not collectContainerKeksForDocumentSync: the blob upload retry classifier\n// keys on the bare \"Container writer projection KEK… could not be unwrapped\"\n// message, which the sync collector would wrap with document-sync context.\nasync function collectContainerKeks(\n  input: {\n    execSql?: ExecSql | undefined;\n    secretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<ReadonlyMap<string, Uint8Array>> {\n  const keksByEpochId = new Map<string, Uint8Array>();\n\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    const projectionKeks = await unwrapContainerKekPath({\n      execSql: input.execSql,\n      projection,\n      secretKey: input.secretKey,\n      ...projectionVerificationOptions(input),\n    });\n\n    for (const [containerKeyEpochId, keyMaterial] of projectionKeks) {\n      const existing = keksByEpochId.get(containerKeyEpochId);\n      if (existing) {\n        assertEqualBytes(\n          existing,\n          keyMaterial,\n          \"Blob writer projection contains conflicting container KEKs\",\n        );\n        continue;\n      }\n      keksByEpochId.set(containerKeyEpochId, keyMaterial);\n    }\n  }\n\n  return keksByEpochId;\n}\n\nexport async function wrapBlobContentKey(\n  input: {\n    blobId: string;\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    execSql?: ExecSql | undefined;\n    secretKey: Uint8Array;\n    targets: readonly BlobContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<BlobContentKeyTargetEnvelopeRequest[]> {\n  assertDocumentKekPathsCurrent(\n    input.writerProjection,\n    new Set(input.targets.map((target) => target.containerId)),\n  );\n  const keksByEpochId = await collectContainerKeks({\n    execSql: input.execSql,\n    secretKey: input.secretKey,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n\n  return Promise.all(\n    input.targets.map(async (target) => {\n      const targetKek = keksByEpochId.get(target.containerKeyEpochId);\n      if (!targetKek) {\n        throw new Error(\n          `Blob target KEK could not be unwrapped for ${target.containerKeyEpochId}`,\n        );\n      }\n\n      const wrapped = await wrapContentKey(input.contentKey, targetKek, {\n        kind: \"Blob\",\n        objectId: input.blobId,\n        contentKeyEpoch: input.contentKeyEpoch,\n        containerId: target.containerId,\n        containerKeyEpochId: target.containerKeyEpochId,\n      });\n      return {\n        ...target,\n        wrappedKey: bytesToBase64(wrapped.ciphertext),\n        wrappingMetadata: {\n          suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n          iv: bytesToBase64(wrapped.iv),\n        },\n      };\n    }),\n  );\n}\n\nasync function unwrapBlobContentKeyTarget(input: {\n  blobId: string;\n  containerKek: Uint8Array;\n  contentKeyEpoch: number;\n  envelope: BlobContentKeyTargetEnvelopeRequest;\n}): Promise<Uint8Array> {\n  return unwrapContentKeyTargetForKind({\n    containerKek: input.containerKek,\n    contentKeyEpoch: input.contentKeyEpoch,\n    envelope: input.envelope,\n    kind: \"Blob\",\n    objectId: input.blobId,\n  });\n}\n\nexport async function unwrapBlobContentKey(\n  input: {\n    /** The blob being read; its wraps must be sealed to it. */\n    blobId: string;\n    contentKeyBundle: BlobContentKeyBundleResponse;\n    documentId: string;\n    encrypted: BlobEncryptedBytesHeader;\n    execSql?: ExecSql | undefined;\n    expectedBindingId: string;\n    secretKey: Uint8Array;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<Uint8Array> {\n  const keksByEpochId = await collectContainerKeks({\n    execSql: input.execSql,\n    secretKey: input.secretKey,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  let contentKey: Uint8Array | null = null;\n  const attachmentTargets = input.contentKeyBundle.targets.filter(\n    (envelope) =>\n      envelope.bindingId === input.expectedBindingId &&\n      envelope.documentId === input.documentId,\n  );\n\n  if (attachmentTargets.length === 0) {\n    throw new Error(\"Blob content-key bundle is missing attachment target\");\n  }\n\n  for (const envelope of attachmentTargets) {\n    const containerKek = keksByEpochId.get(envelope.containerKeyEpochId);\n    if (!containerKek) {\n      continue;\n    }\n    const unwrapped = await unwrapBlobContentKeyTarget({\n      blobId: input.blobId,\n      containerKek,\n      contentKeyEpoch: input.contentKeyBundle.contentKeyEpoch,\n      envelope,\n    });\n    if (contentKey) {\n      assertEqualBytes(\n        contentKey,\n        unwrapped,\n        \"Blob content-key targets unwrap to conflicting keys\",\n      );\n      continue;\n    }\n    contentKey = unwrapped;\n  }\n\n  if (!contentKey) {\n    throw new Error(\"Blob content key could not be unwrapped\");\n  }\n  return contentKey;\n}\n"]}

package/data/documents/blob/shared/readers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"readers.js","sourceRoot":"","sources":["readers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGrF,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAO9B,SAAS,SAAS,CAAC,MAA4B;IAC7C,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,mBAAmB;QAC1B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;KACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAqB;IAErB,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,gBAAkD;IAElD,MAAM,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC;IAC9C,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CACjC,gBAAgB,CAAC,KAAK,EACtB,YAAY,EACZ,2CAA2C,CAC5C,CAAC;IACF,IAAI,UAAU,KAAK,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,UAAU;QACV,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,cAAc,EAAE,gBAAgB,CAC9B,gBAAgB,CAAC,KAAK,EACtB,gBAAgB,EAChB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,cAAuC;IAEvC,OAAO,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA6C;IAE7C,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA8B,EAC9B,KAAa;IAEb,OAAO;QACL,SAAS,EAAE,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC;QACtD,UAAU,EAAE,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC;QACxD,WAAW,EAAE,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC;QAC1D,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,EACL,uBAAuB,EACvB,KAAK,CACN;QACD,mBAAmB,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,CAAC;QAC1E,iBAAiB,EAAE,yBAAyB,CAC1C,KAAK,EACL,mBAAmB,EACnB,KAAK,CACN;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { parseBlobEnvelopeV2 } from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { BlobContentKeyTargetEnvelopeRequest } from \"@tearleads/validators/request\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  readRecordPositiveInteger,\n  readRecordString,\n  sortTargets,\n} from \"../../shared/readers\";\nimport type {\n  BlobContentKeyTarget,\n  BlobEncryptedBytesRecord,\n  DocumentManifestIdentity,\n} from \"./types\";\n\nfunction targetKey(target: BlobContentKeyTarget): string {\n  return [\n    target.bindingId,\n    target.documentId,\n    target.containerId,\n    target.containerManifestHash,\n    target.containerKeyEpochId,\n    String(target.containerKeyEpoch),\n  ].join(\":\");\n}\n\nexport function sortBlobTargets<T extends BlobContentKeyTarget>(\n  targets: readonly T[],\n): T[] {\n  return sortTargets(targets, targetKey);\n}\n\nexport function readDocumentManifestIdentity(\n  writerProjection: DocumentWriterProjectionResponse,\n): DocumentManifestIdentity {\n  const { documentManifest } = writerProjection;\n  if (!isPlainRecord(documentManifest.state)) {\n    throw new Error(\"Document writer projection manifest state is invalid\");\n  }\n\n  const documentId = readRecordString(\n    documentManifest.state,\n    \"documentId\",\n    \"Document writer projection manifest state\",\n  );\n  if (documentId !== writerProjection.documentId) {\n    throw new Error(\"Document writer projection document id is inconsistent\");\n  }\n\n  return {\n    documentId,\n    manifestHash: documentManifest.manifestHash,\n    organizationId: readRecordString(\n      documentManifest.state,\n      \"organizationId\",\n      \"Document writer projection manifest state\",\n    ),\n  };\n}\n\nexport function parseBlobEncryptedBytes(\n  encryptedBytes: Uint8Array<ArrayBuffer>,\n): BlobEncryptedBytesRecord {\n  return parseBlobEnvelopeV2(encryptedBytes);\n}\n\nexport function contentKeyTargetReference(\n  envelope: BlobContentKeyTargetEnvelopeRequest,\n): BlobContentKeyTarget {\n  return {\n    bindingId: envelope.bindingId,\n    documentId: envelope.documentId,\n    containerId: envelope.containerId,\n    containerManifestHash: envelope.containerManifestHash,\n    containerKeyEpochId: envelope.containerKeyEpochId,\n    containerKeyEpoch: envelope.containerKeyEpoch,\n  };\n}\n\nexport function readBlobKekTarget(\n  value: Record<string, unknown>,\n  label: string,\n): BlobContentKeyTarget {\n  return {\n    bindingId: readRecordString(value, \"bindingId\", label),\n    documentId: readRecordString(value, \"documentId\", label),\n    containerId: readRecordString(value, \"containerId\", label),\n    containerManifestHash: readRecordString(\n      value,\n      \"containerManifestHash\",\n      label,\n    ),\n    containerKeyEpochId: readRecordString(value, \"containerKeyEpochId\", label),\n    containerKeyEpoch: readRecordPositiveInteger(\n      value,\n      \"containerKeyEpoch\",\n      label,\n    ),\n  };\n}\n"]}

package/data/documents/blob/shared/responses.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"responses.js","sourceRoot":"","sources":["responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,sBAAsB,EACtB,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AAGnB,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,MAAmC;IAEnC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAC9C,CAAC;IACF,IAAI,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAmC;IAEnC,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,KAQtD;IACC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;QAC9D,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,eAAe;QAChE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU;QACtD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO;KACjD,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC,wBAAwB,CAAC,CAAC;IACrE,IACE,kBAAkB,CAChB,wBAAwB,EACxB,kDAAkD,CACnD;QACD,kBAAkB,CAChB,8BAA8B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACtD,iDAAiD,CAClD,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CACrC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC1D,iBAAiB,CACf,MAAM,EACN,4CAA4C,KAAK,GAAG,CACrD,CACF,CACF,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,IACE,kBAAkB,CAChB,eAAe,EACf,2CAA2C,CAC5C;QACD,kBAAkB,CAChB,eAAe,EACf,0CAA0C,CAC3C,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IACE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACrD,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,cAAc;YAC1C,KAAK,CAAC,gBAAgB,CAAC,cAAc;QACvC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,iBAAiB,KAAK,KAAK,CAAC,UAAU,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,qBAAqB,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB;QACtD,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,wDAAwD;KAClE,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB;QAC5D,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,2DAA2D;KACrE,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,6BAA6B;QACnE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;QACvE,OAAO,EAAE,4DAA4D;KACtE,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,0BAA0B;QAChE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;QACrE,OAAO,EAAE,uDAAuD;KACjE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAetD;IACC,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,yEAAyE;IACzE,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY;QAC5B,KAAK,CAAC,QAAQ,CAAC,oBAAoB;YACjC,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACrC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,KAAK,KAAK,CAAC,IAAI,CAAC,iBAAiB;QACjE,kBAAkB,CAChB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAChC,0CAA0C,CAC3C,KAAK,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,mCAAmC,CAAC;QACzE,kBAAkB,CAChB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EACjC,qCAAqC,CACtC;YACC,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,oCAAoC,CAAC;QACvE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS;YACnC,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC3B,kBAAkB,CAChB,KAAK,CAAC,QAAQ,CAAC,WAAW,EAC1B,4CAA4C,CAC7C;YACC,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,8BAA8B,CAAC;QACvE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACtC,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAC5C,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC9C,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACtC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB;YAClD,KAAK,CAAC,sBAAsB;QAC9B,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB;QAClC,kBAAkB,CAChB,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EACjC,mDAAmD,CACpD;YACC,kBAAkB,CAChB,KAAK,CAAC,QAAQ,CAAC,cAAc,EAC7B,2CAA2C,CAC5C;QACH,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,uCAAuC,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAMlD;IACC,IACE,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAC5C,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACtC,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC9C,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AttachmentBindAccessEventBody,\n  computeAccessEventHash,\n  computeBlobContentKeyTargetHash,\n  type WriteHeader,\n} from \"@tearleads/crypto\";\nimport type { BlobContentKeyBundleRequest } from \"@tearleads/validators/request\";\nimport type {\n  BlobAttachmentBindResponse,\n  BlobAttachmentDetachResponse,\n} from \"@tearleads/validators/response\";\nimport { serializeCanonical, uniqueSortedStrings } from \"../../shared/readers\";\nimport {\n  contentKeyTargetReference,\n  readBlobKekTarget,\n  sortBlobTargets,\n} from \"./readers\";\nimport type { BlobContentKeyTarget, DocumentManifestIdentity } from \"./types\";\n\nexport async function assertBlobContentKeyBundleTargetHash(\n  bundle: BlobContentKeyBundleRequest,\n): Promise<void> {\n  const targetHash = await computeBlobContentKeyTargetHash(\n    bundle.targets.map(contentKeyTargetReference),\n  );\n  if (targetHash !== bundle.targetHash) {\n    throw new Error(\"Blob content-key target hash is not canonical\");\n  }\n}\n\nfunction normalizedBlobContentKeyBundle(\n  bundle: BlobContentKeyBundleRequest,\n): BlobContentKeyBundleRequest {\n  return {\n    contentKeyEpoch: bundle.contentKeyEpoch,\n    targetHash: bundle.targetHash,\n    targets: sortBlobTargets(bundle.targets),\n  };\n}\n\nfunction assertStringSetsEqual(input: {\n  actual: readonly string[];\n  expected: readonly string[];\n  message: string;\n}): void {\n  const actual = uniqueSortedStrings(input.actual);\n  const expected = uniqueSortedStrings(input.expected);\n  if (\n    actual.length !== expected.length ||\n    actual.some((value, index) => value !== expected[index])\n  ) {\n    throw new Error(input.message);\n  }\n}\n\nasync function assertBlobAttachmentBindResponseTargets(input: {\n  bindingId: string;\n  blobId: string;\n  contentKeyBundle: BlobContentKeyBundleRequest;\n  manifestIdentity: DocumentManifestIdentity;\n  response: BlobAttachmentBindResponse;\n  targetHash: string;\n  targets: readonly BlobContentKeyTarget[];\n}): Promise<void> {\n  if (input.response.contentKeyBundle.blobId !== input.blobId) {\n    throw new Error(\"Blob attachment bind response blob id mismatch\");\n  }\n\n  const responseContentKeyBundle = normalizedBlobContentKeyBundle({\n    contentKeyEpoch: input.response.contentKeyBundle.contentKeyEpoch,\n    targetHash: input.response.contentKeyBundle.targetHash,\n    targets: input.response.contentKeyBundle.targets,\n  });\n  await assertBlobContentKeyBundleTargetHash(responseContentKeyBundle);\n  if (\n    serializeCanonical(\n      responseContentKeyBundle,\n      \"Blob attachment bind response content-key bundle\",\n    ) !==\n    serializeCanonical(\n      normalizedBlobContentKeyBundle(input.contentKeyBundle),\n      \"Blob attachment bind request content-key bundle\",\n    )\n  ) {\n    throw new Error(\n      \"Blob attachment bind response content-key bundle mismatch\",\n    );\n  }\n\n  const responseTargets = sortBlobTargets(\n    input.response.blobKekTargets.targets.map((target, index) =>\n      readBlobKekTarget(\n        target,\n        `Blob attachment bind response KEK target[${index}]`,\n      ),\n    ),\n  );\n  const expectedTargets = sortBlobTargets(input.targets);\n  if (\n    serializeCanonical(\n      responseTargets,\n      \"Blob attachment bind response KEK targets\",\n    ) !==\n    serializeCanonical(\n      expectedTargets,\n      \"Blob attachment bind request KEK targets\",\n    )\n  ) {\n    throw new Error(\"Blob attachment bind response KEK targets mismatch\");\n  }\n\n  if (\n    input.response.blobKekTargets.blobId !== input.blobId ||\n    input.response.blobKekTargets.organizationId !==\n      input.manifestIdentity.organizationId ||\n    input.response.blobKekTargets.blobKeyTargetHash !== input.targetHash\n  ) {\n    throw new Error(\"Blob attachment bind response KEK summary mismatch\");\n  }\n  assertStringSetsEqual({\n    actual: input.response.blobKekTargets.activeBindingIds,\n    expected: [input.bindingId],\n    message: \"Blob attachment bind response active bindings mismatch\",\n  });\n  assertStringSetsEqual({\n    actual: input.response.blobKekTargets.documentManifestHashes,\n    expected: [input.manifestIdentity.manifestHash],\n    message: \"Blob attachment bind response document manifests mismatch\",\n  });\n  assertStringSetsEqual({\n    actual: input.response.blobKekTargets.linkedContainerManifestHashes,\n    expected: expectedTargets.map((target) => target.containerManifestHash),\n    message: \"Blob attachment bind response container manifests mismatch\",\n  });\n  assertStringSetsEqual({\n    actual: input.response.blobKekTargets.linkedContainerKeyEpochIds,\n    expected: expectedTargets.map((target) => target.containerKeyEpochId),\n    message: \"Blob attachment bind response container KEKs mismatch\",\n  });\n}\n\nexport async function assertBlobAttachmentBindResponse(input: {\n  body: AttachmentBindAccessEventBody;\n  bindingId: string;\n  blobAccessManifestHash: string;\n  blobId: string;\n  contentKeyBundle: BlobContentKeyBundleRequest;\n  documentId: string;\n  event: AccessEvent;\n  manifestIdentity: DocumentManifestIdentity;\n  response: BlobAttachmentBindResponse;\n  slotId: string;\n  targetHash: string;\n  targets: readonly BlobContentKeyTarget[];\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n}): Promise<void> {\n  // This boundary is used only by the staged upload workflow: those bytes were\n  // written under the same target set the bind response acknowledges. A future\n  // SDK re-bind workflow must instead accept the blob's historical write\n  // authorization, which can legitimately differ from the new binding set.\n  if (\n    !input.response.bindingEvent ||\n    input.response.documentManifestHash !==\n      input.manifestIdentity.manifestHash ||\n    input.response.previousBindingId !== input.body.expectedBindingId ||\n    serializeCanonical(\n      input.response.bindingEvent.body,\n      \"Blob attachment bind response event body\",\n    ) !== serializeCanonical(input.body, \"Blob attachment bind request body\") ||\n    serializeCanonical(\n      input.response.bindingEvent.event,\n      \"Blob attachment bind response event\",\n    ) !==\n      serializeCanonical(input.event, \"Blob attachment bind request event\") ||\n    input.response.bindingEvent.eventHash !==\n      (await computeAccessEventHash(input.event)) ||\n    !input.response.writeHeader ||\n    serializeCanonical(\n      input.response.writeHeader,\n      \"Blob attachment bind response write header\",\n    ) !==\n      serializeCanonical(input.writeHeader, \"Blob attachment write header\") ||\n    input.response.blobId !== input.blobId ||\n    input.response.bindingId !== input.bindingId ||\n    input.response.documentId !== input.documentId ||\n    input.response.slotId !== input.slotId ||\n    input.response.blobKekTargets.blobAccessManifestHash !==\n      input.blobAccessManifestHash ||\n    !input.response.writeAuthorization ||\n    serializeCanonical(\n      input.response.writeAuthorization,\n      \"Blob attachment bind response write authorization\",\n    ) !==\n      serializeCanonical(\n        input.response.blobKekTargets,\n        \"Blob attachment bind response KEK targets\",\n      ) ||\n    input.response.writeHeaderHash !== input.writeHeaderHash\n  ) {\n    throw new Error(\"Blob attachment bind response did not match request\");\n  }\n\n  await assertBlobAttachmentBindResponseTargets(input);\n}\n\nexport function assertBlobAttachmentDetachResponse(input: {\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  response: BlobAttachmentDetachResponse;\n  slotId: string;\n}): void {\n  if (\n    input.response.bindingId !== input.bindingId ||\n    input.response.blobId !== input.blobId ||\n    input.response.documentId !== input.documentId ||\n    input.response.slotId !== input.slotId\n  ) {\n    throw new Error(\"Blob attachment detach response did not match request\");\n  }\n}\n"]}

package/data/documents/blob/shared/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAqCA,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GACzC,mCAAmC,CAAC;AACtC,MAAM,CAAC,MAAM,gCAAgC,GAC3C,qCAAqC,CAAC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GACxC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC","sourcesContent":["import type {\n  RequestFailureKind,\n  RequestResultOptions,\n  UploadMultipartBlobPartBytesRequest,\n} from \"@tearleads/api-client\";\nimport type {\n  BlobContentKeyTarget,\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n  WriteHeader,\n} from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentBindRequest,\n  BlobAttachmentDetachRequest,\n  BlobContentKeyBundleRequest,\n  InitiateMultipartBlobStageRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  BlobAttachmentBindResponse,\n  BlobAttachmentDetachResponse,\n  BlobAttachmentSummary,\n  DocumentWriterProjectionResponse,\n  InitiateMultipartBlobStageResponse,\n  MultipartBlobStageStatusResponse,\n  UploadMultipartBlobPartResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  BlobByteSourceInput,\n  BlobBytes,\n} from \"../../../blobs/blobContracts\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../sqlite/sqlSchema\";\nimport type { DocumentCreateAuthor } from \"../../shared/types\";\n\nexport const BLOB_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.blob.content-record-key-info\";\nexport const BLOB_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.blob.content-record-aad\";\nexport const BLOB_CONTENT_RECORD_NONCE_DOMAIN =\n  \"tearleads.blob.content-record-nonce\";\nexport const BLOB_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.blob.content-record-hkdf-salt\");\nexport const TEXT_ENCODER = new TextEncoder();\n\nexport interface BlobAttachmentRequestOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n}\n\nexport interface BlobAttachmentApi {\n  bindBlobAttachment(\n    blobId: string,\n    input: BlobAttachmentBindRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentBindResponse | null>;\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getRequestFailure?(input: {\n    method: \"DELETE\" | \"GET\" | \"POST\" | \"PUT\";\n    path: string;\n  }): {\n    readonly code?: string | undefined;\n    readonly kind: RequestFailureKind;\n    readonly message: string;\n    readonly status: number | null;\n  } | null;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getMultipartBlobStage(\n    stageId: string,\n  ): Promise<MultipartBlobStageStatusResponse | null>;\n  initiateMultipartBlobStage(\n    input: InitiateMultipartBlobStageRequest,\n  ): Promise<InitiateMultipartBlobStageResponse | null>;\n  uploadMultipartBlobPartBytes(\n    stageId: string,\n    partNumber: number,\n    input: UploadMultipartBlobPartBytesRequest,\n    options?: RequestResultOptions,\n  ): Promise<UploadMultipartBlobPartResponse | null>;\n}\n\nexport interface BlobAttachmentDetachApi {\n  detachBlobAttachment(\n    blobId: string,\n    bindingId: string,\n    input: BlobAttachmentDetachRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentDetachResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n}\n\nexport type { BlobContentKeyTarget };\n\n/**\n * Aliases of the crypto parser's own types. The parser is shared with the API,\n * so restating these shapes here would let the two drift apart silently.\n */\nexport type BlobEncryptedBytesRecord = BlobEnvelopeRecord;\n\n/**\n * The envelope as the header establishes it. Streaming readers hold this\n * before any ciphertext is read, so it has no `chunks`: an empty array there\n * would read as an empty object rather than an unread one.\n */\nexport type BlobEncryptedBytesHeader = BlobEnvelopeHeaderRecord;\n\nexport type BlobEncryptedChunk = BlobEnvelopeRecord[\"chunks\"][number];\n\nexport interface BlobSourceSnapshot {\n  readonly byteLength: number;\n  readonly chunkSha256: readonly string[];\n  readonly chunkSize: number;\n  readonly sha256: string;\n}\n\nexport interface BlobEncryptionPlan {\n  readonly byteLength: number;\n  readonly chunkSize: number;\n  readonly metadataHash: string;\n  readonly partCount: number;\n  readonly plaintextByteLength: number;\n  readonly plaintextSha256: string;\n  readonly sha256: string;\n  encryptPart(index: number): Promise<BlobBytes>;\n  getPartByteLength(index: number): number;\n}\n\nexport interface DocumentManifestIdentity {\n  documentId: string;\n  manifestHash: string;\n  organizationId: string;\n}\n\nexport interface BlobAttachmentMaterial {\n  blobAccessManifestHash: string;\n  contentKeyBundle: BlobContentKeyBundleRequest;\n  encrypted: BlobEncryptionPlan;\n  manifestIdentity: DocumentManifestIdentity;\n  targetHash: string;\n  targets: BlobContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\n/**\n * Progress for an in-flight multipart blob upload.\n */\nexport interface MultipartUploadProgress {\n  readonly bytesTotal: number;\n  readonly bytesUploaded: number;\n  readonly partsCompleted: number;\n  readonly partsTotal: number;\n}\n\nexport type MultipartUploadProgressListener = (\n  progress: MultipartUploadProgress,\n) => void;\n\n/**\n * Fires once a multipart stage has been opened (or resumed), with its id and\n * plaintext chunk size. Callers persist both so a later attempt can reproduce\n * the same encrypted parts and resume instead of orphaning the partial upload.\n */\nexport type MultipartStageResolvedListener = (input: {\n  readonly partSize: number;\n  readonly stageId: string;\n}) => void | Promise<void>;\n\nexport interface UploadDocumentAttachmentInput {\n  apiClient: BlobAttachmentApi;\n  author: DocumentCreateAuthor;\n  blobId?: string | undefined;\n  bindingId?: string | undefined;\n  bytes: BlobByteSourceInput;\n  contentKey?: Uint8Array | undefined;\n  contentKeyEpoch?: number | undefined;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  expectedBindingId: string | null;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  // A persisted nonce seed. The plaintext digest derives the envelope IV from\n  // it, then each chunk derives a unique IV. Same-source retries reproduce the\n  // encrypted parts; changed bytes cannot reuse their AES-GCM nonces.\n  nonceSeed?: Uint8Array | undefined;\n  multipart?: MultipartBlobUploadOptions | undefined;\n  onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  onStageResolved?: MultipartStageResolvedListener | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface MultipartBlobUploadOptions {\n  /** Exactly 5 MiB per plaintext encryption chunk; transport parts include envelope overhead. */\n  readonly partSize: number;\n  // The id of a previously opened stage to resume. When set, the upload refetches\n  // that stage and skips parts the server already has instead of opening a new\n  // one; if the stage is gone (expired), it falls back to a fresh stage.\n  readonly resumeStageId?: string | undefined;\n  readonly uploadConcurrency?: number | undefined;\n}\n\nexport interface UploadDocumentAttachmentResult {\n  blobId: string;\n  bindingId: string;\n  request: BlobAttachmentBindRequest;\n  response: BlobAttachmentBindResponse;\n  sha256: string;\n  byteLength: number;\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DetachDocumentAttachmentInput {\n  apiClient: BlobAttachmentDetachApi;\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DetachDocumentAttachmentResult {\n  request: BlobAttachmentDetachRequest;\n  response: BlobAttachmentDetachResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DecryptDocumentAttachmentBlobInput {\n  binding: BlobAttachmentSummary;\n  encryptedBytes: BlobBytes;\n  expectedDocumentId: string;\n  expectedSlotId: string;\n  execSql: ExecSql;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  targetSecretKey: Uint8Array;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n"]}