@terrascale/sdk 0.0.3 → 0.0.5

package/src/v1/management-decode.js

@@ -0,0 +1,24 @@
+import { array, malformed, object, string, boolean } from "./decode.js";
+import { ExactDecimal } from "./json.js";
+/** @import { JsonValue } from "./json.js" */
+/** @template T @typedef {(value: JsonValue | undefined) => T} Decoder */
+export const text = /** @type {Decoder<string>} */ (value => string(value, "string"));
+export const flag = /** @type {Decoder<boolean>} */ (value => boolean(value, "boolean"));
+/** @type {Decoder<number | ExactDecimal>} */
+export const numeric = value => typeof value === "number" && Number.isFinite(value) || value instanceof ExactDecimal ? value : malformed("number");
+/** @template T @param {Decoder<T>} decode @returns {Decoder<T | null>} */
+export const nullable = decode => value => value === null ? null : decode(value);
+/** @template T @param {Decoder<T>} decode @returns {Decoder<T | undefined>} */
+export const optional = decode => value => value === undefined ? undefined : decode(value);
+/** @template T @param {Decoder<T>} decode @returns {Decoder<readonly T[]>} */
+export const list = decode => value => Object.freeze(array(value, "array").map(decode));
+/** @template T @param {{ [K in keyof T]: Decoder<T[K]> }} fields @returns {Decoder<Readonly<T>>} */
+export function record(fields) {
+  return value => {
+    const raw = object(value, "management response");
+    return Object.freeze(/** @type {T} */ (Object.fromEntries(Object.entries(fields).map(([key, decode]) =>
+      [key, /** @type {Decoder<unknown>} */ (decode)(raw[key])]))));
+  };
+}
+/** @template T @param {Decoder<T>} decode @returns {Decoder<Readonly<Record<string, T>>>} */
+export const dictionary = decode => value => Object.freeze(Object.fromEntries(Object.entries(object(value, "dictionary")).map(([key, item]) => [key, decode(item)])));

package/src/v1/management-routes.js

@@ -0,0 +1,72 @@
+/** @typedef {"getShapeManifest" | "exportDatabase" | "putCollectionTtl" | "getCollectionTtl" | "deleteCollectionTtl" | "healthz" | "readyz" | "backupz" | "replicationHealth" | "listPlatformDatabases" | "listPlatformCollections" | "listPlatformDocuments" | "getPlatformDocument" | "createImport" | "getImport" | "uploadImportSource" | "updateImport" | "startImport" | "cancelImport" | "resumeImport" | "createBackup" | "listBackups" | "restoreBackup" | "getBackupPolicy" | "setBackupPolicy" | "getRestoreWindow" | "planPointInTime" | "restorePointInTime" | "getBackupDestination" | "setBackupDestination" | "deleteBackupDestination" | "getProjectUsage" | "getProjectAnalytics" | "getProjectReplication" | "getDatabaseUsage" | "getDatabaseAnalytics" | "getDatabaseReplication" | "createIndex" | "listIndexes" | "dropIndex" | "getAutoIndexPolicy" | "setAutoIndexPolicy" | "listIndexRecommendations" | "applyIndexRecommendation" | "getDatabaseSchema" | "inferCollectionSchema" | "declareCollectionSchema" | "listQueryShapes" | "createSavedQuery" | "listSavedQueries" | "getSavedQuery" | "updateSavedQuery" | "deleteSavedQuery"} ManagementOperation */
+const saved = "/v1/projects/{project}/saved-queries";
+const ttl = "/v1/projects/{project}/databases/{database}/collections/{collection}/ttl";
+/** @type {readonly import("./routes.js").V1Route[]} */
+export const managementV1Routes = Object.freeze([
+  route("getShapeManifest", "GET", "/v1/projects/{project}/databases/{database}/collections/{collection}/shape/manifest"),
+  route("exportDatabase", "GET", "/v1/projects/{project}/databases/{database}/export"),
+  route("putCollectionTtl", "PUT", ttl),
+  route("getCollectionTtl", "GET", ttl),
+  route("deleteCollectionTtl", "DELETE", ttl),
+  route("healthz", "GET", "/healthz"),
+  route("readyz", "GET", "/readyz"),
+  route("backupz", "GET", "/backupz"),
+  route("replicationHealth", "GET", "/health/replication"),
+  route("listPlatformDatabases", "GET", "/v1/platform/databases"),
+  route("listPlatformCollections", "GET", "/v1/platform/databases/{database}/collections"),
+  route("listPlatformDocuments", "GET", "/v1/platform/databases/{database}/collections/{collection}/documents"),
+  route("getPlatformDocument", "GET", "/v1/platform/databases/{database}/collections/{collection}/documents/by-key"),
+  route("createImport", "POST", "/v1/projects/{project}/databases/{database}/import", 201),
+  route("getImport", "GET", "/v1/projects/{project}/databases/{database}/import", 200),
+  route("uploadImportSource", "PUT", "/v1/projects/{project}/databases/{database}/import/source", 200),
+  route("updateImport", "PATCH", "/v1/projects/{project}/databases/{database}/import", 202),
+  route("startImport", "POST", "/v1/projects/{project}/databases/{database}/import/start", 202),
+  route("cancelImport", "POST", "/v1/projects/{project}/databases/{database}/import/cancel", 202),
+  route("resumeImport", "POST", "/v1/projects/{project}/databases/{database}/import/resume", 202),
+  route("createBackup", "POST", "/v1/projects/{project}/databases/{database}/backups", 201),
+  route("listBackups", "GET", "/v1/projects/{project}/databases/{database}/backups", 200),
+  route("restoreBackup", "POST", "/v1/projects/{project}/databases/{database}/backups/{backup}/restore", 201),
+  route("getBackupPolicy", "GET", "/v1/projects/{project}/databases/{database}/backup-policy", 200),
+  route("setBackupPolicy", "PUT", "/v1/projects/{project}/databases/{database}/backup-policy", 200),
+  route("getRestoreWindow", "GET", "/v1/projects/{project}/databases/{database}/point-in-time", 200),
+  route("planPointInTime", "POST", "/v1/projects/{project}/databases/{database}/point-in-time/plan", 200),
+  route("restorePointInTime", "POST", "/v1/projects/{project}/databases/{database}/point-in-time/restore", 201),
+  route("getBackupDestination", "GET", "/v1/projects/{project}/backup-destination", 200),
+  route("setBackupDestination", "PUT", "/v1/projects/{project}/backup-destination", 200),
+  route("deleteBackupDestination", "DELETE", "/v1/projects/{project}/backup-destination", 204),
+  route("getProjectUsage", "GET", "/v1/projects/{project}/usage"),
+  route("getProjectAnalytics", "GET", "/v1/projects/{project}/analytics"),
+  route("getProjectReplication", "GET", "/v1/projects/{project}/replication"),
+  route("getDatabaseUsage", "GET", "/v1/projects/{project}/databases/{database}/usage"),
+  route("getDatabaseAnalytics", "GET", "/v1/projects/{project}/databases/{database}/analytics"),
+  route("getDatabaseReplication", "GET", "/v1/projects/{project}/databases/{database}/replication"),
+  route("createIndex", "POST", "/v1/projects/{project}/databases/{database}/indexes", 201),
+  route("listIndexes", "GET", "/v1/projects/{project}/databases/{database}/indexes", 200),
+  route("dropIndex", "DELETE", "/v1/projects/{project}/databases/{database}/indexes/{index}", 204),
+  route("getAutoIndexPolicy", "GET", "/v1/projects/{project}/databases/{database}/auto-index/{collection}", 200),
+  route("setAutoIndexPolicy", "PUT", "/v1/projects/{project}/databases/{database}/auto-index/{collection}", 200),
+  route("listIndexRecommendations", "GET", "/v1/projects/{project}/databases/{database}/index-recommendations", 200),
+  route("applyIndexRecommendation", "POST", "/v1/projects/{project}/databases/{database}/index-recommendations/{recommendation}/apply", 201),
+  route("getDatabaseSchema", "GET", "/v1/projects/{project}/databases/{database}/schema"),
+  route("inferCollectionSchema", "GET", "/v1/projects/{project}/databases/{database}/schema/{collection}"),
+  route("declareCollectionSchema", "PUT", "/v1/projects/{project}/databases/{database}/schema/{collection}"),
+  route("listQueryShapes", "GET", "/v1/projects/{project}/databases/{database}/query-shapes"),
+  route("createSavedQuery", "POST", saved, 201),
+  route("listSavedQueries", "GET", saved),
+  route("getSavedQuery", "GET", `${saved}/{query}`),
+  route("updateSavedQuery", "PUT", `${saved}/{query}`),
+  route("deleteSavedQuery", "DELETE", `${saved}/{query}`, 204),
+]);
+
+/** @param {ManagementOperation} operation @param {import("./routes.js").V1Route["method"]} method @param {string} pathTemplate @param {number} [status] @returns {import("./routes.js").V1Route} */
+function route(operation, method, pathTemplate, status = 200) {
+  const write = method !== "GET" && operation !== "planPointInTime";
+  const noBody = ["createBackup", "applyIndexRecommendation", "cancelImport", "resumeImport"].includes(operation);
+  return Object.freeze({ operation, method, pathTemplate,
+    permission: operation === "getShapeManifest" || operation === "exportDatabase" || operation === "getCollectionTtl" ? "documents:read" : pathTemplate === ttl ? "documents:write" : pathTemplate.startsWith("/v1/platform/") ? "platform-admin" : !pathTemplate.startsWith("/v1/") ? "anonymous" : write ? "databases:write" : "databases:read",
+    additionalPermissions: Object.freeze(["createImport", "uploadImportSource", "updateImport", "startImport", "resumeImport"].includes(operation) ? ["documents:write"] : []),
+    requestMediaTypes: Object.freeze(noBody ? [] : operation === "uploadImportSource" ? ["application/octet-stream"] : method === "POST" || method === "PUT" || method === "PATCH" ? ["application/json"] : []),
+    responseMediaType: status === 204 ? "" : operation === "exportDatabase" ? "application/x-ndjson" : "application/json", successStatuses: Object.freeze(operation === "readyz" || operation === "backupz" ? [200, 503] : operation === "applyIndexRecommendation" || operation === "createImport" ? [200, 201] : [status]),
+    idempotencyKey: "none", replaySafe: !write, contract: "docs/terrabase/api.md", contractText: Object.freeze([]),
+  });
+}

package/src/v1/management-validation.js

@@ -0,0 +1,25 @@
+/** @import { V1DatabaseListRequest } from "./catalog.js" */
+/** @param {unknown} request @param {readonly string[]} allowed */
+export function members(request, allowed) {
+  if (request === null || typeof request !== "object" || Array.isArray(request) ||
+      ![Object.prototype, null].includes(Object.getPrototypeOf(request))) throw new TypeError("Expected a plain request object.");
+  for (const key of Object.keys(request)) if (!allowed.includes(key)) throw new TypeError(`Unknown request member ${key}.`);
+}
+/** @param {object} options */
+export function mutationOptions(options) {
+  if ("idempotencyKey" in options) throw new TypeError("The producer does not support Idempotency-Key; mutations are never replayed.");
+}
+/** @param {V1DatabaseListRequest} request */
+export function pageQuery(request) {
+  members(request, ["after", "limit"]);
+  const query = new URLSearchParams();
+  if (request.after !== undefined) {
+    if (typeof request.after !== "string") throw new TypeError("after must be an opaque string.");
+    query.set("after", request.after);
+  }
+  if (request.limit !== undefined) {
+    if (!Number.isInteger(request.limit) || request.limit < 1 || request.limit > 100) throw new TypeError("limit must be 1-100.");
+    query.set("limit", String(request.limit));
+  }
+  return query;
+}

package/src/v1/routes.js

@@ -1,11 +1,13 @@
-// Routes owned by the C# Documents API at 6cb9745 (decision 0004 and shape-reads.md).
-/** @typedef {"getDocument" | "putDocument" | "createDocument" | "patchDocument" | "deleteDocument" | "commitTransaction" | "queryDocuments" | "createCollection" | "getCollection" | "listCollections" | "dropCollection" | "readShape"} V1Operation */
+import { managementV1Routes } from "./management-routes.js";
+// Current TerraBase routes at e30ffdc; readShape is retained from release 6cb9745 only.
+/** @typedef {import("./management-routes.js").ManagementOperation | "readFreeShape" | "getShapeKey" | "getDocument" | "putDocument" | "createDocument" | "patchDocument" | "deleteDocument" | "commitTransaction" | "queryDocuments" | "createCollection" | "getCollection" | "listCollections" | "dropCollection" | "readShape" | "runSql" | "checkSql" | "explainSql" | "streamDatabaseChanges" | "listDocuments" | "getCollectionSchema" | "putCollectionSchema" | "deleteCollectionSchema" | "createDatabase" | "listDatabases" | "getDatabase" | "updateDatabase" | "deleteDatabase" | "branchDatabase"} V1Operation */
 /**
  * @typedef {object} V1Route
  * @property {V1Operation} operation
  * @property {"GET" | "PUT" | "POST" | "PATCH" | "DELETE"} method
  * @property {string} pathTemplate
- * @property {"documents:read" | "documents:write" | "shapes:read"} permission
+ * @property {"documents:read" | "documents:write" | "shapes:read" | "databases:read" | "databases:write" | "anonymous" | "platform-admin"} permission
+ * @property {readonly string[]} [additionalPermissions]
  * @property {readonly string[]} requestMediaTypes
  * @property {string} responseMediaType
  * @property {readonly number[]} successStatuses
@@ -18,6 +20,7 @@ const database = "/v1/projects/{project}/databases/{database}";
 const collections = `${database}/collections`;
 const collection = `${collections}/{collection}`;
 const documents = `${collection}/documents`;
+const databases = "/v1/projects/{project}/databases";
 /** @type {readonly V1Route[]} */
 export const v1Routes = Object.freeze(/** @type {V1Route[]} */ ([
   { operation: "getDocument", method: "GET", pathTemplate: `${documents}/by-key`, permission: "documents:read", requestMediaTypes: [], successStatuses: [200] },
@@ -32,10 +35,25 @@ export const v1Routes = Object.freeze(/** @type {V1Route[]} */ ([
   { operation: "listCollections", method: "GET", pathTemplate: collections, permission: "documents:read", requestMediaTypes: [], successStatuses: [200] },
   { operation: "dropCollection", method: "DELETE", pathTemplate: collection, permission: "documents:write", requestMediaTypes: [], successStatuses: [200] },
   { operation: "readShape", method: "GET", pathTemplate: `${collection}/shape`, permission: "shapes:read", requestMediaTypes: [], successStatuses: [200, 307] },
+  { operation: "runSql", method: "POST", pathTemplate: `${database}/sql`, permission: "databases:read", requestMediaTypes: ["application/json"], successStatuses: [200] },
+  { operation: "checkSql", method: "POST", pathTemplate: `${database}/sql/check`, permission: "databases:read", requestMediaTypes: ["application/json"], successStatuses: [200] },
+  { operation: "explainSql", method: "POST", pathTemplate: `${database}/sql/explain`, permission: "databases:read", requestMediaTypes: ["application/json"], successStatuses: [200] },
+  { operation: "streamDatabaseChanges", method: "GET", pathTemplate: `${database}/changes`, permission: "documents:read", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "listDocuments", method: "GET", pathTemplate: documents, permission: "documents:read", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "getCollectionSchema", method: "GET", pathTemplate: `${collection}/schema`, permission: "documents:read", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "putCollectionSchema", method: "PUT", pathTemplate: `${collection}/schema`, permission: "documents:write", requestMediaTypes: ["application/json"], successStatuses: [200] },
+  { operation: "deleteCollectionSchema", method: "DELETE", pathTemplate: `${collection}/schema`, permission: "documents:write", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "createDatabase", method: "POST", pathTemplate: databases, permission: "databases:write", requestMediaTypes: ["application/json"], successStatuses: [201] },
+  { operation: "listDatabases", method: "GET", pathTemplate: databases, permission: "databases:read", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "getDatabase", method: "GET", pathTemplate: database, permission: "databases:read", requestMediaTypes: [], successStatuses: [200] },
+  { operation: "updateDatabase", method: "PATCH", pathTemplate: database, permission: "databases:write", requestMediaTypes: ["application/json"], successStatuses: [200] },
+  { operation: "deleteDatabase", method: "DELETE", pathTemplate: database, permission: "databases:write", requestMediaTypes: [], successStatuses: [204] },
+  { operation: "branchDatabase", method: "POST", pathTemplate: `${database}/branches`, permission: "databases:write", requestMediaTypes: ["application/json"], successStatuses: [201] },
 ].map(route => ({
-  ...route, responseMediaType: "application/json", idempotencyKey: "none",
-  replaySafe: route.permission !== "documents:write",
-  contract: route.operation === "readShape" ? "docs/shape-reads.md" : "docs/decisions/0004-document-api-v1.md",
+  ...route, responseMediaType: route.operation === "deleteDatabase" ? "" : route.operation === "streamDatabaseChanges" ? "text/event-stream" : "application/json", idempotencyKey: "none",
+  replaySafe: !route.permission.endsWith(":write"),
+  contract: route.operation === "readShape" ? "docs/shape-reads.md" :
+    ["runSql", "checkSql", "explainSql", "streamDatabaseChanges"].includes(route.operation) ? "docs/terrabase/api.md" : "docs/decisions/0004-document-api-v1.md",
   contractText: [],
 }))).map(route => Object.freeze({
   ...route, requestMediaTypes: Object.freeze(route.requestMediaTypes),
@@ -43,7 +61,7 @@ export const v1Routes = Object.freeze(/** @type {V1Route[]} */ ([
 })));
 /** @param {V1Operation} operation @returns {V1Route} */
 export function v1Route(operation) {
-  const route = v1Routes.find(candidate => candidate.operation === operation);
+  const route = [...v1Routes, ...shapeV1Routes, ...managementV1Routes].find(candidate => candidate.operation === operation);
   if (route === undefined) throw new TypeError(`Unknown v1 operation ${operation}.`);
   return route;
 }
@@ -55,3 +73,10 @@ export function v1RoutePath(route, params) {
     return encodeURIComponent(value);
   });
 }
+
+// Proposed free-read protocol, separately inventoried from historical/runtime route evidence.
+/** @type {readonly V1Route[]} */
+export const shapeV1Routes = Object.freeze([
+  Object.freeze({ operation: /** @type {const} */ ("readFreeShape"), method: /** @type {const} */ ("GET"), pathTemplate: `${collection}/shape`, permission: /** @type {const} */ ("documents:read"), requestMediaTypes: Object.freeze([]), responseMediaType: "application/json", successStatuses: Object.freeze([200, 307]), idempotencyKey: /** @type {const} */ ("none"), replaySafe: true, contract: "docs/terrabase/shape-reads.md", contractText: Object.freeze([]) }),
+  Object.freeze({ operation: /** @type {const} */ ("getShapeKey"), method: /** @type {const} */ ("GET"), pathTemplate: `${collection}/shape/keys`, permission: /** @type {const} */ ("documents:read"), requestMediaTypes: Object.freeze([]), responseMediaType: "application/json", successStatuses: Object.freeze([200]), idempotencyKey: /** @type {const} */ ("none"), replaySafe: true, contract: "docs/terrabase/shape-reads.md", contractText: Object.freeze([]) }),
+]);

package/src/v1/saved-queries.js

@@ -0,0 +1,58 @@
+import { requireId } from "../ids.js";
+import { array, malformed, object, string } from "./decode.js";
+import { stringifyExactJson } from "./json.js";
+import { members, mutationOptions, pageQuery } from "./management-validation.js";
+/** @import { V1Transport } from "./transport.js" */
+/** @import { V1RequestOptions } from "./terrabase-v1.js" */
+/** @typedef {{ readonly id: string; readonly name: string; readonly sql: string; readonly createdAt: string; readonly updatedAt: string | null }} V1SavedQuery */
+/** @typedef {{ readonly name: string; readonly sql: string }} V1SavedQueryRequest */
+/** @typedef {{ readonly items: readonly V1SavedQuery[]; readonly next: string | null }} V1SavedQueryPage */
+
+/** @param {import("./json.js").JsonValue | undefined} value @returns {V1SavedQuery} */
+function savedQuery(value) {
+  const raw = object(value, "saved query");
+  return Object.freeze({ id: requireId(raw.id), name: string(raw.name, "saved query name"), sql: string(raw.sql, "saved SQL"),
+    createdAt: string(raw.createdAt, "saved query createdAt"), updatedAt: raw.updatedAt === null ? null : string(raw.updatedAt, "saved query updatedAt") });
+}
+/** @param {V1SavedQueryRequest} request */
+function body(request) {
+  members(request, ["name", "sql"]);
+  if (typeof request.name !== "string" || request.name.trim().length < 1 || request.name.trim().length > 128 ||
+      /[\p{Cc}]/u.test(request.name) || !/[\p{L}\p{N}]/u.test(request.name)) throw new TypeError("name must contain a letter or digit and be 1-128 characters without controls.");
+  if (typeof request.sql !== "string" || request.sql.trim() === "" || request.sql.length > 16_384)
+    throw new TypeError("sql must be a non-empty statement of at most 16384 UTF-16 code units.");
+  return stringifyExactJson({ name: request.name, sql: request.sql }, "saved query");
+}
+
+/** Saved queries belong to the authorized project, independently of database handles. */
+export class V1SavedQueries {
+  /** @type {V1Transport} */
+  #transport;
+  /** @param {V1Transport} transport */
+  constructor(transport) { this.#transport = transport; Object.freeze(this); }
+  /** @param {V1SavedQueryRequest} request @param {V1RequestOptions} [options] @returns {Promise<V1SavedQuery>} */
+  async create(request, options = {}) {
+    mutationOptions(options);
+    return savedQuery((await this.#transport.call("createSavedQuery", {}, { body: body(request), signal: options.signal })).value);
+  }
+  /** @param {import("./catalog.js").V1DatabaseListRequest} [request] @param {V1RequestOptions} [options] @returns {Promise<V1SavedQueryPage>} */
+  async list(request = {}, options = {}) {
+    const raw = object((await this.#transport.call("listSavedQueries", {}, { query: pageQuery(request), signal: options.signal })).value, "saved query page");
+    if (raw.next !== null && (typeof raw.next !== "string" || raw.next === "")) malformed("saved query next");
+    return Object.freeze({ items: Object.freeze(array(raw.items, "saved queries").map(savedQuery)), next: raw.next });
+  }
+  /** @param {string} id @param {V1RequestOptions} [options] @returns {Promise<V1SavedQuery>} */
+  async get(id, options = {}) {
+    return savedQuery((await this.#transport.call("getSavedQuery", { query: requireId(id) }, { signal: options.signal })).value);
+  }
+  /** @param {string} id @param {V1SavedQueryRequest} request @param {V1RequestOptions} [options] @returns {Promise<V1SavedQuery>} */
+  async update(id, request, options = {}) {
+    mutationOptions(options);
+    return savedQuery((await this.#transport.call("updateSavedQuery", { query: requireId(id) }, { body: body(request), signal: options.signal })).value);
+  }
+  /** @param {string} id @param {V1RequestOptions} [options] @returns {Promise<void>} */
+  async delete(id, options = {}) {
+    mutationOptions(options);
+    await this.#transport.call("deleteSavedQuery", { query: requireId(id) }, { signal: options.signal });
+  }
+}

package/src/v1/shape-crypto.js

@@ -0,0 +1,125 @@
+const MAGIC = "TBS1";
+const HEADER_BYTES = 70;
+const KEY_ID_BYTES = 26;
+const FRAME_BYTES = 1048576;
+const MAX_PLAINTEXT_BYTES = 8388608;
+const TAG_BYTES = 16;
+const LAST_FRAME_FLAG = 0x80000000;
+const LENGTH_MASK = 0x7fffffff;
+const MAX_UINT64 = 2n ** 64n - 1n;
+
+/**
+ * @typedef {object} ShapeObjectRequest
+ * @property {string} handle The shape handle this client requested, e.g. `h1-…`.
+ * @property {string} offset Canonical offset of the object's URL, e.g. `2` or `snap.0.0`.
+ * @property {string} epoch Decimal epoch the client expects in the header.
+ * @property {string} keyId The 26-character project data key id the client expects in the header.
+ * @property {Uint8Array} key Raw 32-byte epoch key `K_e`.
+ */
+
+/**
+ * Verifies and decrypts one TBS1 sealed shape object. The plaintext is returned only when the
+ * header, every frame tag and the framing rules pass. Any failure throws and yields no bytes.
+ *
+ * @param {Uint8Array} input Exact TBS1 object bytes.
+ * @param {ShapeObjectRequest} request
+ * @returns {Promise<Uint8Array>}
+ */
+export async function decryptShapeObject(input, { handle, offset, epoch, keyId, key: keyInput }) {
+  if (input.byteLength > HEADER_BYTES + 9 * (4 + TAG_BYTES) + MAX_PLAINTEXT_BYTES)
+    throw new TypeError("TBS1 object exceeds the maximum sealed size");
+  // WebCrypto needs ArrayBuffer-backed views; copying keeps the caller's (possibly shared) buffer out of it.
+  const bytes = Uint8Array.from(input);
+  const key = Uint8Array.from(keyInput);
+  if (key.byteLength !== 32) throw new TypeError("TBS1 epoch key must be 32 bytes");
+  if (typeof keyId !== "string" || !/^[\x00-\x7f]{26}$/u.test(keyId))
+    throw new TypeError("TBS1 key id must be 26 ASCII characters");
+  if (bytes.byteLength < HEADER_BYTES) throw new TypeError("TBS1 header is short");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (new TextDecoder().decode(bytes.subarray(0, 4)) !== MAGIC) throw new TypeError("TBS1 magic mismatch");
+  if (view.getBigUint64(4) !== parseEpoch(epoch)) throw new TypeError("TBS1 epoch mismatch");
+  if (new TextDecoder().decode(bytes.subarray(12, 12 + KEY_ID_BYTES)) !== keyId) throw new TypeError("TBS1 key id mismatch");
+
+  const header = bytes.subarray(0, HEADER_BYTES);
+  const { subtle } = globalThis.crypto;
+  const epochKey = await subtle.importKey("raw", key, "HKDF", false, ["deriveKey"]);
+  const objectKey = await subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: bytes.slice(38, HEADER_BYTES),
+      info: new TextEncoder().encode(`TBS1 object\u0000${handle}\u0000${offset}`),
+    },
+    epochKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["decrypt"],
+  );
+
+  const plaintextParts = [];
+  let plaintextTotal = 0;
+  let position = HEADER_BYTES;
+  for (let index = 0; ; index += 1) {
+    if (position + 4 > bytes.byteLength) throw new TypeError("TBS1 object ends before its last frame");
+    const lengthWord = view.getUint32(position);
+    const last = (lengthWord & LAST_FRAME_FLAG) !== 0;
+    const length = lengthWord & LENGTH_MASK;
+    if (last ? length >= FRAME_BYTES : length !== FRAME_BYTES) throw new TypeError("TBS1 frame length is invalid");
+    plaintextTotal += length;
+    if (plaintextTotal > MAX_PLAINTEXT_BYTES) throw new TypeError("TBS1 plaintext exceeds 8 MiB");
+    const bodyStart = position + 4;
+    const frameEnd = bodyStart + length + TAG_BYTES;
+    if (frameEnd > bytes.byteLength) throw new TypeError("TBS1 object is truncated");
+    const nonce = concat(new Uint8Array(4), uint64(index));
+    const additionalData = concat(header, uint64(index), bytes.subarray(position, bodyStart));
+    try {
+      const plaintext = await subtle.decrypt(
+        { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
+        objectKey,
+        bytes.subarray(bodyStart, frameEnd),
+      );
+      plaintextParts.push(new Uint8Array(plaintext));
+    } catch {
+      throw new TypeError("TBS1 frame failed authentication");
+    }
+    position = frameEnd;
+    if (last) break;
+  }
+  if (position !== bytes.byteLength) throw new TypeError("TBS1 object has bytes after its last frame");
+  return concat(...plaintextParts);
+}
+
+/**
+ * @param {string} value
+ * @returns {bigint}
+ */
+function parseEpoch(value) {
+  if (!/^(0|[1-9][0-9]*)$/u.test(value)) throw new TypeError("TBS1 epoch must be a canonical decimal");
+  const epoch = BigInt(value);
+  if (epoch > MAX_UINT64) throw new TypeError("TBS1 epoch exceeds uint64");
+  return epoch;
+}
+
+/**
+ * @param {number} value
+ * @returns {Uint8Array}
+ */
+function uint64(value) {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, BigInt(value));
+  return out;
+}
+
+/**
+ * @param {...Uint8Array} parts
+ * @returns {Uint8Array<ArrayBuffer>}
+ */
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.byteLength;
+  }
+  return out;
+}

package/src/v1/shape-manifest.js

@@ -0,0 +1,31 @@
+import { requireId } from "../ids.js";
+import { malformed } from "./decode.js";
+import { list, numeric, record, text } from "./management-decode.js";
+import { requireFilter } from "./filter.js";
+import { stringifyExactJson } from "./json.js";
+import { requireShapeHandle, requireShapeOffset } from "./shapes.js";
+/** @import { V1Transport } from "./transport.js" */
+const manifest = record({ handle: requireShapeHandle, objects: list(record({ offset: requireShapeOffset, next_offset: requireShapeOffset,
+  binding: text, object: text, url: text, expires_at: text, epoch: text, key_id: requireId, sha256: text, size: numeric })) });
+/** @typedef {ReturnType<typeof manifest>} V1ShapeManifest */
+/** @typedef {{readonly handle: string; readonly offset: string; readonly where?: import("./filter.js").V1Filter}} V1ShapeManifestRequest */
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @param {V1ShapeManifestRequest} request @param {AbortSignal | undefined} signal @returns {Promise<V1ShapeManifest>} */
+export async function readShapeManifest(transport, params, request, signal) {
+  const handle = requireShapeHandle(request.handle);
+  const offset = requireShapeOffset(request.offset);
+  if (offset === "-1") throw new TypeError("A manifest requires a snapshot or log offset.");
+  const query = new URLSearchParams({ handle, offset });
+  if (request.where !== undefined) query.set("where", stringifyExactJson(requireFilter(request.where), "shape filter"));
+  const response = await transport.call("getShapeManifest", params, { query, cache: "no-store", signal });
+  const result = manifest(response.value);
+  if (result.handle !== handle || result.objects.length > 8) malformed("shape manifest binding");
+  let next = offset;
+  for (const item of result.objects) {
+    if (item.offset !== next || item.next_offset === item.offset || item.offset === "-1" || item.next_offset === "-1" ||
+        !/^[a-f0-9]{64}$/u.test(item.sha256) || !/^(?:0|[1-9][0-9]*)$/u.test(item.epoch)) malformed("shape manifest object");
+    const url = new URL(item.url);
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") malformed("shape object URL");
+    next = item.next_offset;
+  }
+  return result;
+}