@ahoo-wang/wow-view-store 9.2.0-rc.0

package/dist/index.es.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.es.js","names":["WowViewStoreErrorCodes","REFERENCED_BY_SHARED_DASHBOARD","CODES","ErrorCodes","cause","wow","status","at","depth","message","found","UNFILLED","unfilled","ViewStoreError","code","failure","known","errorCode","toWowError","error","name","SHARED_OWNER_ID","SYSTEM_OWNER_ID","SYSTEM_TENANT_ID","SCOPE","PATHS","place","variables","view","SUMMARY_FIELDS","version","snapshot","aggregateId","state","body","preferences","order","defaultInstanceId","autoRun","lastTabs","a","b","tabs","x","y","LIST_LIMIT","REMEMBERED_WRITES","NOT_REPLAYED","REMEMBERED_SYSTEM_VIEWS","options","query","listQuery","filter","definitionId","LIST_ORDER","personal","shared","system","thrown","seen","summary","AUDIENCE_RANK","id","signal","input","context","requestId","made","write","result","revision","audience","answered","retry","answer","current","remembered","relocated","plan","expected","stored","replayed","read","places","index","response","strict","boards","titles","board","isSystemInstanceId","first","instance","NO_VIEW_STORE","singleQuery","method","url","request","path","ResultExtractors","CommandHeaders","CommandStage","asc","run","isViewStoreError","limit","key","value"],"sources":["../src/errors.ts","../src/paths.ts","../src/wire.ts","../src/wowViewStore.ts"],"sourcesContent":["/*\n * Copyright [2021-present] [ahoo wang <ahoowang@qq.com> (https://github.com/Ahoo-Wang)].\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *      http://www.apache.org/licenses/LICENSE-2.0\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  ErrorCodes,\n  toWowError,\n  type BindingError,\n  type WowError,\n} from '@ahoo-wang/wow-client';\nimport {\n  ViewStoreError,\n  type ViewStoreErrorCode,\n} from '@ahoo-wang/wow-view-engine';\n\n/**\n * The view store's own error codes, beside Wow's (`ErrorCodes` of\n * `@ahoo-wang/wow-client`).\n *\n * Named apart from the engine's `ViewStoreErrorCode` (the port's six codes): these\n * are the server's `errorCode` strings, which a `ViewStoreError` carries as\n * `detail.code`. Mirrors `ViewStoreErrorCodes` in\n * `view-store/wow-view-store-api/src/main/kotlin/me/ahoo/wow/viewstore/api/ViewStoreErrorCodes.kt`.\n */\nexport const WowViewStoreErrorCodes = Object.freeze({\n  /** A write that is not a valid view or preferences write (HTTP 400). */\n  VIEW_INVALID: 'ViewInvalid',\n  /** The request carries no `CoSec-App-Id` (HTTP 400). */\n  VIEW_APP_REQUIRED: 'ViewAppRequired',\n  /** A system view is read-only (HTTP 403). */\n  SYSTEM_VIEW_READ_ONLY: 'SystemViewReadOnly',\n  /** The path's tenant or owner is missing, blank or invisible (HTTP 400). */\n  VIEW_SCOPE_REQUIRED: 'ViewScopeRequired',\n  /** The view store's event streams are closed to HTTP queries (HTTP 403). */\n  VIEW_EVENT_STREAM_CLOSED: 'ViewEventStreamClosed',\n} as const);\n\n/**\n * The binding error code a claim refusal names each shared dashboard with\n * (`View.REFERENCED_BY_SHARED_DASHBOARD`): the board's id as `name`, its\n * title as `msg`.\n */\nexport const REFERENCED_BY_SHARED_DASHBOARD = 'referenced-by-shared-dashboard';\n\n/** The port's error code of each error code the server answers with. */\nconst CODES: Readonly<Record<string, ViewStoreErrorCode>> = {\n  [ErrorCodes.COMMAND_EXPECT_VERSION_CONFLICT]: 'CONFLICT',\n  [ErrorCodes.EVENT_VERSION_CONFLICT]: 'CONFLICT',\n  [ErrorCodes.SOURCING_VERSION_CONFLICT]: 'CONFLICT',\n  [ErrorCodes.NOT_FOUND]: 'NOT_FOUND',\n  [ErrorCodes.ILLEGAL_ACCESS_DELETED_AGGREGATE]: 'NOT_FOUND',\n  [ErrorCodes.ILLEGAL_ACCESS_OWNER_AGGREGATE]: 'FORBIDDEN',\n  [ErrorCodes.ILLEGAL_ACCESS_SPACE_AGGREGATE]: 'FORBIDDEN',\n  [ErrorCodes.ILLEGAL_ACCESS_QUERY_SCOPE]: 'FORBIDDEN',\n  [WowViewStoreErrorCodes.SYSTEM_VIEW_READ_ONLY]: 'FORBIDDEN',\n  [WowViewStoreErrorCodes.VIEW_EVENT_STREAM_CLOSED]: 'FORBIDDEN',\n  [WowViewStoreErrorCodes.VIEW_INVALID]: 'INVALID',\n  [WowViewStoreErrorCodes.VIEW_APP_REQUIRED]: 'INVALID',\n  [WowViewStoreErrorCodes.VIEW_SCOPE_REQUIRED]: 'INVALID',\n  [ErrorCodes.BAD_REQUEST]: 'INVALID',\n  [ErrorCodes.ILLEGAL_ARGUMENT]: 'INVALID',\n  // The server's own state, not the request: what a retry may get past.\n  [ErrorCodes.ILLEGAL_STATE]: 'UNAVAILABLE',\n  [ErrorCodes.COMMAND_VALIDATION]: 'INVALID',\n  [ErrorCodes.DUPLICATE_AGGREGATE_ID]: 'INVALID',\n  [ErrorCodes.QUERY_SCHEMA_VALIDATION]: 'INVALID',\n  [ErrorCodes.REQUEST_TIMEOUT]: 'UNAVAILABLE',\n  [ErrorCodes.TOO_MANY_REQUESTS]: 'UNAVAILABLE',\n  [ErrorCodes.INTERNAL_SERVER_ERROR]: 'UNAVAILABLE',\n  [ErrorCodes.QUERY_SCHEMA_UNAVAILABLE]: 'UNAVAILABLE',\n  [ErrorCodes.QUERY_SCHEMA_CONFLICT]: 'UNAVAILABLE',\n};\n\n/**\n * A request that did not succeed, as the store reads it: the server's error,\n * when the server answered with one, and the HTTP status, when a response\n * came back at all.\n */\nexport class Failure {\n  constructor(\n    /** What the request threw. */\n    readonly cause: unknown,\n    /** The server's error, read from the failed response. */\n    readonly wow?: WowError,\n    /** The status of the failed response; absent when none came back. */\n    readonly status?: number,\n  ) {}\n\n  /** The server's error code, if it answered with one. */\n  get errorCode(): string | undefined {\n    return this.wow?.errorCode;\n  }\n\n  get bindingErrors(): readonly BindingError[] {\n    return this.wow?.bindingErrors ?? [];\n  }\n\n  /**\n   * The path variable the fetcher's interceptors never filled, when that is\n   * why the request was never sent: the host's set-up is wrong, not the\n   * network.\n   */\n  get unfilled(): string | undefined {\n    if (this.wow || this.status !== undefined) return undefined;\n    for (let at: unknown = this.cause, depth = 0; at && depth < 4; depth++) {\n      const message = (at as { message?: unknown }).message;\n      const found = typeof message === 'string' ? UNFILLED.exec(message) : null;\n      if (found) return found[1];\n      at = (at as { cause?: unknown }).cause;\n    }\n    return undefined;\n  }\n\n  /**\n   * The port's code for it (see {@link portCodeOf}). A path variable the\n   * interceptors never filled is `INVALID`, as the server's own\n   * `ViewScopeRequired` is: the request is wrong as built and a retry sends\n   * the same — not `UNAVAILABLE`, which would offer one.\n   */\n  get code(): ViewStoreErrorCode {\n    if (this.unfilled !== undefined) return 'INVALID';\n    return portCodeOf(this.errorCode, this.status);\n  }\n\n  /**\n   * Whether the server (or something in front of it) answered at all: a\n   * response came back. An `UNAVAILABLE` that was answered is the server's\n   * own error — a 5xx, a timeout it reported — and not the network.\n   */\n  get reached(): boolean {\n    return this.wow !== undefined || this.status !== undefined;\n  }\n\n  get message(): string {\n    if (this.wow) return this.wow.message;\n    const unfilled = this.unfilled;\n    if (unfilled !== undefined)\n      return `The fetcher's interceptors did not fill the path variable {${unfilled}}`;\n    if (this.status !== undefined)\n      return `The view store answered HTTP ${this.status}`;\n    return `The view store could not be reached: ${reasonOf(this.cause)}`;\n  }\n\n  /**\n   * The port's error, holding what it was read from: the request's own\n   * failure as `cause`, the server's error code as `detail` (a host tells\n   * `ViewAppRequired` from `ViewInvalid` by it), and for `UNAVAILABLE`\n   * whether the server answered (`reachable`).\n   */\n  toStoreError(): ViewStoreError {\n    return new ViewStoreError(this.code, this.message, this.held());\n  }\n\n  /** {@link toStoreError} with another code: the same failure, read further. */\n  held(): {\n    cause: unknown;\n    detail?: { code: string };\n    reachable?: true;\n  } {\n    const code = this.errorCode;\n    return {\n      cause: this.cause,\n      ...(code === undefined ? {} : { detail: { code } }),\n      ...(this.code === 'UNAVAILABLE' && this.reached\n        ? { reachable: true as const }\n        : {}),\n    };\n  }\n}\n\n/** The fetcher's refusal of a route whose path variable has no value. */\nconst UNFILLED = /^Missing required path parameter: (\\S+)/;\n\n/** Whether the request id of a write was used before. */\nexport function isDuplicateRequest(failure: Failure): boolean {\n  return failure.errorCode === ErrorCodes.DUPLICATE_REQUEST_ID;\n}\n\n/**\n * The port's code for a server's answer, **by Wow's error code first**: the\n * code says what the server decided, where one HTTP status carries several\n * decisions (a `400` is a stale version on no server, but a bad title and a\n * missing application alike). Only an answer without a code the store knows\n * — a gateway's own page, a proxy, a code a later server adds — falls back to\n * the status, and no answer at all (a network failure, a timeout, an abort)\n * is `UNAVAILABLE`: the outcome is unknown, and a retry under the same\n * `requestId` is what the port expects.\n */\nexport function portCodeOf(\n  errorCode: string | undefined,\n  status: number | undefined,\n): ViewStoreErrorCode {\n  const known = errorCode === undefined ? undefined : CODES[errorCode];\n  if (known) return known;\n  switch (status) {\n    case 400:\n    case 422:\n      return 'INVALID';\n    case 401:\n    case 403:\n      return 'FORBIDDEN';\n    case 404:\n    case 410:\n      return 'NOT_FOUND';\n    case 409:\n    case 412:\n      return 'CONFLICT';\n    default:\n      return 'UNAVAILABLE';\n  }\n}\n\n/** What a failed request threw, read as a {@link Failure}. */\nexport async function failureOf(error: unknown): Promise<Failure> {\n  const wow = await toWowError(error);\n  const status = wow?.status ?? statusOf(error);\n  return new Failure(error, wow, status);\n}\n\n/** The status of a fetcher error's response, when it carries one. */\nfunction statusOf(error: unknown): number | undefined {\n  if (typeof error !== 'object' || error === null) return undefined;\n  const response = (error as { exchange?: { response?: Response } }).exchange\n    ?.response;\n  return response?.status;\n}\n\n/** What a refusal said; a `DOMException` is an `Error` only in some realms. */\nfunction reasonOf(error: unknown): string {\n  if (typeof error === 'object' && error !== null) {\n    const { name, message } = error as { name?: unknown; message?: unknown };\n    if (typeof message === 'string')\n      return typeof name === 'string' ? `${name}: ${message}` : message;\n  }\n  return String(error);\n}\n","/*\n * Copyright [2021-present] [ahoo wang <ahoowang@qq.com> (https://github.com/Ahoo-Wang)].\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *      http://www.apache.org/licenses/LICENSE-2.0\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The reserved owner of shared views and shared preferences\n * (`ViewStoreService.SHARED_OWNER_ID` on the server). The parentheses keep it\n * apart from every user id, so a path whose owner segment is `(shared)` is the\n * shared audience's.\n *\n * A host nobody signs in to fills `{ownerId}` with it by default (its own\n * request interceptor), and then has shared views and shared preferences\n * only.\n */\nexport const SHARED_OWNER_ID = '(shared)';\n\n/**\n * The reserved owner of stored system views\n * (`ViewStoreService.SYSTEM_OWNER_ID` on the server).\n */\nexport const SYSTEM_OWNER_ID = '(system)';\n\n/**\n * The one tenant stored system views live under\n * (`ViewStoreService.SYSTEM_TENANT_ID`): the value of CoSec's platform\n * tenant, not the default tenant `(0)`. System views are global, so the\n * store writes them on `tenant/(platform)/owner/(system)` whatever the\n * caller's own tenant, and the security gateway decides who may, by that\n * path.\n */\nexport const SYSTEM_TENANT_ID = '(platform)';\n\n/**\n * Where a view lives on the server: the owner segment of its path. `personal`\n * leaves `{ownerId}` to the fetcher's interceptors (fetcher-cosec's resource\n * attribution fills it from the token's `sub`); `shared` names\n * {@link SHARED_OWNER_ID}, which the interceptors never replace; `system`\n * names both the tenant and the owner of stored system views,\n * {@link SYSTEM_TENANT_ID} and {@link SYSTEM_OWNER_ID}.\n */\nexport type Place = 'personal' | 'shared' | 'system';\n\n/** Every route starts here; the tenant and owner are path variables. */\nconst SCOPE = '/view-store/tenant/{tenantId}/owner/{ownerId}';\n\n/** The view store's routes, relative to the fetcher's base URL. */\nexport const PATHS = {\n  /** `POST`: create (the server generates the id). */\n  views: `${SCOPE}/view`,\n  /** `DELETE`: Wow's delete of the aggregate. */\n  view: `${SCOPE}/view/{id}`,\n  save: `${SCOPE}/view/{id}/save`,\n  rename: `${SCOPE}/view/{id}/rename`,\n  /** Sent to the view's personal path; moves it to `(shared)`. */\n  share: `${SCOPE}/view/{id}/share`,\n  /** Sent to the caller's own path; moves a shared view to the caller. */\n  claim: `${SCOPE}/view/{id}/claim`,\n  single: `${SCOPE}/view/snapshot/single`,\n  list: `${SCOPE}/view/snapshot/list`,\n  /** The view as the write with this request id left it; `204` for a delete. */\n  replay: `${SCOPE}/view/requests/{requestId}`,\n  /**\n   * Served under `(shared)` only: the configured system views of the\n   * caller's tenant and the stored ones, global.\n   */\n  systemViews: `${SCOPE}/system-views`,\n  systemView: `${SCOPE}/system-views/{id}`,\n  preferences: `${SCOPE}/definitions/{definitionId}/preferences`,\n} as const;\n\n/**\n * The path variables of a request at `place`. The tenant is the\n * interceptors' but on the system path; the owner is theirs for a personal\n * path.\n */\nexport function pathAt(\n  place: Place,\n  variables: Record<string, string> = {},\n): Record<string, string> {\n  switch (place) {\n    case 'shared':\n      return { ...variables, ownerId: SHARED_OWNER_ID };\n    case 'system':\n      return {\n        ...variables,\n        tenantId: SYSTEM_TENANT_ID,\n        ownerId: SYSTEM_OWNER_ID,\n      };\n    default:\n      return { ...variables };\n  }\n}\n","/*\n * Copyright [2021-present] [ahoo wang <ahoowang@qq.com> (https://github.com/Ahoo-Wang)].\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *      http://www.apache.org/licenses/LICENSE-2.0\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*\n * The server's shapes, as far as the store reads them, and their reading as\n * the port's. The server stores the engine's `ViewConfig` whole and never\n * reads its meaning, so a config comes back exactly as it was saved.\n */\n\nimport type {\n  ViewAudience,\n  ViewConfig,\n  ViewInstance,\n  ViewInstanceSummary,\n  ViewKind,\n  ViewPreferences,\n} from '@ahoo-wang/wow-view-engine';\n\n/** The state of a `view` aggregate (`ViewState`); tenant and owner are Wow's. */\nexport interface ViewStateBody {\n  definitionId: string;\n  title: string;\n  /** Follows the owner: `(shared)` is `shared`, any user is `personal`. */\n  audience: ViewAudience;\n  config: ViewConfig;\n}\n\n/**\n * A view's snapshot as a snapshot query or the replay route answers it. A\n * list projects it down to the summary's fields, `state.config.kind` among\n * them.\n */\nexport interface ViewSnapshotBody {\n  aggregateId: string;\n  version: number;\n  state: ViewStateBody;\n}\n\n/** A system view the server serves (`SystemView`); `scope` is always `system`. */\nexport interface SystemViewBody {\n  id: string;\n  definitionId: string;\n  title: string;\n  kind: ViewKind;\n  /** A hash of its content, whatever its source. */\n  revision: string;\n  config: ViewConfig;\n  /**\n   * `configured` (read-only) or `stored` (a view of `tenant/(platform)/owner/(system)`,\n   * written through the view routes); absent from a server before it,\n   * which served configured views only.\n   */\n  source?: 'configured' | 'stored';\n  /** A stored view's aggregate version, which its writes expect. */\n  version?: number | null;\n}\n\n/**\n * Whether the server stores `view` (else it configures it). A stored one\n * carries the port's `stored: true` (D81), the views an `editSystem`\n * permission may write; configured and code system views carry none.\n */\nexport function isStored(view: SystemViewBody): boolean {\n  return view.source === 'stored' && typeof view.version === 'number';\n}\n\n/** One owner's preferences in one definition (`ViewPreferencesView`). */\nexport interface PreferencesBody {\n  definitionId: string;\n  order?: string[] | null;\n  defaultInstanceId?: string | null;\n  autoRun?: boolean | null;\n  lastTabs?: Record<string, string> | null;\n  /** `0` for preferences never written. */\n  version: number;\n}\n\n/** The part of a command's answer (`CommandResult`) the store reads. */\nexport interface CommandResultBody {\n  aggregateId: string;\n  aggregateVersion?: number | null;\n}\n\n/** The fields a list reads, and nothing of the config but its `kind`. */\nexport const SUMMARY_FIELDS = [\n  'aggregateId',\n  'version',\n  'state.definitionId',\n  'state.title',\n  'state.audience',\n  'state.config.kind',\n];\n\n/** A snapshot's revision: the aggregate's version, compared as a string. */\nexport function revisionOf(version: number): string {\n  return String(version);\n}\n\nexport function toInstance(snapshot: ViewSnapshotBody): ViewInstance {\n  const { aggregateId, version, state } = snapshot;\n  return {\n    id: aggregateId,\n    definitionId: state.definitionId,\n    title: state.title,\n    scope: state.audience,\n    revision: revisionOf(version),\n    config: state.config,\n  };\n}\n\nexport function toSummary(snapshot: ViewSnapshotBody): ViewInstanceSummary {\n  const { aggregateId, version, state } = snapshot;\n  return {\n    id: aggregateId,\n    definitionId: state.definitionId,\n    title: state.title,\n    scope: state.audience,\n    kind: state.config.kind,\n    revision: revisionOf(version),\n  };\n}\n\nexport function systemInstance(view: SystemViewBody): ViewInstance {\n  return {\n    id: view.id,\n    definitionId: view.definitionId,\n    title: view.title,\n    scope: 'system',\n    revision: view.revision,\n    config: view.config,\n    ...(isStored(view) ? { stored: true as const } : {}),\n  };\n}\n\nexport function systemSummary(view: SystemViewBody): ViewInstanceSummary {\n  return {\n    id: view.id,\n    definitionId: view.definitionId,\n    title: view.title,\n    scope: 'system',\n    kind: view.kind,\n    revision: view.revision,\n    ...(isStored(view) ? { stored: true as const } : {}),\n  };\n}\n\n/**\n * The port's preferences. A member the server holds as `null` is one never\n * set: `defaultInstanceId` reads as `null`, and `autoRun` and `lastTabs` are\n * left out, as the port's own `emptyPreferences()` leaves them.\n */\nexport function toPreferences(body: PreferencesBody): ViewPreferences {\n  return preferencesAt(\n    {\n      order: body.order ?? [],\n      defaultInstanceId: body.defaultInstanceId ?? null,\n      autoRun: body.autoRun ?? undefined,\n      lastTabs: body.lastTabs ?? undefined,\n    },\n    body.version,\n  );\n}\n\n/** What a preferences write sends: everything but the revision. */\nexport function preferencesInput(\n  preferences: Omit<ViewPreferences, 'revision'>,\n): Omit<ViewPreferences, 'revision'> {\n  const { order, defaultInstanceId, autoRun, lastTabs } = preferences;\n  return {\n    order: [...order],\n    defaultInstanceId: defaultInstanceId ?? null,\n    ...(autoRun === undefined ? {} : { autoRun }),\n    ...(lastTabs === undefined ? {} : { lastTabs: { ...lastTabs } }),\n  };\n}\n\n/** `preferences` as written at `version`, in the port's shape. */\nexport function preferencesAt(\n  preferences: Omit<ViewPreferences, 'revision'>,\n  version: number,\n): ViewPreferences {\n  return { ...preferencesInput(preferences), revision: revisionOf(version) };\n}\n\n/** Whether two preferences say the same, whatever their revisions. */\nexport function samePreferences(\n  a: Omit<ViewPreferences, 'revision'>,\n  b: Omit<ViewPreferences, 'revision'>,\n): boolean {\n  return canonical(a) === canonical(b);\n}\n\n/** One spelling of what preferences say, the tabs in key order. */\nfunction canonical(preferences: Omit<ViewPreferences, 'revision'>): string {\n  const { order, defaultInstanceId, autoRun, lastTabs } =\n    preferencesInput(preferences);\n  const tabs =\n    lastTabs &&\n    Object.entries(lastTabs).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0));\n  return JSON.stringify([\n    order,\n    defaultInstanceId,\n    autoRun ?? null,\n    tabs ?? null,\n  ]);\n}\n","/*\n * Copyright [2021-present] [ahoo wang <ahoowang@qq.com> (https://github.com/Ahoo-Wang)].\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *      http://www.apache.org/licenses/LICENSE-2.0\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ResultExtractors, type Fetcher } from '@ahoo-wang/fetcher';\nimport {\n  asc,\n  CommandHeaders,\n  CommandStage,\n  filter,\n  listQuery,\n  singleQuery,\n  type BindingError,\n} from '@ahoo-wang/wow-client';\nimport {\n  isSystemInstanceId,\n  isViewStoreError,\n  ViewStoreError,\n  type ViewAudience,\n  type ViewConfig,\n  type ViewInstance,\n  type ViewInstanceSummary,\n  type ViewPermissions,\n  type ViewPreferences,\n  type ViewStore,\n  type WriteContext,\n} from '@ahoo-wang/wow-view-engine';\nimport {\n  failureOf,\n  Failure,\n  isDuplicateRequest,\n  REFERENCED_BY_SHARED_DASHBOARD,\n} from './errors.js';\nimport { PATHS, pathAt, type Place } from './paths.js';\nimport {\n  isStored,\n  preferencesAt,\n  preferencesInput,\n  revisionOf,\n  samePreferences,\n  SUMMARY_FIELDS,\n  systemInstance,\n  systemSummary,\n  toInstance,\n  toPreferences,\n  toSummary,\n  type CommandResultBody,\n  type PreferencesBody,\n  type SystemViewBody,\n  type ViewSnapshotBody,\n} from './wire.js';\n\n/** How a {@link WowViewStore} reaches the view store. */\nexport interface WowViewStoreOptions {\n  /**\n   * The fetcher every request goes through, on the base URL that serves\n   * `/view-store/…` (the CoSec gateway in front of the view store server, or\n   * the service that embeds the starter).\n   *\n   * Its interceptors carry who is asking; the store never does. They must\n   * fill the path variables `{tenantId}` and, on a personal path,\n   * `{ownerId}` where the store leaves them out — fetcher-cosec's\n   * `ResourceAttributionRequestInterceptor` fills them from the token's\n   * `tenantId` and `sub` — and send `CoSec-App-Id` (fetcher-cosec's\n   * `CoSecRequestInterceptor`), and the space and the authorization with it.\n   * A host nobody signs in to adds an interceptor of its own that fills the\n   * same defaults (the owner `(shared)`, {@link SHARED_OWNER_ID}).\n   */\n  fetcher: Fetcher;\n  /**\n   * Which buttons are enabled for one definition's views. The server does\n   * not authorize, the CoSec gateway does; a host answers this by the roles\n   * it holds there — `changeAudience` by the role that may write\n   * `owner/(shared)`, which claiming a view needs. Left out, everything is\n   * allowed, as the port reads a store without `permissions`.\n   */\n  permissions?: (definitionId: string) => ViewPermissions;\n}\n\n/**\n * The largest list the server answers (its query budget); a definition with\n * more views of one audience lists the first this many.\n */\nconst LIST_LIMIT = 1000;\n\n/** How many preference writes the store remembers the outcome of. */\nconst REMEMBERED_WRITES = 256;\n\n/** What a stored system view's writes expect: its version at a revision. */\ninterface StoredAt {\n  /** The content hash the engine holds as the view's revision. */\n  revision: string;\n  version: number;\n}\n\n/** One instance write, as sent from the place the view is at. */\ninterface InstanceWrite {\n  method: 'POST' | 'PUT' | 'DELETE';\n  url: string;\n  /** The path it is sent to, and so replayed on. */\n  sentTo: Place;\n  body?: unknown;\n  /** Where the view is once it lands; `null` for a delete. */\n  landsAt: Place | null;\n}\n\n/** The replay route found nothing this write can be answered with. */\nconst NOT_REPLAYED = Symbol('not replayed');\n\n/**\n * The view engine's `ViewStore` over the Wow view store (`view-store/` in the\n * Wow repository): saved views and preferences as two Wow aggregates, served\n * under `/view-store/tenant/{tenantId}/owner/{ownerId}/…`.\n *\n * **The owner segment is the audience.** A personal view lives on the\n * caller's own path (`{ownerId}` filled by the fetcher's interceptors), a\n * shared one on `owner/(shared)`; the CoSec gateway decides who may use\n * which. The port names a view by id alone, so the store remembers where it\n * last saw each one (a list, a read, a write) and looks an unknown id up on\n * the personal path, the shared path and the server's system views, in that\n * order. Setting a view shared or personal moves it between the two paths,\n * id kept.\n *\n * **Writes** carry the port's `requestId` as `Command-Request-Id`, its\n * `revision` as `Command-Aggregate-Version`, and wait for the snapshot; the\n * answer is the view read back at the version the write left. A write the\n * server refuses as a stale version or a repeated request id is first looked\n * up by its request id (the replay route): a retry answers what the first\n * attempt wrote. Otherwise a stale version is `CONFLICT` carrying the view as\n * it is now, and a view that turns out to be gone is `NOT_FOUND`.\n *\n * **Errors** are read by Wow's error code onto the port's five codes, by the\n * HTTP status only for an answer without a code the store knows; a request\n * that got no answer is `UNAVAILABLE`, and a retry under the same\n * `requestId` is safe.\n *\n * **Creating is not idempotent on the server**, which generates the id. A\n * store remembers the request ids of its own creates (bounded), and a retry\n * of one first asks the replay route whether it landed; a retry sent by\n * another store — another tab, a reload — makes a second view.\n */\nexport class WowViewStore implements ViewStore {\n  private readonly fetcher: Fetcher;\n  /**\n   * Where each view was last seen, by id. Kept after a delete, for its retry.\n   * A `system` view is read through the server's system views (configured\n   * and stored) and written, when stored, on the system path.\n   */\n  private readonly places = new Map<string, Place>();\n  /**\n   * The preferences have no replay route, so the store keeps what each of\n   * its own writes answered, and which ones it sent: a retry answers the\n   * first outcome, and a retry whose first answer was lost is recognised.\n   */\n  private readonly preferenceOutcomes = new Remembered<ViewPreferences>();\n  private readonly preferenceAttempts = new Remembered<true>();\n  /** The request ids of the creates this store sent, for their retries. */\n  private readonly createAttempts = new Remembered<true>();\n  /**\n   * The system views as last read, by id: a stored one's version at its\n   * revision (a hash of its content, while a write expects the version), or\n   * `null` for a configured one, which is read-only.\n   */\n  private readonly storedVersions = new Remembered<StoredAt | null>(\n    REMEMBERED_SYSTEM_VIEWS,\n  );\n  /** The host's {@link WowViewStoreOptions.permissions}, when it gave any. */\n  readonly permissions?: (definitionId: string) => ViewPermissions;\n\n  constructor(options: WowViewStoreOptions) {\n    this.fetcher = options.fetcher;\n    // Left undefined when the host declared none, which the port reads as\n    // \"everything is allowed\".\n    if (options.permissions) this.permissions = options.permissions;\n  }\n\n  /**\n   * The caller's personal views, the shared views and the server's system\n   * views of the definition: three requests, sent together, answered in the\n   * port's order — system, shared, personal, each oldest first (the server\n   * sorts each audience by the time its first event was written).\n   *\n   * A server with no view store at all (one released before it) answers\n   * every route `404`, where a list on one that has it never does: that is\n   * `UNSUPPORTED`, not a missing view.\n   */\n  list(\n    definitionId: string,\n    signal?: AbortSignal,\n  ): Promise<ViewInstanceSummary[]> {\n    return guard(async () => {\n      const query = listQuery({\n        filter: filter.eq('state.definitionId', definitionId),\n        projection: { include: SUMMARY_FIELDS },\n        sort: LIST_ORDER,\n        limit: LIST_LIMIT,\n      });\n      const [personal, shared, system] = await Promise.all([\n        this.json<ViewSnapshotBody[]>('POST', PATHS.list, 'personal', {\n          body: query,\n          signal,\n        }),\n        this.json<ViewSnapshotBody[]>('POST', PATHS.list, 'shared', {\n          body: query,\n          signal,\n        }),\n        this.json<SystemViewBody[]>('GET', PATHS.systemViews, 'shared', {\n          query: { definitionId },\n          signal,\n        }),\n      ]).catch((thrown: unknown) => {\n        throw thrown instanceof Failure && thrown.code === 'NOT_FOUND'\n          ? unsupported(thrown)\n          : thrown;\n      });\n      for (const view of system) this.rememberSystem(view);\n      const seen = new Map<string, ViewInstanceSummary>();\n      for (const summary of [\n        ...personal.map(toSummary),\n        ...shared.map(toSummary),\n        ...system.map(systemSummary),\n      ]) {\n        if (seen.has(summary.id)) continue;\n        seen.set(summary.id, summary);\n        this.places.set(summary.id, summary.scope);\n      }\n      // Sorted stably: within an audience, the server's order stands.\n      return [...seen.values()].sort(\n        (a, b) => AUDIENCE_RANK[a.scope] - AUDIENCE_RANK[b.scope],\n      );\n    });\n  }\n\n  /** View `id` wherever it is: the caller's, shared, or the server's system view. */\n  get(id: string, signal?: AbortSignal): Promise<ViewInstance> {\n    return guard(async () => (await this.find(id, signal)).instance);\n  }\n\n  /**\n   * Posts the view to the path of its `scope`; the server generates the id.\n   * A retry of a create this store sent asks the replay route on that path\n   * first, and answers the view the first attempt made when it landed; the\n   * server itself does not deduplicate, so a retry from another store makes\n   * a second view.\n   */\n  create(\n    input: Omit<ViewInstance, 'id' | 'revision'>,\n    context: WriteContext,\n  ): Promise<ViewInstance> {\n    return guard(async () => {\n      // A system view is created on the system path, global (the gateway\n      // decides who may); configured and code system views stay read-only.\n      const place: Place = input.scope;\n      const { requestId } = context;\n      if (this.createAttempts.has(requestId)) {\n        const made = await this.probe(place, context, true);\n        const snapshot =\n          made?.status === 200\n            ? ((await made.json()) as ViewSnapshotBody | null)\n            : null;\n        if (snapshot?.aggregateId) {\n          this.places.set(snapshot.aggregateId, place);\n          // A system view's revision is its content hash, which the\n          // snapshot does not carry: it is read from the system views.\n          return place === 'system'\n            ? this.readAt('system', snapshot.aggregateId, context.signal)\n            : toInstance(snapshot);\n        }\n      }\n      this.createAttempts.set(requestId, true);\n      const { definitionId, title, config } = input;\n      const write: InstanceWrite = {\n        method: 'POST',\n        url: PATHS.views,\n        sentTo: place,\n        body: { definitionId, title, config },\n        landsAt: place,\n      };\n      const result = await this.json<CommandResultBody>(\n        write.method,\n        write.url,\n        place,\n        {\n          body: write.body,\n          headers: writeHeaders(context),\n          signal: context.signal,\n        },\n      ).catch(async (thrown: unknown) => {\n        throw await this.unsupportedOr(thrown, context.signal);\n      });\n      const landed = await this.landed(\n        result.aggregateId,\n        write,\n        result,\n        context,\n      );\n      return landed!;\n    });\n  }\n\n  /** Replaces the view's config, at the expected `revision`. */\n  save(\n    id: string,\n    config: ViewConfig,\n    revision: string,\n    context: WriteContext,\n  ): Promise<ViewInstance> {\n    return this.write(id, revision, context, place => ({\n      method: 'PUT',\n      url: PATHS.save,\n      sentTo: place,\n      body: { config },\n      landsAt: place,\n    })) as Promise<ViewInstance>;\n  }\n\n  /** Renames the view (the server trims the title), at the expected `revision`. */\n  rename(\n    id: string,\n    title: string,\n    revision: string,\n    context: WriteContext,\n  ): Promise<ViewInstance> {\n    return this.write(id, revision, context, place => ({\n      method: 'PUT',\n      url: PATHS.rename,\n      sentTo: place,\n      body: { title },\n      landsAt: place,\n    })) as Promise<ViewInstance>;\n  }\n\n  /**\n   * 设为共享 sends `share` to the path the view is at; 设为个人 sends `claim`\n   * to the caller's own path, which the gateway admits only with the role\n   * that may write `owner/(shared)`. Either answers a view that already has\n   * the audience as it is, revision unmoved.\n   *\n   * A shared view a shared dashboard shows stays shared: the server refuses\n   * the claim and names the boards, and the refusal carries them by\n   * **title** in `boards`, as they are stored — a title written as a key\n   * stays one, and is said where the engine shows the refusal.\n   */\n  changeAudience(\n    id: string,\n    audience: ViewAudience,\n    revision: string,\n    context: WriteContext,\n  ): Promise<ViewInstance> {\n    return this.write(id, revision, context, place =>\n      place === 'system'\n        ? readOnly('A system view never moves audience')\n        : audience === 'shared'\n          ? {\n              method: 'PUT',\n              url: PATHS.share,\n              sentTo: place,\n              body: {},\n              landsAt: 'shared',\n            }\n          : {\n              method: 'PUT',\n              url: PATHS.claim,\n              sentTo: 'personal',\n              landsAt: 'personal',\n            },\n    ) as Promise<ViewInstance>;\n  }\n\n  /** Deletes the view, at the expected `revision`; a board showing it keeps a broken panel. */\n  async delete(\n    id: string,\n    revision: string,\n    context: WriteContext,\n  ): Promise<void> {\n    await this.write(id, revision, context, place => ({\n      method: 'DELETE',\n      url: PATHS.view,\n      sentTo: place,\n      body: {},\n      landsAt: null,\n    }));\n  }\n\n  /** The caller's own, or `(shared)`'s where the host fills that owner. */\n  getPreferences(\n    definitionId: string,\n    signal?: AbortSignal,\n  ): Promise<ViewPreferences> {\n    return guard(async () =>\n      toPreferences(\n        await this.json<PreferencesBody>('GET', PATHS.preferences, 'personal', {\n          path: { definitionId },\n          signal,\n        }).catch(async (thrown: unknown) => {\n          throw await this.unsupportedOr(thrown, signal);\n        }),\n      ),\n    );\n  }\n\n  /**\n   * Writes the preferences at the expected `revision` (`'0'` for ones never\n   * written). The server has no replay route for them, so a retry answers\n   * what this store's first attempt answered, or — its answer lost — what is\n   * stored when that is what it wrote.\n   */\n  setPreferences(\n    definitionId: string,\n    preferences: ViewPreferences,\n    context: WriteContext,\n  ): Promise<ViewPreferences> {\n    return guard(async () => {\n      const { requestId, signal } = context;\n      const answered = this.preferenceOutcomes.get(requestId);\n      if (answered) return structuredClone(answered);\n      const retry = this.preferenceAttempts.has(requestId);\n      this.preferenceAttempts.set(requestId, true);\n      let answer: ViewPreferences;\n      try {\n        const result = await this.json<CommandResultBody>(\n          'PUT',\n          PATHS.preferences,\n          'personal',\n          {\n            path: { definitionId },\n            body: preferencesInput(preferences),\n            headers: writeHeaders(context, preferences.revision),\n            signal,\n          },\n        );\n        answer =\n          typeof result.aggregateVersion === 'number'\n            ? preferencesAt(preferences, result.aggregateVersion)\n            : await this.getPreferences(definitionId, signal);\n      } catch (thrown) {\n        if (\n          !(thrown instanceof Failure) ||\n          (thrown.code !== 'CONFLICT' && !isDuplicateRequest(thrown))\n        )\n          throw await this.unsupportedOr(thrown, signal);\n        const current = await this.getPreferences(definitionId, signal);\n        // A retry the server refuses because its first attempt landed: what\n        // is stored says what it wrote, unless another writer moved it on.\n        if (\n          (retry || isDuplicateRequest(thrown)) &&\n          samePreferences(current, preferences)\n        )\n          answer = current;\n        else\n          throw new ViewStoreError('CONFLICT', thrown.message, {\n            ...thrown.held(),\n            preferences: current,\n          });\n      }\n      this.preferenceOutcomes.set(requestId, answer);\n      return structuredClone(answer);\n    });\n  }\n\n  /**\n   * One instance write: to the place the view is at, then the answer read\n   * back. A view remembered at a place it has since left (another tab shared\n   * it) is looked up again and the write sent once more to where it is.\n   */\n  private write(\n    id: string,\n    revision: string,\n    context: WriteContext,\n    plan: (place: Place) => InstanceWrite,\n  ): Promise<ViewInstance | undefined> {\n    return guard(async () => {\n      const { signal } = context;\n      const remembered = this.places.get(id);\n      let place = remembered ?? (await this.find(id, signal)).place;\n      let relocated = remembered === undefined;\n      for (;;) {\n        const write = plan(place);\n        let expected = revision;\n        if (place === 'system') {\n          const stored = await this.storedVersion(id, revision, write, context);\n          if ('answer' in stored) return stored.answer;\n          expected = stored.version;\n        }\n        let result: CommandResultBody;\n        try {\n          result = await this.json<CommandResultBody>(\n            write.method,\n            write.url,\n            write.sentTo,\n            {\n              path: { id },\n              body: write.body,\n              headers: writeHeaders(context, expected),\n              signal,\n            },\n          );\n        } catch (thrown) {\n          if (!(thrown instanceof Failure)) throw thrown;\n          const replayed = await this.replayed(id, write, context, thrown);\n          if (replayed !== NOT_REPLAYED) return replayed;\n          if (\n            !relocated &&\n            (thrown.code === 'NOT_FOUND' || thrown.code === 'FORBIDDEN')\n          ) {\n            relocated = true;\n            const found = (await this.find(id, signal, null)).place;\n            // Only where the write would go elsewhere: a claim goes to the\n            // caller's own path wherever the view is.\n            if (found !== place && plan(found).sentTo !== write.sentTo) {\n              place = found;\n              continue;\n            }\n          }\n          if (thrown.code === 'CONFLICT' || isDuplicateRequest(thrown))\n            throw await this.conflict(id, thrown, signal);\n          throw await this.refusal(thrown, signal);\n        }\n        // Landed: what goes wrong reading it back is never a reason to send\n        // it again.\n        return this.landed(id, write, result, context);\n      }\n    });\n  }\n\n  /** A landed write's answer: the view read back at the version it left. */\n  private async landed(\n    id: string,\n    write: InstanceWrite,\n    result: CommandResultBody,\n    context: WriteContext,\n  ): Promise<ViewInstance | undefined> {\n    if (write.landsAt === null) return undefined;\n    this.places.set(id, write.landsAt);\n    const version = result.aggregateVersion;\n    let read: ViewInstance | undefined;\n    let failure: unknown;\n    try {\n      read = await this.readAt(write.landsAt, id, context.signal);\n      if (typeof version !== 'number' || read.revision === revisionOf(version))\n        return read;\n      // A system view's revision is its content hash: the version it was\n      // read at says whether it is this write's.\n      if (write.landsAt === 'system') {\n        if (this.storedVersions.get(id)?.version === version) return read;\n      }\n    } catch (thrown) {\n      failure = thrown;\n    }\n    // Another writer moved it on between the write and the read: the replay\n    // route answers it as this write left it. The write landed, so a probe\n    // that fails is no reason to report it otherwise: what was read stands.\n    const replayed = await this.replay(id, write, context, false);\n    if (replayed !== NOT_REPLAYED && replayed !== undefined) return replayed;\n    if (read) return read;\n    throw failure;\n  }\n\n  /**\n   * The answer of a write the server refused as a stale version, a repeated\n   * request id or a missing view, when the refusal is that of a retry: the\n   * replay route finds the first attempt by its request id.\n   */\n  private async replayed(\n    id: string,\n    write: InstanceWrite,\n    context: WriteContext,\n    failure: Failure,\n  ): Promise<ViewInstance | undefined | typeof NOT_REPLAYED> {\n    const retryable =\n      failure.code === 'CONFLICT' ||\n      failure.code === 'NOT_FOUND' ||\n      isDuplicateRequest(failure);\n    return retryable ? this.replay(id, write, context, true) : NOT_REPLAYED;\n  }\n\n  /**\n   * What the write with the context's request id left of view `id`, from the\n   * replay route: the view at that version, or `undefined` for a delete.\n   *\n   * The route finds a write only on the path of the owner who wrote it, and\n   * a retry may be sent elsewhere than its first attempt — a share goes to\n   * the personal path the view has left by the time it is retried — so the\n   * path this attempt went to is asked first and the other one next.\n   *\n   * A probe that fails other than as \"not found\" is no answer on its path.\n   * With `strict` — a refused write, whose own path is asked first — that\n   * path's failure is passed on: whether the first attempt landed is\n   * unknown, and a retry under the same request id is safe. The other path\n   * (a caller without the shared role is refused there), and every probe of\n   * a write that landed, count it as not replayed, and the caller keeps what\n   * it knows: the refusal, or the view it read back.\n   */\n  private async replay(\n    id: string,\n    write: InstanceWrite,\n    context: WriteContext,\n    strict: boolean,\n  ): Promise<ViewInstance | undefined | typeof NOT_REPLAYED> {\n    const places: Place[] =\n      write.sentTo === 'system'\n        ? ['system']\n        : write.sentTo === 'personal'\n          ? ['personal', 'shared']\n          : ['shared', 'personal'];\n    for (const [index, place] of places.entries()) {\n      const response = await this.probe(place, context, strict && index === 0);\n      if (!response) continue;\n      if (response.status === 204)\n        return write.landsAt === null ? undefined : NOT_REPLAYED;\n      const snapshot = (await response.json()) as ViewSnapshotBody;\n      if (write.landsAt === null || snapshot?.aggregateId !== id)\n        return NOT_REPLAYED;\n      // The replay route answers a snapshot, whose revision would be its\n      // version; a system view's is its content hash, which only the server\n      // computes: the view is answered as it is now.\n      if (write.landsAt === 'system')\n        return this.readAt('system', id, context.signal);\n      return toInstance(snapshot);\n    }\n    return NOT_REPLAYED;\n  }\n\n  /**\n   * The replay route at `place` for the context's request id; `undefined`\n   * when it knows none, or — not `strict` — when it could not be asked.\n   */\n  private async probe(\n    place: Place,\n    context: WriteContext,\n    strict: boolean,\n  ): Promise<Response | undefined> {\n    try {\n      return await this.send('GET', PATHS.replay, place, {\n        path: { requestId: context.requestId },\n        signal: context.signal,\n      });\n    } catch (thrown) {\n      if (thrown instanceof Failure && (thrown.code === 'NOT_FOUND' || !strict))\n        return undefined;\n      throw thrown;\n    }\n  }\n\n  /** A stale write's refusal, carrying the view as it is now. */\n  private async conflict(\n    id: string,\n    failure: Failure,\n    signal: AbortSignal | undefined,\n  ): Promise<ViewStoreError> {\n    const { instance } = await this.find(id, signal, null);\n    return new ViewStoreError('CONFLICT', failure.message, {\n      ...failure.held(),\n      instance,\n    });\n  }\n\n  /**\n   * The port's refusal of a write. A claim the server refuses because shared\n   * dashboards show the view carries those boards' titles (`boards`), which\n   * the server gives beside each board's id (a board it gives no title for\n   * is read for one); the engine says the refusal around them.\n   */\n  private async refusal(\n    failure: Failure,\n    signal: AbortSignal | undefined,\n  ): Promise<ViewStoreError> {\n    const boards = failure.bindingErrors.filter(\n      error => error.code === REFERENCED_BY_SHARED_DASHBOARD,\n    );\n    if (failure.code !== 'INVALID' || boards.length === 0)\n      return failure.toStoreError();\n    const titles = await Promise.all(\n      boards.map(board => this.boardTitle(board, signal)),\n    );\n    return new ViewStoreError('INVALID', failure.message, {\n      ...failure.held(),\n      boards: titles,\n    });\n  }\n\n  private async boardTitle(\n    board: BindingError,\n    signal: AbortSignal | undefined,\n  ): Promise<string> {\n    if (typeof board.msg === 'string' && board.msg.trim() !== '')\n      return board.msg;\n    try {\n      return (await this.readAt('shared', board.name, signal)).title;\n    } catch {\n      return board.name;\n    }\n  }\n\n  /**\n   * View `id` and where it is: first where it was last seen (`first`, `null`\n   * to ignore that), then the personal path, the shared path and the\n   * server's system views.\n   */\n  private async find(\n    id: string,\n    signal: AbortSignal | undefined,\n    first: Place | null | undefined = this.places.get(id),\n  ): Promise<{ place: Place; instance: ViewInstance }> {\n    // Ids in `system:` are the views a host declares in code; the server\n    // never issues or serves one.\n    if (!isSystemInstanceId(id)) {\n      const order: Place[] = ['personal', 'shared', 'system'];\n      if (first)\n        order.sort((a, b) => Number(b === first) - Number(a === first));\n      for (const place of order) {\n        try {\n          const instance = await this.readAt(place, id, signal);\n          this.places.set(id, place);\n          return { place, instance };\n        } catch (thrown) {\n          if (thrown instanceof Failure && thrown.code === 'NOT_FOUND')\n            continue;\n          throw thrown;\n        }\n      }\n      // Every place answered `404`: a view that is not there, or no view\n      // store there at all (a server released before it) — the one\n      // question the server's system views tell apart.\n      if (!(await this.served(signal)))\n        throw new ViewStoreError('UNSUPPORTED', NO_VIEW_STORE);\n    }\n    throw new ViewStoreError('NOT_FOUND', `No such view: ${id}`);\n  }\n\n  /**\n   * Whether the server has a view store at all: its system views answer\n   * on one that has (an empty list included), and `404` on one released\n   * before it. Any other failure is no answer to that, and reads as served.\n   */\n  private async served(signal: AbortSignal | undefined): Promise<boolean> {\n    try {\n      await this.send('GET', PATHS.systemViews, 'shared', { signal });\n      return true;\n    } catch (thrown) {\n      return !(thrown instanceof Failure && thrown.code === 'NOT_FOUND');\n    }\n  }\n\n  /** A `404` from a server with no view store is `UNSUPPORTED`; else as it was. */\n  private async unsupportedOr(\n    thrown: unknown,\n    signal: AbortSignal | undefined,\n  ): Promise<unknown> {\n    return thrown instanceof Failure &&\n      thrown.code === 'NOT_FOUND' &&\n      !(await this.served(signal))\n      ? unsupported(thrown)\n      : thrown;\n  }\n\n  /** Keeps what a stored system view's writes expect; forgets a configured one. */\n  private rememberSystem(view: SystemViewBody): SystemViewBody {\n    this.storedVersions.set(\n      view.id,\n      isStored(view)\n        ? { revision: view.revision, version: view.version! }\n        : null,\n    );\n    return view;\n  }\n\n  /**\n   * The version a write of stored system view `id` at `revision` (its\n   * content hash) expects: as last read, else read now. A configured system\n   * view is read-only (`FORBIDDEN`; a code one is never found here). A\n   * revision other than the view's is stale — unless this write is a retry\n   * whose first attempt moved it on, which the replay route answers — and is\n   * then `CONFLICT`, carrying the view as it is.\n   */\n  private async storedVersion(\n    id: string,\n    revision: string,\n    write: InstanceWrite,\n    context: WriteContext,\n  ): Promise<{ version: string } | { answer: ViewInstance | undefined }> {\n    let known = this.storedVersions.get(id);\n    if (known === null) readOnly('Configured system views are read-only');\n    if (known?.revision !== revision) {\n      const instance = await this.readAt('system', id, context.signal);\n      known = this.storedVersions.get(id);\n      if (known && known.revision !== revision) {\n        const replayed = await this.replay(id, write, context, false);\n        if (replayed !== NOT_REPLAYED) return { answer: replayed };\n        throw new ViewStoreError(\n          'CONFLICT',\n          `System view ${id} has moved on from revision ${revision}`,\n          { instance },\n        );\n      }\n    }\n    if (!known) readOnly('Configured system views are read-only');\n    return { version: String(known.version) };\n  }\n\n  private async readAt(\n    place: Place,\n    id: string,\n    signal: AbortSignal | undefined,\n  ): Promise<ViewInstance> {\n    if (place === 'system')\n      return systemInstance(\n        this.rememberSystem(\n          await this.json<SystemViewBody>('GET', PATHS.systemView, 'shared', {\n            path: { id },\n            signal,\n          }),\n        ),\n      );\n    return toInstance(\n      await this.json<ViewSnapshotBody>('POST', PATHS.single, place, {\n        body: singleQuery({ filter: filter.id(id) }),\n        signal,\n      }),\n    );\n  }\n\n  private async json<R>(\n    method: string,\n    url: string,\n    place: Place,\n    request: Request,\n  ): Promise<R> {\n    const response = await this.send(method, url, place, request);\n    return (await response.json()) as R;\n  }\n\n  /**\n   * The one place a request leaves the store, and so the one place what it\n   * threw becomes a {@link Failure}.\n   */\n  private async send(\n    method: string,\n    url: string,\n    place: Place,\n    { path, query, body, headers, signal }: Request,\n  ): Promise<Response> {\n    try {\n      return await this.fetcher.request<Response>(\n        {\n          url,\n          method,\n          urlParams: { path: pathAt(place, path), query },\n          body: body as Record<string, unknown> | undefined,\n          headers,\n          signal,\n        },\n        { resultExtractor: ResultExtractors.Response },\n      );\n    } catch (error) {\n      throw await failureOf(error);\n    }\n  }\n}\n\n/** One request's parts beside its method, route and place. */\ninterface Request {\n  path?: Record<string, string>;\n  query?: Record<string, string>;\n  body?: unknown;\n  headers?: Record<string, string>;\n  signal?: AbortSignal;\n}\n\n/** The headers of a write: its request id, its expected version, the wait. */\nfunction writeHeaders(\n  context: WriteContext,\n  revision?: string,\n): Record<string, string> {\n  return {\n    [CommandHeaders.REQUEST_ID]: context.requestId,\n    [CommandHeaders.WAIT_STAGE]: CommandStage.SNAPSHOT,\n    ...(revision === undefined\n      ? {}\n      : { [CommandHeaders.AGGREGATE_VERSION]: revision }),\n  };\n}\n\n/** What a server without a view store is told as. */\nconst NO_VIEW_STORE = 'This server has no view store';\n\nfunction unsupported(failure: Failure): ViewStoreError {\n  return new ViewStoreError('UNSUPPORTED', NO_VIEW_STORE, failure.held());\n}\n\n/**\n * The port's list order, asked of the server per audience: oldest first, by\n * the time a view's first event was written, its id breaking a tie.\n */\nconst LIST_ORDER = [asc('firstEventTime'), asc('aggregateId')];\n\n/** System views first, then shared, then personal: the port's list order. */\nconst AUDIENCE_RANK: Readonly<Record<ViewInstanceSummary['scope'], number>> = {\n  system: 0,\n  shared: 1,\n  personal: 2,\n};\n\n/** Refuses a write to a system view the server or the code declares. */\nfunction readOnly(message: string): never {\n  throw new ViewStoreError('FORBIDDEN', message);\n}\n\n/**\n * Runs one of the port's methods, so that everything it rejects with is a\n * `ViewStoreError`: a failed request as its code says, anything else — a\n * body that did not parse — as `UNAVAILABLE`, the outcome unknown.\n */\nasync function guard<T>(run: () => Promise<T>): Promise<T> {\n  try {\n    return await run();\n  } catch (thrown) {\n    if (thrown instanceof Failure) throw thrown.toStoreError();\n    if (isViewStoreError(thrown)) throw thrown;\n    // A body that did not parse came back from something — a login wall's\n    // page, a proxy's: answered, so not \"could not be reached\".\n    throw new ViewStoreError(\n      'UNAVAILABLE',\n      thrown instanceof Error ? thrown.message : String(thrown),\n      {\n        cause: thrown,\n        ...(thrown instanceof SyntaxError ? { reachable: true as const } : {}),\n      },\n    );\n  }\n}\n\n/**\n * How many system views the store remembers the version of; one it forgot\n * is read again before its write.\n */\nconst REMEMBERED_SYSTEM_VIEWS = 1024;\n\n/** A bounded memory by key: the oldest entry goes first. */\nclass Remembered<T> {\n  private readonly entries = new Map<string, T>();\n\n  constructor(private readonly limit = REMEMBERED_WRITES) {}\n\n  get(key: string): T | undefined {\n    return this.entries.get(key);\n  }\n\n  has(key: string): boolean {\n    return this.entries.has(key);\n  }\n\n  set(key: string, value: T): void {\n    this.entries.delete(key);\n    this.entries.set(key, value);\n    if (this.entries.size > this.limit)\n      this.entries.delete(this.entries.keys().next().value!);\n  }\n}\n"],"mappings":";;;;IAiCaA,IAAyB,OAAO,OAAO;CAElD,cAAc;CAEd,mBAAmB;CAEnB,uBAAuB;CAEvB,qBAAqB;CAErB,0BAA0B;AAC5B,CAAU,GAOGC,IAAiC,kCAGxCC,IAAsD;EACzDC,EAAW,kCAAkC;EAC7CA,EAAW,yBAAyB;EACpCA,EAAW,4BAA4B;EACvCA,EAAW,YAAY;EACvBA,EAAW,mCAAmC;EAC9CA,EAAW,iCAAiC;EAC5CA,EAAW,iCAAiC;EAC5CA,EAAW,6BAA6B;EACxCH,EAAuB,wBAAwB;EAC/CA,EAAuB,2BAA2B;EAClDA,EAAuB,eAAe;EACtCA,EAAuB,oBAAoB;EAC3CA,EAAuB,sBAAsB;EAC7CG,EAAW,cAAc;EACzBA,EAAW,mBAAmB;EAE9BA,EAAW,gBAAgB;EAC3BA,EAAW,qBAAqB;EAChCA,EAAW,yBAAyB;EACpCA,EAAW,0BAA0B;EACrCA,EAAW,kBAAkB;EAC7BA,EAAW,oBAAoB;EAC/BA,EAAW,wBAAwB;EACnCA,EAAW,2BAA2B;EACtCA,EAAW,wBAAwB;AACtC,GAOa,UAAb,MAAqB;CACnB,YAEE,GAEA,GAEA,GACA;EADS,AAJA,KAAA,QAAAC,GAEA,KAAA,MAAAC,GAEA,KAAA,SAAAC;CACR;CAGH,IAAI,YAAgC;EAClC,OAAO,KAAK,KAAK;CACnB;CAEA,IAAI,gBAAyC;EAC3C,OAAO,KAAK,KAAK,iBAAiB,CAAC;CACrC;CAOA,IAAI,WAA+B;EACjC,IAAI,OAAK,OAAO,KAAK,WAAW,KAAA,IAChC,KAAK,IAAIC,IAAc,KAAK,OAAOC,IAAQ,GAAGD,KAAMC,IAAQ,GAAG,KAAS;GACtE,IAAMC,IAAWF,EAA6B,SACxCG,IAAQ,OAAOD,KAAY,WAAWE,EAAS,KAAKF,CAAO,IAAI;GACrE,IAAIC,GAAO,OAAOA,EAAM;GACxB,IAAMH,EAA2B;EACnC;CAEF;CAQA,IAAI,OAA2B;EAE7B,OADI,KAAK,aAAa,KAAA,IACf,WAAW,KAAK,WAAW,KAAK,MAAM,IADL;CAE1C;CAOA,IAAI,UAAmB;EACrB,OAAO,KAAK,QAAQ,KAAA,KAAa,KAAK,WAAW,KAAA;CACnD;CAEA,IAAI,UAAkB;EACpB,IAAI,KAAK,KAAK,OAAO,KAAK,IAAI;EAC9B,IAAMK,IAAW,KAAK;EAKtB,OAJIA,MAAa,KAAA,IAEb,KAAK,WAAW,KAAA,IAEb,wCAAwC,SAAS,KAAK,KAAK,MADzD,gCAAgC,KAAK,WAFrC,8DAA8DA,EAAS;CAIlF;CAQA,eAA+B;EAC7B,OAAO,IAAIC,EAAe,KAAK,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC;CAChE;CAGA,OAIE;EACA,IAAMC,IAAO,KAAK;EAClB,OAAO;GACL,OAAO,KAAK;GACZ,GAAIA,MAAS,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAK,EAAE;GACjD,GAAI,KAAK,SAAS,iBAAiB,KAAK,UACpC,EAAE,WAAW,GAAc,IAC3B,CAAC;EACP;CACF;AACF,GAGMH,IAAW;AAGjB,SAAgB,mBAAmB,GAA2B;CAC5D,OAAOI,EAAQ,cAAcZ,EAAW;AAC1C;AAYA,SAAgB,WACd,GACA,GACoB;CACpB,IAAMa,IAAQC,MAAc,KAAA,IAAY,KAAA,IAAYf,EAAMe;CAC1D,IAAID,GAAO,OAAOA;CAClB,QAAQV,GAAR;EACE,KAAK;EACL,KAAK,KACH,OAAO;EACT,KAAK;EACL,KAAK,KACH,OAAO;EACT,KAAK;EACL,KAAK,KACH,OAAO;EACT,KAAK;EACL,KAAK,KACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAGA,eAAsB,UAAU,GAAkC;CAChE,IAAMD,IAAM,MAAMa,EAAWC,CAAK;CAElC,OAAO,IAAI,QAAQA,GAAOd,GADXA,GAAK,UAAU,SAASc,CAAK,CACP;AACvC;AAGA,SAAS,SAAS,GAAoC;CACpD,IAAI,OAAOA,KAAU,YAAYA,GAGjC,OAFkBA,EAAiD,UAC/D,UACa;AACnB;AAGA,SAAS,SAAS,GAAwB;CACxC,IAAI,OAAOA,KAAU,YAAYA,GAAgB;EAC/C,IAAM,EAAE,SAAM,eAAYA;EAC1B,IAAI,OAAOV,KAAY,UACrB,OAAO,OAAOW,KAAS,WAAW,GAAGA,EAAK,IAAIX,MAAYA;CAC9D;CACA,OAAO,OAAOU,CAAK;AACrB;;;AC7NA,IAAaE,IAAkB,YAMlBC,IAAkB,YAUlBC,IAAmB,cAa1BC,IAAQ,iDAGDC,IAAQ;CAEnB,OAAO,GAAGD,EAAM;CAEhB,MAAM,GAAGA,EAAM;CACf,MAAM,GAAGA,EAAM;CACf,QAAQ,GAAGA,EAAM;CAEjB,OAAO,GAAGA,EAAM;CAEhB,OAAO,GAAGA,EAAM;CAChB,QAAQ,GAAGA,EAAM;CACjB,MAAM,GAAGA,EAAM;CAEf,QAAQ,GAAGA,EAAM;CAKjB,aAAa,GAAGA,EAAM;CACtB,YAAY,GAAGA,EAAM;CACrB,aAAa,GAAGA,EAAM;AACxB;AAOA,SAAgB,OACd,GACA,IAAoC,CAAC,GACb;CACxB,QAAQE,GAAR;EACE,KAAK,UACH,OAAO;GAAE,GAAGC;GAAW,SAASN;EAAgB;EAClD,KAAK,UACH,OAAO;GACL,GAAGM;GACH,UAAUJ;GACV,SAASD;EACX;EACF,SACE,OAAO,EAAE,GAAGK,EAAU;CAC1B;AACF;;;AC5BA,SAAgB,SAAS,GAA+B;CACtD,OAAOC,EAAK,WAAW,YAAY,OAAOA,EAAK,WAAY;AAC7D;AAoBA,IAAaC,IAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,SAAgB,WAAW,GAAyB;CAClD,OAAO,OAAOC,CAAO;AACvB;AAEA,SAAgB,WAAW,GAA0C;CACnE,IAAM,EAAE,gBAAa,YAAS,aAAUC;CACxC,OAAO;EACL,IAAIC;EACJ,cAAcC,EAAM;EACpB,OAAOA,EAAM;EACb,OAAOA,EAAM;EACb,UAAU,WAAWH,CAAO;EAC5B,QAAQG,EAAM;CAChB;AACF;AAEA,SAAgB,UAAU,GAAiD;CACzE,IAAM,EAAE,gBAAa,YAAS,aAAUF;CACxC,OAAO;EACL,IAAIC;EACJ,cAAcC,EAAM;EACpB,OAAOA,EAAM;EACb,OAAOA,EAAM;EACb,MAAMA,EAAM,OAAO;EACnB,UAAU,WAAWH,CAAO;CAC9B;AACF;AAEA,SAAgB,eAAe,GAAoC;CACjE,OAAO;EACL,IAAIF,EAAK;EACT,cAAcA,EAAK;EACnB,OAAOA,EAAK;EACZ,OAAO;EACP,UAAUA,EAAK;EACf,QAAQA,EAAK;EACb,GAAI,SAASA,CAAI,IAAI,EAAE,QAAQ,GAAc,IAAI,CAAC;CACpD;AACF;AAEA,SAAgB,cAAc,GAA2C;CACvE,OAAO;EACL,IAAIA,EAAK;EACT,cAAcA,EAAK;EACnB,OAAOA,EAAK;EACZ,OAAO;EACP,MAAMA,EAAK;EACX,UAAUA,EAAK;EACf,GAAI,SAASA,CAAI,IAAI,EAAE,QAAQ,GAAc,IAAI,CAAC;CACpD;AACF;AAOA,SAAgB,cAAc,GAAwC;CACpE,OAAO,cACL;EACE,OAAOM,EAAK,SAAS,CAAC;EACtB,mBAAmBA,EAAK,qBAAqB;EAC7C,SAASA,EAAK,WAAW,KAAA;EACzB,UAAUA,EAAK,YAAY,KAAA;CAC7B,GACAA,EAAK,OACP;AACF;AAGA,SAAgB,iBACd,GACmC;CACnC,IAAM,EAAE,UAAO,sBAAmB,YAAS,gBAAaC;CACxD,OAAO;EACL,OAAO,CAAC,GAAGC,CAAK;EAChB,mBAAmBC,KAAqB;EACxC,GAAIC,MAAY,KAAA,IAAY,CAAC,IAAI,EAAE,WAAQ;EAC3C,GAAIC,MAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAGA,EAAS,EAAE;CAChE;AACF;AAGA,SAAgB,cACd,GACA,GACiB;CACjB,OAAO;EAAE,GAAG,iBAAiBJ,CAAW;EAAG,UAAU,WAAWL,CAAO;CAAE;AAC3E;AAGA,SAAgB,gBACd,GACA,GACS;CACT,OAAO,UAAUU,CAAC,MAAM,UAAUC,CAAC;AACrC;AAGA,SAAS,UAAU,GAAwD;CACzE,IAAM,EAAE,UAAO,sBAAmB,YAAS,gBACzC,iBAAiBN,CAAW,GACxBO,IACJH,KACA,OAAO,QAAQA,CAAQ,CAAC,CAAC,MAAM,CAACI,IAAI,CAACC,OAAQD,IAAIC,IAAI,KAAK,MAAIA,EAAU;CAC1E,OAAO,KAAK,UAAU;EACpBR;EACAC;EACAC,KAAW;EACXI,KAAQ;CACV,CAAC;AACH;;;AC3HA,IAAMG,IAAa,KAGbC,IAAoB,KAqBpBC,IAAe,OAAO,cAAc,GAkC7B,eAAb,MAA+C;CA4B7C,YAAY,GAA8B;EAIxC,AAzBwB,KAAA,yBAAA,IAAI,IAAmB,GAMX,KAAA,qBAAA,IAAI,WAA4B,GAChC,KAAA,qBAAA,IAAI,WAAiB,GAEzB,KAAA,iBAAA,IAAI,WAAiB,GAMrB,KAAA,iBAAA,IAAI,WACpCC,CACF,GAKE,KAAK,UAAUC,EAAQ,SAGnBA,EAAQ,gBAAa,KAAK,cAAcA,EAAQ;CACtD;CAYA,KACE,GACA,GACgC;EAChC,OAAO,MAAM,YAAY;GACvB,IAAMC,IAAQC,EAAU;IACtB,QAAQC,EAAO,GAAG,sBAAsBC,CAAY;IACpD,YAAY,EAAE,SAASxB,EAAe;IACtC,MAAMyB;IACN,OAAOT;GACT,CAAC,GACK,CAACU,GAAUC,GAAQC,KAAU,MAAM,QAAQ,IAAI;IACnD,KAAK,KAAyB,QAAQhC,EAAM,MAAM,YAAY;KAC5D,MAAMyB;KACN;IACF,CAAC;IACD,KAAK,KAAyB,QAAQzB,EAAM,MAAM,UAAU;KAC1D,MAAMyB;KACN;IACF,CAAC;IACD,KAAK,KAAuB,OAAOzB,EAAM,aAAa,UAAU;KAC9D,OAAO,EAAE,gBAAa;KACtB;IACF,CAAC;GACH,CAAC,CAAC,CAAC,OAAO,MAAoB;IAC5B,MAAMiC,aAAkB,WAAWA,EAAO,SAAS,cAC/C,YAAYA,CAAM,IAClBA;GACN,CAAC;GACD,KAAK,IAAM9B,KAAQ6B,GAAQ,KAAK,eAAe7B,CAAI;GACnD,IAAM+B,oBAAO,IAAI,IAAiC;GAClD,KAAK,IAAMC,KAAW;IACpB,GAAGL,EAAS,IAAI,SAAS;IACzB,GAAGC,EAAO,IAAI,SAAS;IACvB,GAAGC,EAAO,IAAI,aAAa;GAC7B,GACE,AAAIE,EAAK,IAAIC,EAAQ,EAAE,MACvBD,EAAK,IAAIC,EAAQ,IAAIA,CAAO,GAC5B,KAAK,OAAO,IAAIA,EAAQ,IAAIA,EAAQ,KAAK;GAG3C,OAAO,CAAC,GAAGD,EAAK,OAAO,CAAC,CAAC,CAAC,MACvB,GAAG,MAAME,EAAcrB,EAAE,SAASqB,EAAcpB,EAAE,MACrD;EACF,CAAC;CACH;CAGA,IAAI,GAAY,GAA6C;EAC3D,OAAO,MAAM,aAAa,MAAM,KAAK,KAAKqB,GAAIC,CAAM,EAAA,CAAG,QAAQ;CACjE;CASA,OACE,GACA,GACuB;EACvB,OAAO,MAAM,YAAY;GAGvB,IAAMrC,IAAesC,EAAM,OACrB,EAAE,iBAAcC;GACtB,IAAI,KAAK,eAAe,IAAIC,CAAS,GAAG;IACtC,IAAMC,IAAO,MAAM,KAAK,MAAMzC,GAAOuC,GAAS,EAAI,GAC5ClC,IACJoC,GAAM,WAAW,MACX,MAAMA,EAAK,KAAK,IAClB;IACN,IAAIpC,GAAU,aAIZ,OAHA,KAAK,OAAO,IAAIA,EAAS,aAAaL,CAAK,GAGpCA,MAAU,WACb,KAAK,OAAO,UAAUK,EAAS,aAAakC,EAAQ,MAAM,IAC1D,WAAWlC,CAAQ;GAE3B;GACA,KAAK,eAAe,IAAImC,GAAW,EAAI;GACvC,IAAM,EAAE,iBAAc,UAAO,cAAWF,GAClCI,IAAuB;IAC3B,QAAQ;IACR,KAAK3C,EAAM;IACX,QAAQC;IACR,MAAM;KAAE;KAAc;KAAO;IAAO;IACpC,SAASA;GACX,GACM2C,IAAS,MAAM,KAAK,KACxBD,EAAM,QACNA,EAAM,KACN1C,GACA;IACE,MAAM0C,EAAM;IACZ,SAAS,aAAaH,CAAO;IAC7B,QAAQA,EAAQ;GAClB,CACF,CAAC,CAAC,MAAM,OAAO,MAAoB;IACjC,MAAM,MAAM,KAAK,cAAcP,GAAQO,EAAQ,MAAM;GACvD,CAAC;GAOD,OAAO,MANc,KAAK,OACxBI,EAAO,aACPD,GACAC,GACAJ,CACF;EAEF,CAAC;CACH;CAGA,KACE,GACA,GACA,GACA,GACuB;EACvB,OAAO,KAAK,MAAMH,GAAIQ,GAAUL,IAAS,OAAU;GACjD,QAAQ;GACR,KAAKxC,EAAM;GACX,QAAQC;GACR,MAAM,EAAE,UAAO;GACf,SAASA;EACX,EAAE;CACJ;CAGA,OACE,GACA,GACA,GACA,GACuB;EACvB,OAAO,KAAK,MAAMoC,GAAIQ,GAAUL,IAAS,OAAU;GACjD,QAAQ;GACR,KAAKxC,EAAM;GACX,QAAQC;GACR,MAAM,EAAE,SAAM;GACd,SAASA;EACX,EAAE;CACJ;CAaA,eACE,GACA,GACA,GACA,GACuB;EACvB,OAAO,KAAK,MAAMoC,GAAIQ,GAAUL,IAAS,MACvCvC,MAAU,WACN,SAAS,oCAAoC,IAC7C6C,MAAa,WACX;GACE,QAAQ;GACR,KAAK9C,EAAM;GACX,QAAQC;GACR,MAAM,CAAC;GACP,SAAS;EACX,IACA;GACE,QAAQ;GACR,KAAKD,EAAM;GACX,QAAQ;GACR,SAAS;EACX,CACR;CACF;CAGA,MAAM,OACJ,GACA,GACA,GACe;EACf,MAAM,KAAK,MAAMqC,GAAIQ,GAAUL,IAAS,OAAU;GAChD,QAAQ;GACR,KAAKxC,EAAM;GACX,QAAQC;GACR,MAAM,CAAC;GACP,SAAS;EACX,EAAE;CACJ;CAGA,eACE,GACA,GAC0B;EAC1B,OAAO,MAAM,YACX,cACE,MAAM,KAAK,KAAsB,OAAOD,EAAM,aAAa,YAAY;GACrE,MAAM,EAAE,gBAAa;GACrB;EACF,CAAC,CAAC,CAAC,MAAM,OAAO,MAAoB;GAClC,MAAM,MAAM,KAAK,cAAciC,GAAQK,CAAM;EAC/C,CAAC,CACH,CACF;CACF;CAQA,eACE,GACA,GACA,GAC0B;EAC1B,OAAO,MAAM,YAAY;GACvB,IAAM,EAAE,cAAW,cAAWE,GACxBO,IAAW,KAAK,mBAAmB,IAAIN,CAAS;GACtD,IAAIM,GAAU,OAAO,gBAAgBA,CAAQ;GAC7C,IAAMC,IAAQ,KAAK,mBAAmB,IAAIP,CAAS;GACnD,KAAK,mBAAmB,IAAIA,GAAW,EAAI;GAC3C,IAAIQ;GACJ,IAAI;IACF,IAAML,IAAS,MAAM,KAAK,KACxB,OACA5C,EAAM,aACN,YACA;KACE,MAAM,EAAE,gBAAa;KACrB,MAAM,iBAAiBU,CAAW;KAClC,SAAS,aAAa8B,GAAS9B,EAAY,QAAQ;KACnD;IACF,CACF;IACA,IACE,OAAOkC,EAAO,oBAAqB,WAC/B,cAAclC,GAAakC,EAAO,gBAAgB,IAClD,MAAM,KAAK,eAAehB,GAAcU,CAAM;GACtD,SAASL,GAAQ;IACf,IACE,EAAEA,aAAkB,YACnBA,EAAO,SAAS,cAAc,CAAC,mBAAmBA,CAAM,GAEzD,MAAM,MAAM,KAAK,cAAcA,GAAQK,CAAM;IAC/C,IAAMY,IAAU,MAAM,KAAK,eAAetB,GAAcU,CAAM;IAG9D,KACGU,KAAS,mBAAmBf,CAAM,MACnC,gBAAgBiB,GAASxC,CAAW,GAEpC,IAASwC;SAET,MAAM,IAAI9D,EAAe,YAAY6C,EAAO,SAAS;KACnD,GAAGA,EAAO,KAAK;KACf,aAAaiB;IACf,CAAC;GACL;GAEA,OADA,KAAK,mBAAmB,IAAIT,GAAWQ,CAAM,GACtC,gBAAgBA,CAAM;EAC/B,CAAC;CACH;CAOA,MACE,GACA,GACA,GACA,GACmC;EACnC,OAAO,MAAM,YAAY;GACvB,IAAM,EAAE,cAAWT,GACbW,IAAa,KAAK,OAAO,IAAId,CAAE,GACjCpC,IAAQkD,MAAe,MAAM,KAAK,KAAKd,GAAIC,CAAM,EAAA,CAAG,OACpDc,IAAYD,MAAe,KAAA;GAC/B,SAAS;IACP,IAAMR,IAAQU,EAAKpD,CAAK,GACpBqD,IAAWT;IACf,IAAI5C,MAAU,UAAU;KACtB,IAAMsD,IAAS,MAAM,KAAK,cAAclB,GAAIQ,GAAUF,GAAOH,CAAO;KACpE,IAAI,YAAYe,GAAQ,OAAOA,EAAO;KACtC,IAAWA,EAAO;IACpB;IACA,IAAIX;IACJ,IAAI;KACF,IAAS,MAAM,KAAK,KAClBD,EAAM,QACNA,EAAM,KACNA,EAAM,QACN;MACE,MAAM,EAAE,MAAG;MACX,MAAMA,EAAM;MACZ,SAAS,aAAaH,GAASc,CAAQ;MACvC;KACF,CACF;IACF,SAASrB,GAAQ;KACf,IAAI,EAAEA,aAAkB,UAAU,MAAMA;KACxC,IAAMuB,IAAW,MAAM,KAAK,SAASnB,GAAIM,GAAOH,GAASP,CAAM;KAC/D,IAAIuB,MAAalC,GAAc,OAAOkC;KACtC,IACE,CAACJ,MACAnB,EAAO,SAAS,eAAeA,EAAO,SAAS,cAChD;MACA,IAAY;MACZ,IAAMhD,KAAS,MAAM,KAAK,KAAKoD,GAAIC,GAAQ,IAAI,EAAA,CAAG;MAGlD,IAAIrD,MAAUgB,KAASoD,EAAKpE,CAAK,CAAC,CAAC,WAAW0D,EAAM,QAAQ;OAC1D,IAAQ1D;OACR;MACF;KACF;KAGA,MAFIgD,EAAO,SAAS,cAAc,mBAAmBA,CAAM,IACnD,MAAM,KAAK,SAASI,GAAIJ,GAAQK,CAAM,IACxC,MAAM,KAAK,QAAQL,GAAQK,CAAM;IACzC;IAGA,OAAO,KAAK,OAAOD,GAAIM,GAAOC,GAAQJ,CAAO;GAC/C;EACF,CAAC;CACH;CAGA,MAAc,OACZ,GACA,GACA,GACA,GACmC;EACnC,IAAIG,EAAM,YAAY,MAAM;EAC5B,KAAK,OAAO,IAAIN,GAAIM,EAAM,OAAO;EACjC,IAAMtC,IAAUuC,EAAO,kBACnBa,GACAnE;EACJ,IAAI;GAMF,IALA,IAAO,MAAM,KAAK,OAAOqD,EAAM,SAASN,GAAIG,EAAQ,MAAM,GACtD,OAAOnC,KAAY,YAAYoD,EAAK,aAAa,WAAWpD,CAAO,KAInEsC,EAAM,YAAY,YAChB,KAAK,eAAe,IAAIN,CAAE,CAAC,EAAE,YAAYhC,GAAS,OAAOoD;EAEjE,SAASxB,GAAQ;GACf,IAAUA;EACZ;EAIA,IAAMuB,IAAW,MAAM,KAAK,OAAOnB,GAAIM,GAAOH,GAAS,EAAK;EAC5D,IAAIgB,MAAalC,KAAgBkC,MAAa,KAAA,GAAW,OAAOA;EAChE,IAAIC,GAAM,OAAOA;EACjB,MAAMnE;CACR;CAOA,MAAc,SACZ,GACA,GACA,GACA,GACyD;EAKzD,OAHEA,EAAQ,SAAS,cACjBA,EAAQ,SAAS,eACjB,mBAAmBA,CAAO,IACT,KAAK,OAAO+C,GAAIM,GAAOH,GAAS,EAAI,IAAIlB;CAC7D;CAmBA,MAAc,OACZ,GACA,GACA,GACA,GACyD;EACzD,IAAMoC,IACJf,EAAM,WAAW,WACb,CAAC,QAAQ,IACTA,EAAM,WAAW,aACf,CAAC,YAAY,QAAQ,IACrB,CAAC,UAAU,UAAU;EAC7B,KAAK,IAAM,CAACgB,GAAO1D,MAAUyD,EAAO,QAAQ,GAAG;GAC7C,IAAME,IAAW,MAAM,KAAK,MAAM3D,GAAOuC,GAASqB,KAAUF,MAAU,CAAC;GACvE,IAAI,CAACC,GAAU;GACf,IAAIA,EAAS,WAAW,KACtB,OAAOjB,EAAM,YAAY,OAAO,KAAA,IAAYrB;GAC9C,IAAMhB,IAAY,MAAMsD,EAAS,KAAK;GAQtC,OAPIjB,EAAM,YAAY,QAAQrC,GAAU,gBAAgB+B,IAC/Cf,IAILqB,EAAM,YAAY,WACb,KAAK,OAAO,UAAUN,GAAIG,EAAQ,MAAM,IAC1C,WAAWlC,CAAQ;EAC5B;EACA,OAAOgB;CACT;CAMA,MAAc,MACZ,GACA,GACA,GAC+B;EAC/B,IAAI;GACF,OAAO,MAAM,KAAK,KAAK,OAAOtB,EAAM,QAAQC,GAAO;IACjD,MAAM,EAAE,WAAWuC,EAAQ,UAAU;IACrC,QAAQA,EAAQ;GAClB,CAAC;EACH,SAASP,GAAQ;GACf,IAAIA,aAAkB,YAAYA,EAAO,SAAS,eAAe,CAAC4B,IAChE;GACF,MAAM5B;EACR;CACF;CAGA,MAAc,SACZ,GACA,GACA,GACyB;EACzB,IAAM,EAAE,gBAAa,MAAM,KAAK,KAAKI,GAAIC,GAAQ,IAAI;EACrD,OAAO,IAAIlD,EAAe,YAAYE,EAAQ,SAAS;GACrD,GAAGA,EAAQ,KAAK;GAChB;EACF,CAAC;CACH;CAQA,MAAc,QACZ,GACA,GACyB;EACzB,IAAMwE,IAASxE,EAAQ,cAAc,QACnC,MAASI,EAAM,SAASlB,CAC1B;EACA,IAAIc,EAAQ,SAAS,aAAawE,EAAO,WAAW,GAClD,OAAOxE,EAAQ,aAAa;EAC9B,IAAMyE,IAAS,MAAM,QAAQ,IAC3BD,EAAO,KAAI,MAAS,KAAK,WAAWE,GAAO1B,CAAM,CAAC,CACpD;EACA,OAAO,IAAIlD,EAAe,WAAWE,EAAQ,SAAS;GACpD,GAAGA,EAAQ,KAAK;GAChB,QAAQyE;EACV,CAAC;CACH;CAEA,MAAc,WACZ,GACA,GACiB;EACjB,IAAI,OAAOC,EAAM,OAAQ,YAAYA,EAAM,IAAI,KAAK,MAAM,IACxD,OAAOA,EAAM;EACf,IAAI;GACF,QAAQ,MAAM,KAAK,OAAO,UAAUA,EAAM,MAAM1B,CAAM,EAAA,CAAG;EAC3D,QAAQ;GACN,OAAO0B,EAAM;EACf;CACF;CAOA,MAAc,KACZ,GACA,GACA,IAAkC,KAAK,OAAO,IAAI3B,CAAE,GACD;EAGnD,IAAI,CAAC4B,EAAmB5B,CAAE,GAAG;GAC3B,IAAM1B,IAAiB;IAAC;IAAY;IAAU;GAAQ;GACtD,AAAIuD,KACFvD,EAAM,MAAM,GAAG,MAAM,OAAOK,MAAMkD,CAAK,IAAI,OAAOnD,MAAMmD,CAAK,CAAC;GAChE,KAAK,IAAMjE,KAASU,GAClB,IAAI;IACF,IAAMwD,IAAW,MAAM,KAAK,OAAOlE,GAAOoC,GAAIC,CAAM;IAEpD,OADA,KAAK,OAAO,IAAID,GAAIpC,CAAK,GAClB;KAAE;KAAO;IAAS;GAC3B,SAASgC,GAAQ;IACf,IAAIA,aAAkB,WAAWA,EAAO,SAAS,aAC/C;IACF,MAAMA;GACR;GAKF,IAAI,CAAE,MAAM,KAAK,OAAOK,CAAM,GAC5B,MAAM,IAAIlD,EAAe,eAAegF,CAAa;EACzD;EACA,MAAM,IAAIhF,EAAe,aAAa,iBAAiBiD,GAAI;CAC7D;CAOA,MAAc,OAAO,GAAmD;EACtE,IAAI;GAEF,OADA,MAAM,KAAK,KAAK,OAAOrC,EAAM,aAAa,UAAU,EAAE,UAAO,CAAC,GACvD;EACT,SAASiC,GAAQ;GACf,OAAO,EAAEA,aAAkB,WAAWA,EAAO,SAAS;EACxD;CACF;CAGA,MAAc,cACZ,GACA,GACkB;EAClB,OAAOA,aAAkB,WACvBA,EAAO,SAAS,eAChB,CAAE,MAAM,KAAK,OAAOK,CAAM,IACxB,YAAYL,CAAM,IAClBA;CACN;CAGA,eAAuB,GAAsC;EAO3D,OANA,KAAK,eAAe,IAClB9B,EAAK,IACL,SAASA,CAAI,IACT;GAAE,UAAUA,EAAK;GAAU,SAASA,EAAK;EAAS,IAClD,IACN,GACOA;CACT;CAUA,MAAc,cACZ,GACA,GACA,GACA,GACqE;EACrE,IAAIZ,IAAQ,KAAK,eAAe,IAAI8C,CAAE;EAEtC,IADI9C,MAAU,QAAM,SAAS,uCAAuC,GAChEA,GAAO,aAAasD,GAAU;GAChC,IAAMsB,IAAW,MAAM,KAAK,OAAO,UAAU9B,GAAIG,EAAQ,MAAM;GAE/D,IADA,IAAQ,KAAK,eAAe,IAAIH,CAAE,GAC9B9C,KAASA,EAAM,aAAasD,GAAU;IACxC,IAAMW,IAAW,MAAM,KAAK,OAAOnB,GAAIM,GAAOH,GAAS,EAAK;IAC5D,IAAIgB,MAAalC,GAAc,OAAO,EAAE,QAAQkC,EAAS;IACzD,MAAM,IAAIpE,EACR,YACA,eAAeiD,EAAG,8BAA8BQ,KAChD,EAAE,YAAS,CACb;GACF;EACF;EAEA,OADKtD,KAAO,SAAS,uCAAuC,GACrD,EAAE,SAAS,OAAOA,EAAM,OAAO,EAAE;CAC1C;CAEA,MAAc,OACZ,GACA,GACA,GACuB;EAUvB,OATIU,MAAU,WACL,eACL,KAAK,eACH,MAAM,KAAK,KAAqB,OAAOD,EAAM,YAAY,UAAU;GACjE,MAAM,EAAE,MAAG;GACX;EACF,CAAC,CACH,CACF,IACK,WACL,MAAM,KAAK,KAAuB,QAAQA,EAAM,QAAQC,GAAO;GAC7D,MAAMoE,EAAY,EAAE,QAAQ1C,EAAO,GAAGU,CAAE,EAAE,CAAC;GAC3C;EACF,CAAC,CACH;CACF;CAEA,MAAc,KACZ,GACA,GACA,GACA,GACY;EAEZ,OAAQ,OAAM,MADS,KAAK,KAAKiC,GAAQC,GAAKtE,GAAOuE,CAAO,EAAA,CACrC,KAAK;CAC9B;CAMA,MAAc,KACZ,GACA,GACA,GACA,EAAE,SAAM,UAAO,SAAM,YAAS,aACX;EACnB,IAAI;GACF,OAAO,MAAM,KAAK,QAAQ,QACxB;IACE;IACA;IACA,WAAW;KAAE,MAAM,OAAOvE,GAAOwE,CAAI;KAAG;IAAM;IACxC;IACN;IACA;GACF,GACA,EAAE,iBAAiBC,EAAiB,SAAS,CAC/C;EACF,SAAShF,GAAO;GACd,MAAM,MAAM,UAAUA,CAAK;EAC7B;CACF;AACF;AAYA,SAAS,aACP,GACA,GACwB;CACxB,OAAO;GACJiF,EAAe,aAAanC,EAAQ;GACpCmC,EAAe,aAAaC,EAAa;EAC1C,GAAI/B,MAAa,KAAA,IACb,CAAC,IACD,GAAG8B,EAAe,oBAAoB9B,EAAS;CACrD;AACF;AAGA,IAAMuB,IAAgB;AAEtB,SAAS,YAAY,GAAkC;CACrD,OAAO,IAAIhF,EAAe,eAAegF,GAAe9E,EAAQ,KAAK,CAAC;AACxE;AAMA,IAAMuC,IAAa,CAACgD,EAAI,gBAAgB,GAAGA,EAAI,aAAa,CAAC,GAGvDzC,IAAwE;CAC5E,QAAQ;CACR,QAAQ;CACR,UAAU;AACZ;AAGA,SAAS,SAAS,GAAwB;CACxC,MAAM,IAAIhD,EAAe,aAAaJ,CAAO;AAC/C;AAOA,eAAe,MAAS,GAAmC;CACzD,IAAI;EACF,OAAO,MAAM8F,EAAI;CACnB,SAAS7C,GAAQ;EAKf,MAJIA,aAAkB,UAAeA,EAAO,aAAa,IACrD8C,EAAiB9C,CAAM,IAASA,IAG9B,IAAI7C,EACR,eACA6C,aAAkB,QAAQA,EAAO,UAAU,OAAOA,CAAM,GACxD;GACE,OAAOA;GACP,GAAIA,aAAkB,cAAc,EAAE,WAAW,GAAc,IAAI,CAAC;EACtE,CACF;CACF;AACF;AAMA,IAAMV,IAA0B,MAG1B,aAAN,MAAoB;CAGlB,YAAY,IAAyBF,GAAmB;EAF7B,AAEE,KAAA,QAAA2D,GAFF,KAAA,0BAAA,IAAI,IAAe;CAEW;CAEzD,IAAI,GAA4B;EAC9B,OAAO,KAAK,QAAQ,IAAIC,CAAG;CAC7B;CAEA,IAAI,GAAsB;EACxB,OAAO,KAAK,QAAQ,IAAIA,CAAG;CAC7B;CAEA,IAAI,GAAa,GAAgB;EAG/B,AAFA,KAAK,QAAQ,OAAOA,CAAG,GACvB,KAAK,QAAQ,IAAIA,GAAKC,CAAK,GACvB,KAAK,QAAQ,OAAO,KAAK,SAC3B,KAAK,QAAQ,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAM;CACzD;AACF"}

package/dist/paths.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The reserved owner of shared views and shared preferences
+ * (`ViewStoreService.SHARED_OWNER_ID` on the server). The parentheses keep it
+ * apart from every user id, so a path whose owner segment is `(shared)` is the
+ * shared audience's.
+ *
+ * A host nobody signs in to fills `{ownerId}` with it by default (its own
+ * request interceptor), and then has shared views and shared preferences
+ * only.
+ */
+export declare const SHARED_OWNER_ID = "(shared)";
+/**
+ * The reserved owner of stored system views
+ * (`ViewStoreService.SYSTEM_OWNER_ID` on the server).
+ */
+export declare const SYSTEM_OWNER_ID = "(system)";
+/**
+ * The one tenant stored system views live under
+ * (`ViewStoreService.SYSTEM_TENANT_ID`): the value of CoSec's platform
+ * tenant, not the default tenant `(0)`. System views are global, so the
+ * store writes them on `tenant/(platform)/owner/(system)` whatever the
+ * caller's own tenant, and the security gateway decides who may, by that
+ * path.
+ */
+export declare const SYSTEM_TENANT_ID = "(platform)";
+/**
+ * Where a view lives on the server: the owner segment of its path. `personal`
+ * leaves `{ownerId}` to the fetcher's interceptors (fetcher-cosec's resource
+ * attribution fills it from the token's `sub`); `shared` names
+ * {@link SHARED_OWNER_ID}, which the interceptors never replace; `system`
+ * names both the tenant and the owner of stored system views,
+ * {@link SYSTEM_TENANT_ID} and {@link SYSTEM_OWNER_ID}.
+ */
+export type Place = 'personal' | 'shared' | 'system';
+/** The view store's routes, relative to the fetcher's base URL. */
+export declare const PATHS: {
+    /** `POST`: create (the server generates the id). */
+    readonly views: "/view-store/tenant/{tenantId}/owner/{ownerId}/view";
+    /** `DELETE`: Wow's delete of the aggregate. */
+    readonly view: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/{id}";
+    readonly save: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/{id}/save";
+    readonly rename: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/{id}/rename";
+    /** Sent to the view's personal path; moves it to `(shared)`. */
+    readonly share: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/{id}/share";
+    /** Sent to the caller's own path; moves a shared view to the caller. */
+    readonly claim: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/{id}/claim";
+    readonly single: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/snapshot/single";
+    readonly list: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/snapshot/list";
+    /** The view as the write with this request id left it; `204` for a delete. */
+    readonly replay: "/view-store/tenant/{tenantId}/owner/{ownerId}/view/requests/{requestId}";
+    /**
+     * Served under `(shared)` only: the configured system views of the
+     * caller's tenant and the stored ones, global.
+     */
+    readonly systemViews: "/view-store/tenant/{tenantId}/owner/{ownerId}/system-views";
+    readonly systemView: "/view-store/tenant/{tenantId}/owner/{ownerId}/system-views/{id}";
+    readonly preferences: "/view-store/tenant/{tenantId}/owner/{ownerId}/definitions/{definitionId}/preferences";
+};
+/**
+ * The path variables of a request at `place`. The tenant is the
+ * interceptors' but on the system path; the owner is theirs for a personal
+ * path.
+ */
+export declare function pathAt(place: Place, variables?: Record<string, string>): Record<string, string>;

package/dist/wire.d.ts

@@ -0,0 +1,78 @@
+import { ViewAudience, ViewConfig, ViewInstance, ViewInstanceSummary, ViewKind, ViewPreferences } from '@ahoo-wang/wow-view-engine';
+/** The state of a `view` aggregate (`ViewState`); tenant and owner are Wow's. */
+export interface ViewStateBody {
+    definitionId: string;
+    title: string;
+    /** Follows the owner: `(shared)` is `shared`, any user is `personal`. */
+    audience: ViewAudience;
+    config: ViewConfig;
+}
+/**
+ * A view's snapshot as a snapshot query or the replay route answers it. A
+ * list projects it down to the summary's fields, `state.config.kind` among
+ * them.
+ */
+export interface ViewSnapshotBody {
+    aggregateId: string;
+    version: number;
+    state: ViewStateBody;
+}
+/** A system view the server serves (`SystemView`); `scope` is always `system`. */
+export interface SystemViewBody {
+    id: string;
+    definitionId: string;
+    title: string;
+    kind: ViewKind;
+    /** A hash of its content, whatever its source. */
+    revision: string;
+    config: ViewConfig;
+    /**
+     * `configured` (read-only) or `stored` (a view of `tenant/(platform)/owner/(system)`,
+     * written through the view routes); absent from a server before it,
+     * which served configured views only.
+     */
+    source?: 'configured' | 'stored';
+    /** A stored view's aggregate version, which its writes expect. */
+    version?: number | null;
+}
+/**
+ * Whether the server stores `view` (else it configures it). A stored one
+ * carries the port's `stored: true` (D81), the views an `editSystem`
+ * permission may write; configured and code system views carry none.
+ */
+export declare function isStored(view: SystemViewBody): boolean;
+/** One owner's preferences in one definition (`ViewPreferencesView`). */
+export interface PreferencesBody {
+    definitionId: string;
+    order?: string[] | null;
+    defaultInstanceId?: string | null;
+    autoRun?: boolean | null;
+    lastTabs?: Record<string, string> | null;
+    /** `0` for preferences never written. */
+    version: number;
+}
+/** The part of a command's answer (`CommandResult`) the store reads. */
+export interface CommandResultBody {
+    aggregateId: string;
+    aggregateVersion?: number | null;
+}
+/** The fields a list reads, and nothing of the config but its `kind`. */
+export declare const SUMMARY_FIELDS: string[];
+/** A snapshot's revision: the aggregate's version, compared as a string. */
+export declare function revisionOf(version: number): string;
+export declare function toInstance(snapshot: ViewSnapshotBody): ViewInstance;
+export declare function toSummary(snapshot: ViewSnapshotBody): ViewInstanceSummary;
+export declare function systemInstance(view: SystemViewBody): ViewInstance;
+export declare function systemSummary(view: SystemViewBody): ViewInstanceSummary;
+/**
+ * The port's preferences. A member the server holds as `null` is one never
+ * set: `defaultInstanceId` reads as `null`, and `autoRun` and `lastTabs` are
+ * left out, as the port's own `emptyPreferences()` leaves them.
+ */
+export declare function toPreferences(body: PreferencesBody): ViewPreferences;
+/** What a preferences write sends: everything but the revision. */
+export declare function preferencesInput(preferences: Omit<ViewPreferences, 'revision'>): Omit<ViewPreferences, 'revision'>;
+/** `preferences` as written at `version`, in the port's shape. */
+export declare function preferencesAt(preferences: Omit<ViewPreferences, 'revision'>, version: number): ViewPreferences;
+/** Whether two preferences say the same, whatever their revisions. */
+export declare function samePreferences(a: Omit<ViewPreferences, 'revision'>, b: Omit<ViewPreferences, 'revision'>): boolean;

package/dist/wowViewStore.d.ts

@@ -0,0 +1,214 @@
+import { Fetcher } from '@ahoo-wang/fetcher';
+import { ViewAudience, ViewConfig, ViewInstance, ViewInstanceSummary, ViewPermissions, ViewPreferences, ViewStore, WriteContext } from '@ahoo-wang/wow-view-engine';
+/** How a {@link WowViewStore} reaches the view store. */
+export interface WowViewStoreOptions {
+    /**
+     * The fetcher every request goes through, on the base URL that serves
+     * `/view-store/…` (the CoSec gateway in front of the view store server, or
+     * the service that embeds the starter).
+     *
+     * Its interceptors carry who is asking; the store never does. They must
+     * fill the path variables `{tenantId}` and, on a personal path,
+     * `{ownerId}` where the store leaves them out — fetcher-cosec's
+     * `ResourceAttributionRequestInterceptor` fills them from the token's
+     * `tenantId` and `sub` — and send `CoSec-App-Id` (fetcher-cosec's
+     * `CoSecRequestInterceptor`), and the space and the authorization with it.
+     * A host nobody signs in to adds an interceptor of its own that fills the
+     * same defaults (the owner `(shared)`, {@link SHARED_OWNER_ID}).
+     */
+    fetcher: Fetcher;
+    /**
+     * Which buttons are enabled for one definition's views. The server does
+     * not authorize, the CoSec gateway does; a host answers this by the roles
+     * it holds there — `changeAudience` by the role that may write
+     * `owner/(shared)`, which claiming a view needs. Left out, everything is
+     * allowed, as the port reads a store without `permissions`.
+     */
+    permissions?: (definitionId: string) => ViewPermissions;
+}
+/**
+ * The view engine's `ViewStore` over the Wow view store (`view-store/` in the
+ * Wow repository): saved views and preferences as two Wow aggregates, served
+ * under `/view-store/tenant/{tenantId}/owner/{ownerId}/…`.
+ *
+ * **The owner segment is the audience.** A personal view lives on the
+ * caller's own path (`{ownerId}` filled by the fetcher's interceptors), a
+ * shared one on `owner/(shared)`; the CoSec gateway decides who may use
+ * which. The port names a view by id alone, so the store remembers where it
+ * last saw each one (a list, a read, a write) and looks an unknown id up on
+ * the personal path, the shared path and the server's system views, in that
+ * order. Setting a view shared or personal moves it between the two paths,
+ * id kept.
+ *
+ * **Writes** carry the port's `requestId` as `Command-Request-Id`, its
+ * `revision` as `Command-Aggregate-Version`, and wait for the snapshot; the
+ * answer is the view read back at the version the write left. A write the
+ * server refuses as a stale version or a repeated request id is first looked
+ * up by its request id (the replay route): a retry answers what the first
+ * attempt wrote. Otherwise a stale version is `CONFLICT` carrying the view as
+ * it is now, and a view that turns out to be gone is `NOT_FOUND`.
+ *
+ * **Errors** are read by Wow's error code onto the port's five codes, by the
+ * HTTP status only for an answer without a code the store knows; a request
+ * that got no answer is `UNAVAILABLE`, and a retry under the same
+ * `requestId` is safe.
+ *
+ * **Creating is not idempotent on the server**, which generates the id. A
+ * store remembers the request ids of its own creates (bounded), and a retry
+ * of one first asks the replay route whether it landed; a retry sent by
+ * another store — another tab, a reload — makes a second view.
+ */
+export declare class WowViewStore implements ViewStore {
+    private readonly fetcher;
+    /**
+     * Where each view was last seen, by id. Kept after a delete, for its retry.
+     * A `system` view is read through the server's system views (configured
+     * and stored) and written, when stored, on the system path.
+     */
+    private readonly places;
+    /**
+     * The preferences have no replay route, so the store keeps what each of
+     * its own writes answered, and which ones it sent: a retry answers the
+     * first outcome, and a retry whose first answer was lost is recognised.
+     */
+    private readonly preferenceOutcomes;
+    private readonly preferenceAttempts;
+    /** The request ids of the creates this store sent, for their retries. */
+    private readonly createAttempts;
+    /**
+     * The system views as last read, by id: a stored one's version at its
+     * revision (a hash of its content, while a write expects the version), or
+     * `null` for a configured one, which is read-only.
+     */
+    private readonly storedVersions;
+    /** The host's {@link WowViewStoreOptions.permissions}, when it gave any. */
+    readonly permissions?: (definitionId: string) => ViewPermissions;
+    constructor(options: WowViewStoreOptions);
+    /**
+     * The caller's personal views, the shared views and the server's system
+     * views of the definition: three requests, sent together, answered in the
+     * port's order — system, shared, personal, each oldest first (the server
+     * sorts each audience by the time its first event was written).
+     *
+     * A server with no view store at all (one released before it) answers
+     * every route `404`, where a list on one that has it never does: that is
+     * `UNSUPPORTED`, not a missing view.
+     */
+    list(definitionId: string, signal?: AbortSignal): Promise<ViewInstanceSummary[]>;
+    /** View `id` wherever it is: the caller's, shared, or the server's system view. */
+    get(id: string, signal?: AbortSignal): Promise<ViewInstance>;
+    /**
+     * Posts the view to the path of its `scope`; the server generates the id.
+     * A retry of a create this store sent asks the replay route on that path
+     * first, and answers the view the first attempt made when it landed; the
+     * server itself does not deduplicate, so a retry from another store makes
+     * a second view.
+     */
+    create(input: Omit<ViewInstance, 'id' | 'revision'>, context: WriteContext): Promise<ViewInstance>;
+    /** Replaces the view's config, at the expected `revision`. */
+    save(id: string, config: ViewConfig, revision: string, context: WriteContext): Promise<ViewInstance>;
+    /** Renames the view (the server trims the title), at the expected `revision`. */
+    rename(id: string, title: string, revision: string, context: WriteContext): Promise<ViewInstance>;
+    /**
+     * 设为共享 sends `share` to the path the view is at; 设为个人 sends `claim`
+     * to the caller's own path, which the gateway admits only with the role
+     * that may write `owner/(shared)`. Either answers a view that already has
+     * the audience as it is, revision unmoved.
+     *
+     * A shared view a shared dashboard shows stays shared: the server refuses
+     * the claim and names the boards, and the refusal carries them by
+     * **title** in `boards`, as they are stored — a title written as a key
+     * stays one, and is said where the engine shows the refusal.
+     */
+    changeAudience(id: string, audience: ViewAudience, revision: string, context: WriteContext): Promise<ViewInstance>;
+    /** Deletes the view, at the expected `revision`; a board showing it keeps a broken panel. */
+    delete(id: string, revision: string, context: WriteContext): Promise<void>;
+    /** The caller's own, or `(shared)`'s where the host fills that owner. */
+    getPreferences(definitionId: string, signal?: AbortSignal): Promise<ViewPreferences>;
+    /**
+     * Writes the preferences at the expected `revision` (`'0'` for ones never
+     * written). The server has no replay route for them, so a retry answers
+     * what this store's first attempt answered, or — its answer lost — what is
+     * stored when that is what it wrote.
+     */
+    setPreferences(definitionId: string, preferences: ViewPreferences, context: WriteContext): Promise<ViewPreferences>;
+    /**
+     * One instance write: to the place the view is at, then the answer read
+     * back. A view remembered at a place it has since left (another tab shared
+     * it) is looked up again and the write sent once more to where it is.
+     */
+    private write;
+    /** A landed write's answer: the view read back at the version it left. */
+    private landed;
+    /**
+     * The answer of a write the server refused as a stale version, a repeated
+     * request id or a missing view, when the refusal is that of a retry: the
+     * replay route finds the first attempt by its request id.
+     */
+    private replayed;
+    /**
+     * What the write with the context's request id left of view `id`, from the
+     * replay route: the view at that version, or `undefined` for a delete.
+     *
+     * The route finds a write only on the path of the owner who wrote it, and
+     * a retry may be sent elsewhere than its first attempt — a share goes to
+     * the personal path the view has left by the time it is retried — so the
+     * path this attempt went to is asked first and the other one next.
+     *
+     * A probe that fails other than as "not found" is no answer on its path.
+     * With `strict` — a refused write, whose own path is asked first — that
+     * path's failure is passed on: whether the first attempt landed is
+     * unknown, and a retry under the same request id is safe. The other path
+     * (a caller without the shared role is refused there), and every probe of
+     * a write that landed, count it as not replayed, and the caller keeps what
+     * it knows: the refusal, or the view it read back.
+     */
+    private replay;
+    /**
+     * The replay route at `place` for the context's request id; `undefined`
+     * when it knows none, or — not `strict` — when it could not be asked.
+     */
+    private probe;
+    /** A stale write's refusal, carrying the view as it is now. */
+    private conflict;
+    /**
+     * The port's refusal of a write. A claim the server refuses because shared
+     * dashboards show the view carries those boards' titles (`boards`), which
+     * the server gives beside each board's id (a board it gives no title for
+     * is read for one); the engine says the refusal around them.
+     */
+    private refusal;
+    private boardTitle;
+    /**
+     * View `id` and where it is: first where it was last seen (`first`, `null`
+     * to ignore that), then the personal path, the shared path and the
+     * server's system views.
+     */
+    private find;
+    /**
+     * Whether the server has a view store at all: its system views answer
+     * on one that has (an empty list included), and `404` on one released
+     * before it. Any other failure is no answer to that, and reads as served.
+     */
+    private served;
+    /** A `404` from a server with no view store is `UNSUPPORTED`; else as it was. */
+    private unsupportedOr;
+    /** Keeps what a stored system view's writes expect; forgets a configured one. */
+    private rememberSystem;
+    /**
+     * The version a write of stored system view `id` at `revision` (its
+     * content hash) expects: as last read, else read now. A configured system
+     * view is read-only (`FORBIDDEN`; a code one is never found here). A
+     * revision other than the view's is stale — unless this write is a retry
+     * whose first attempt moved it on, which the replay route answers — and is
+     * then `CONFLICT`, carrying the view as it is.
+     */
+    private storedVersion;
+    private readAt;
+    private json;
+    /**
+     * The one place a request leaves the store, and so the one place what it
+     * threw becomes a {@link Failure}.
+     */
+    private send;
+}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@ahoo-wang/wow-view-store",
+  "version": "9.2.0-rc.0",
+  "description": "The Wow view store as the view engine's ViewStore: saved views and preferences of @ahoo-wang/wow-view-engine on a Wow server (https://github.com/Ahoo-Wang/Wow).",
+  "keywords": [
+    "wow",
+    "wow-view-store",
+    "view-engine",
+    "view-store",
+    "cqrs",
+    "typescript"
+  ],
+  "author": "Ahoo-Wang",
+  "license": "Apache-2.0",
+  "homepage": "https://wow.ahoo.me/reference/typescript/wow-view-store/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ahoo-Wang/Wow.git",
+    "directory": "typescript/wow-view-store"
+  },
+  "bugs": {
+    "url": "https://github.com/Ahoo-Wang/Wow/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "module": "./dist/index.es.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.es.js",
+      "default": "./dist/index.es.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "README.zh-CN.md"
+  ],
+  "sideEffects": false,
+  "peerDependencies": {
+    "@ahoo-wang/fetcher": "^5.1.5",
+    "@ahoo-wang/wow-client": "~9.2.0-rc.0",
+    "@ahoo-wang/wow-view-engine": "~9.2.0-rc.0"
+  },
+  "devDependencies": {
+    "@ahoo-wang/fetcher": "^5.1.5",
+    "@ahoo-wang/fetcher-decorator": "^5.1.5",
+    "@ahoo-wang/fetcher-eventstream": "^5.1.5",
+    "@eslint/js": "^10.0.1",
+    "@microsoft/api-extractor": "^7.59.3",
+    "@types/node": "^26.6.3",
+    "@vitest/coverage-v8": "4.1.11",
+    "eslint": "^10.11.0",
+    "globals": "^17.12.0",
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.70.1",
+    "unplugin-dts": "1.1.1",
+    "vite": "8.3.1",
+    "vitest": "^4.1.11",
+    "@ahoo-wang/wow-client": "~9.2.0-rc.0",
+    "@ahoo-wang/wow-view-engine": "~9.2.0-rc.0"
+  },
+  "scripts": {
+    "build": "vite build && pnpm test:package",
+    "test:package": "node scripts/verify-package.mjs",
+    "test": "vitest run --coverage && pnpm test:type && pnpm test:api",
+    "test:no-coverage": "vitest run --coverage.enabled=false && pnpm test:type && pnpm test:api",
+    "test:type": "tsc --noEmit -p test/tsconfig.types.json",
+    "test:api": "node scripts/api-report.mjs",
+    "lint": "eslint . --fix",
+    "clean": "rm -rf dist"
+  }
+}