@cuna_labs/cli 0.1.0

package/dist/runtime/owner-grant-operations.d.ts

@@ -0,0 +1,136 @@
+import type { PlatformAdapter } from '../platform/adapter.js';
+/**
+ * Durable identity for one in-flight owner grant mutation.
+ *
+ * Modelled on `machines/execution-receipt.ts`: one immutable file per operation
+ * ID, written BEFORE the request is dispatched, so a process that dies between
+ * dispatch and answer still knows which authority it may have created or which
+ * session it may have started sharing. Nothing secret is persisted -- only
+ * UUIDs, integers and the operation kind and action. No bearer, no email, no
+ * session name, no grant secret.
+ *
+ * A record's presence means "the outcome of this exact operation is unknown
+ * here". It is never permission to replay: replay is an explicit human action
+ * that reuses the SAME operation ID, and only the server can say what exists.
+ */
+export interface OwnerGrantOperationScope {
+    readonly baseUrl: string;
+    readonly profile: string;
+    readonly ownerPrincipalId: string;
+    readonly projectId: string;
+}
+export interface PendingCreateOperation {
+    readonly version: 1;
+    readonly scope: string;
+    readonly operationId: string;
+    readonly kind: 'create';
+    readonly agentSessionId: string;
+    readonly subjectPrincipalId: string;
+    readonly expectedMembershipRevision: number;
+    readonly expiresAtMs: number;
+}
+export interface PendingRevokeOperation {
+    readonly version: 1;
+    readonly scope: string;
+    readonly operationId: string;
+    readonly kind: 'revoke';
+    readonly grantId: string;
+    readonly agentSessionId: string;
+    readonly subjectPrincipalId: string;
+    readonly expectedRevision: number;
+}
+/**
+ * An unanswered publish or return-to-private.
+ *
+ * It carries no subject: publication is a property of the session, not of one
+ * member. The action is part of the durable identity because
+ * `issue_collab_v2_session_audience_request` refuses an operation ID replayed
+ * with a different action -- replaying the wrong one would turn a recoverable
+ * request into a conflict.
+ */
+export interface PendingAudienceOperation {
+    readonly version: 1;
+    readonly scope: string;
+    readonly operationId: string;
+    readonly kind: 'audience';
+    readonly action: 'publish' | 'private';
+    readonly agentSessionId: string;
+}
+export type PendingOwnerGrantOperation = PendingCreateOperation | PendingRevokeOperation | PendingAudienceOperation;
+export type OwnerGrantOperationIntent = Omit<PendingCreateOperation, 'version' | 'scope'> | Omit<PendingRevokeOperation, 'version' | 'scope'> | Omit<PendingAudienceOperation, 'version' | 'scope'>;
+/**
+ * The newest audience fact this computer holds about one run of one AgentSession.
+ *
+ * It exists because ordering is otherwise per-process: two `cuna share`
+ * processes on one state directory each kept their knowledge in a closure, so a
+ * reading answered in one could be painted as the present after the other had
+ * already confirmed the opposite. This record is the shared ground both read.
+ *
+ * It is deliberately NOT a clock and NOT a local counter. The order comes from
+ * the producer's own arithmetic: `issue_collab_v2_session_audience_request`
+ * answers a publish at `expected_generation + 1` and a return to private at
+ * `expected_generation`, and refuses to issue while an answer is outstanding.
+ * So generation G can only be created by the publish that answers `public@G`,
+ * and any `private@G` must have been issued when G already existed -- meaning
+ * `public@G` always precedes `private@G`, and nothing can put a second
+ * `public@G` after it. `(generation, state)` is therefore a total order over one
+ * run, computed in `audienceFactRank`, and no local tie-break is invented.
+ *
+ * It is bound to the exact run: a fact about another `sessionIncarnation` or
+ * `processEpoch` says nothing about this one and is never compared to it.
+ * Nothing secret is persisted -- identifiers, a state word and a counter.
+ */
+export interface ConfirmedAudienceFact {
+    readonly version: 1;
+    readonly scope: string;
+    readonly agentSessionId: string;
+    readonly sessionIncarnation: string;
+    readonly processEpoch: string;
+    /** `transition` is a decision this account had confirmed here; `reading` is an answer the session gave here. */
+    readonly kind: 'transition' | 'reading';
+    readonly state: 'public' | 'private';
+    readonly generation: string;
+}
+export type ConfirmedAudienceFactInput = Omit<ConfirmedAudienceFact, 'version' | 'scope'>;
+export interface OwnerGrantOperationStore {
+    /** Persist one unresolved operation before its request leaves. Refuses to overwrite an existing identity. */
+    reserve(intent: OwnerGrantOperationIntent): Promise<PendingOwnerGrantOperation>;
+    /** Drop the record once the outcome is known. Failure to drop over-reports, which is the safe direction. */
+    settle(operationId: string): Promise<void>;
+    /** Every operation in this scope whose outcome is still unknown here. */
+    list(signal?: AbortSignal): Promise<readonly PendingOwnerGrantOperation[]>;
+    /** The newest audience fact recorded on this computer for this session, or null. Unreadable bytes throw rather than read as absence. */
+    readAudienceFact(agentSessionId: string): Promise<ConfirmedAudienceFact | null>;
+    /** Record one fact. A fact the stored one already supersedes is not written, and the stored winner is returned either way. */
+    recordAudienceFact(input: ConfirmedAudienceFactInput): Promise<ConfirmedAudienceFact>;
+}
+/**
+ * The producer's own order over one run, as one number.
+ *
+ * `2*generation + (private ? 1 : 0)`: a higher generation always wins, and at an
+ * equal generation `private` is never older than `public`, because the publish
+ * that created G answers `public@G` and every `private@G` is issued after G
+ * exists. Equal ranks agree and need no tie-break.
+ */
+export declare function audienceFactRank(fact: {
+    state: 'public' | 'private';
+    generation: string;
+}): bigint;
+/** True when `candidate` describes a strictly earlier moment of the same run than `held`. */
+export declare function audienceFactIsOlder(candidate: {
+    state: 'public' | 'private';
+    generation: string;
+}, held: {
+    state: 'public' | 'private';
+    generation: string;
+}): boolean;
+/** True when two facts describe the same run and can therefore be ordered against each other. */
+export declare function audienceFactSameRun(a: {
+    sessionIncarnation: string;
+    processEpoch: string;
+}, b: {
+    sessionIncarnation: string;
+    processEpoch: string;
+}): boolean;
+export declare function ownerGrantOperationStore(platform: PlatformAdapter, scope: OwnerGrantOperationScope): OwnerGrantOperationStore;
+//# sourceMappingURL=owner-grant-operations.d.ts.map

package/dist/runtime/owner-grant-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-grant-operations.d.ts","sourceRoot":"","sources":["../../src/runtime/owner-grant-operations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AAG5D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAC,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAC,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAC,MAAM,CAAC;CAC3B;AACD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;IAAA,QAAQ,CAAC,KAAK,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,WAAW,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,IAAI,EAAC,QAAQ,CAAC;IAC5F,QAAQ,CAAC,cAAc,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,kBAAkB,EAAC,MAAM,CAAC;IAClE,QAAQ,CAAC,0BAA0B,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,WAAW,EAAC,MAAM,CAAC;CACxE;AACD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;IAAA,QAAQ,CAAC,KAAK,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,WAAW,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,IAAI,EAAC,QAAQ,CAAC;IAC5F,QAAQ,CAAC,OAAO,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,cAAc,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,kBAAkB,EAAC,MAAM,CAAC;IAC1F,QAAQ,CAAC,gBAAgB,EAAC,MAAM,CAAC;CAClC;AACD;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;IAAA,QAAQ,CAAC,KAAK,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,WAAW,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,IAAI,EAAC,UAAU,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAC,SAAS,GAAC,SAAS,CAAC;IAAA,QAAQ,CAAC,cAAc,EAAC,MAAM,CAAC;CACpE;AACD,MAAM,MAAM,0BAA0B,GAAC,sBAAsB,GAAC,sBAAsB,GAAC,wBAAwB,CAAC;AAC9G,MAAM,MAAM,yBAAyB,GAAC,IAAI,CAAC,sBAAsB,EAAC,SAAS,GAAC,OAAO,CAAC,GAAC,IAAI,CAAC,sBAAsB,EAAC,SAAS,GAAC,OAAO,CAAC,GAAC,IAAI,CAAC,wBAAwB,EAAC,SAAS,GAAC,OAAO,CAAC,CAAC;AAiCrL;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;IAAA,QAAQ,CAAC,KAAK,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,cAAc,EAAC,MAAM,CAAC;IACxE,QAAQ,CAAC,kBAAkB,EAAC,MAAM,CAAC;IAAA,QAAQ,CAAC,YAAY,EAAC,MAAM,CAAC;IAChE,gHAAgH;IAChH,QAAQ,CAAC,IAAI,EAAC,YAAY,GAAC,SAAS,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAC,QAAQ,GAAC,SAAS,CAAC;IAAA,QAAQ,CAAC,UAAU,EAAC,MAAM,CAAC;CAC9D;AACD,MAAM,MAAM,0BAA0B,GAAC,IAAI,CAAC,qBAAqB,EAAC,SAAS,GAAC,OAAO,CAAC,CAAC;AACrF,MAAM,WAAW,wBAAwB;IACvC,6GAA6G;IAC7G,OAAO,CAAC,MAAM,EAAC,yBAAyB,GAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9E,4GAA4G;IAC5G,MAAM,CAAC,WAAW,EAAC,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,EAAC,WAAW,GAAE,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAAC;IACzE,wIAAwI;IACxI,gBAAgB,CAAC,cAAc,EAAC,MAAM,GAAE,OAAO,CAAC,qBAAqB,GAAC,IAAI,CAAC,CAAC;IAC5E,8HAA8H;IAC9H,kBAAkB,CAAC,KAAK,EAAC,0BAA0B,GAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAC;IAAC,KAAK,EAAC,QAAQ,GAAC,SAAS,CAAC;IAAA,UAAU,EAAC,MAAM,CAAA;CAAC,GAAE,MAAM,CAEzF;AACD,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,SAAS,EAAC;IAAC,KAAK,EAAC,QAAQ,GAAC,SAAS,CAAC;IAAA,UAAU,EAAC,MAAM,CAAA;CAAC,EAAC,IAAI,EAAC;IAAC,KAAK,EAAC,QAAQ,GAAC,SAAS,CAAC;IAAA,UAAU,EAAC,MAAM,CAAA;CAAC,GAAE,OAAO,CAEpJ;AACD,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,CAAC,EAAC;IAAC,kBAAkB,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,MAAM,CAAA;CAAC,EAAC,CAAC,EAAC;IAAC,kBAAkB,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,MAAM,CAAA;CAAC,GAAE,OAAO,CAE/I;AAYD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAC,eAAe,EAAC,KAAK,EAAC,wBAAwB,GAAE,wBAAwB,CA+FzH"}

package/dist/runtime/owner-grant-operations.js

@@ -0,0 +1,216 @@
+import { createHash } from 'node:crypto';
+import { lstat, opendir, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { assertCanonicalUuid } from '../core/validation.js';
+const MAXIMUM_BYTES = 2048;
+const RECORD_NAME = /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.json$/u;
+const CREATE_KEYS = 'agentSessionId,expectedMembershipRevision,expiresAtMs,kind,operationId,scope,subjectPrincipalId,version';
+const REVOKE_KEYS = 'agentSessionId,expectedRevision,grantId,kind,operationId,scope,subjectPrincipalId,version';
+const AUDIENCE_KEYS = 'action,agentSessionId,kind,operationId,scope,version';
+function scopeDigest(scope) {
+    const url = new URL(scope.baseUrl);
+    if (url.username || url.password || url.search || url.hash || !['https:', 'http:'].includes(url.protocol) || !scope.profile)
+        throw new Error('Invalid owner grant operation scope.');
+    assertCanonicalUuid(scope.ownerPrincipalId, 'Principal ID');
+    assertCanonicalUuid(scope.projectId, 'Project ID');
+    return createHash('sha256').update(JSON.stringify(['owner-observe-grants-v2', url.href, scope.profile, scope.ownerPrincipalId, scope.projectId])).digest('hex');
+}
+function record(scope, intent) {
+    const digest = scopeDigest(scope);
+    assertCanonicalUuid(intent.operationId, 'Operation ID');
+    assertCanonicalUuid(intent.agentSessionId, 'AgentSession ID');
+    if (intent.kind === 'audience') {
+        if (intent.action !== 'publish' && intent.action !== 'private')
+            throw new Error('Invalid sharing action.');
+        return Object.freeze({ version: 1, scope: digest, operationId: intent.operationId, kind: 'audience', action: intent.action, agentSessionId: intent.agentSessionId });
+    }
+    assertCanonicalUuid(intent.subjectPrincipalId, 'Principal ID');
+    if (intent.kind === 'create') {
+        if (!Number.isSafeInteger(intent.expectedMembershipRevision) || intent.expectedMembershipRevision < 1)
+            throw new Error('Invalid membership revision.');
+        if (!Number.isSafeInteger(intent.expiresAtMs) || intent.expiresAtMs < 0)
+            throw new Error('Invalid expiry.');
+        return Object.freeze({ version: 1, scope: digest, operationId: intent.operationId, kind: 'create', agentSessionId: intent.agentSessionId, subjectPrincipalId: intent.subjectPrincipalId, expectedMembershipRevision: intent.expectedMembershipRevision, expiresAtMs: intent.expiresAtMs });
+    }
+    assertCanonicalUuid(intent.grantId, 'Grant ID');
+    if (!Number.isSafeInteger(intent.expectedRevision) || intent.expectedRevision < 1)
+        throw new Error('Invalid grant revision.');
+    return Object.freeze({ version: 1, scope: digest, operationId: intent.operationId, kind: 'revoke', grantId: intent.grantId, agentSessionId: intent.agentSessionId, subjectPrincipalId: intent.subjectPrincipalId, expectedRevision: intent.expectedRevision });
+}
+const AUDIENCE_FACT_KEYS = 'agentSessionId,generation,kind,processEpoch,scope,sessionIncarnation,state,version';
+/**
+ * The producer's own order over one run, as one number.
+ *
+ * `2*generation + (private ? 1 : 0)`: a higher generation always wins, and at an
+ * equal generation `private` is never older than `public`, because the publish
+ * that created G answers `public@G` and every `private@G` is issued after G
+ * exists. Equal ranks agree and need no tie-break.
+ */
+export function audienceFactRank(fact) {
+    return BigInt(fact.generation) * 2n + (fact.state === 'private' ? 1n : 0n);
+}
+/** True when `candidate` describes a strictly earlier moment of the same run than `held`. */
+export function audienceFactIsOlder(candidate, held) {
+    return audienceFactRank(candidate) < audienceFactRank(held);
+}
+/** True when two facts describe the same run and can therefore be ordered against each other. */
+export function audienceFactSameRun(a, b) {
+    return a.sessionIncarnation === b.sessionIncarnation && a.processEpoch === b.processEpoch;
+}
+function audienceFact(scope, input) {
+    const digest = scopeDigest(scope);
+    assertCanonicalUuid(input.agentSessionId, 'AgentSession ID');
+    assertCanonicalUuid(input.sessionIncarnation, 'Session incarnation');
+    assertCanonicalUuid(input.processEpoch, 'Process epoch');
+    if (input.kind !== 'transition' && input.kind !== 'reading')
+        throw new Error('Invalid audience fact kind.');
+    if (input.state !== 'public' && input.state !== 'private')
+        throw new Error('Invalid audience state.');
+    if (!/^(?:0|[1-9][0-9]{0,19})$/u.test(input.generation) || BigInt(input.generation) > 18446744073709551615n)
+        throw new Error('Invalid audience generation.');
+    return Object.freeze({ version: 1, scope: digest, agentSessionId: input.agentSessionId, sessionIncarnation: input.sessionIncarnation, processEpoch: input.processEpoch, kind: input.kind, state: input.state, generation: input.generation });
+}
+export function ownerGrantOperationStore(platform, scope) {
+    const digest = scopeDigest(scope);
+    const directory = join(platform.paths.stateDirectory, 'owner-observe-grants-v2', digest);
+    const file = (operationId) => join(directory, `${operationId}.json`);
+    // A separate tree, so an audience fact can never be mistaken for an unresolved
+    // operation by `list()` and cannot make that scan fail closed.
+    const factFile = (agentSessionId) => { assertCanonicalUuid(agentSessionId, 'AgentSession ID'); return join(platform.paths.stateDirectory, 'owner-audience-facts-v2', digest, `${agentSessionId}.json`); };
+    const readFact = async (agentSessionId) => {
+        const path = factFile(agentSessionId);
+        const snapshot = await platform.readSafeConfig(path, MAXIMUM_BYTES);
+        if (!snapshot.exists)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(snapshot.text ?? '');
+        }
+        catch {
+            throw new Error(`A local audience state record is unreadable: ${path}`);
+        }
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            throw new Error(`Invalid local audience state record: ${path}`);
+        const row = value;
+        if (row.version !== 1 || row.scope !== digest || row.agentSessionId !== agentSessionId || Object.keys(row).sort().join(',') !== AUDIENCE_FACT_KEYS)
+            throw new Error(`Invalid local audience state record: ${path}`);
+        return audienceFact(scope, row);
+    };
+    const store = {
+        async reserve(intent) {
+            const value = record(scope, intent);
+            const text = JSON.stringify(value) + '\n';
+            const previous = await platform.readSafeConfig(file(value.operationId), MAXIMUM_BYTES);
+            if (previous.exists)
+                throw new Error('This operation ID already has an unresolved record. Resolve it before starting another.');
+            await platform.writeSafeConfig(file(value.operationId), text, MAXIMUM_BYTES);
+            const saved = await platform.readSafeConfig(file(value.operationId), MAXIMUM_BYTES);
+            if (!saved.exists || saved.text !== text)
+                throw new Error('The operation record could not be verified. Nothing was sent.');
+            return value;
+        },
+        async settle(operationId) {
+            assertCanonicalUuid(operationId, 'Operation ID');
+            const path = file(operationId);
+            try {
+                const metadata = await lstat(path);
+                if (metadata.isSymbolicLink() || !metadata.isFile())
+                    throw new Error('Unsafe owner grant operation record.');
+                await unlink(path);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return;
+                throw error;
+            }
+        },
+        async list(signal) {
+            signal?.throwIfAborted();
+            const root = join(platform.paths.stateDirectory, 'owner-observe-grants-v2');
+            try {
+                for (const target of [root, directory]) {
+                    const metadata = await lstat(target);
+                    if (!metadata.isDirectory() || metadata.isSymbolicLink())
+                        throw new Error('Unsafe owner grant operation directory.');
+                }
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return Object.freeze([]);
+                throw new Error('Local owner grant operation records cannot be read safely.');
+            }
+            const items = [];
+            let scanned = 0;
+            for await (const entry of await opendir(directory)) {
+                signal?.throwIfAborted();
+                if (++scanned > 4096)
+                    throw new Error('Too many local operation records to list safely. No partial result is shown.');
+                const match = RECORD_NAME.exec(entry.name);
+                if (match === null)
+                    continue;
+                const path = join(directory, entry.name);
+                if (!entry.isFile() || entry.isSymbolicLink())
+                    throw new Error(`Unsafe owner grant operation record: ${path}`);
+                const snapshot = await platform.readSafeConfig(path, MAXIMUM_BYTES);
+                let value;
+                try {
+                    value = JSON.parse(snapshot.text ?? '');
+                }
+                catch {
+                    throw new Error(`A local owner grant operation record is unreadable: ${path}`);
+                }
+                // Failing closed is the safe direction, but a message that named no file
+                // left no way back: one unreadable record refuses the whole scope, and the
+                // person could not know which file to move aside.
+                if (typeof value !== 'object' || value === null || Array.isArray(value))
+                    throw new Error(`Invalid local owner grant operation record: ${path}`);
+                const row = value;
+                const keys = Object.keys(row).sort().join(',');
+                if (row.version !== 1 || row.scope !== digest || row.operationId !== match[1] || (row.kind === 'create' ? keys !== CREATE_KEYS : row.kind === 'revoke' ? keys !== REVOKE_KEYS : row.kind === 'audience' ? keys !== AUDIENCE_KEYS : true))
+                    throw new Error(`Invalid local owner grant operation record: ${path}`);
+                items.push(record(scope, row));
+            }
+            signal?.throwIfAborted();
+            return Object.freeze(items.sort((a, b) => a.operationId.localeCompare(b.operationId)));
+        },
+        readAudienceFact: agentSessionId => readFact(agentSessionId),
+        /**
+         * Record one fact, keeping whichever of the two describes the later moment.
+         *
+         * A fact about a different run replaces the stored one outright: the counter
+         * restarts with the run, so the old one cannot be compared and must not be
+         * allowed to order anything about the new one.
+         *
+         * There is no cross-process lock here, and none can be built from the
+         * primitives this store has. Two processes writing at once can lose one
+         * write, so the read-back below re-merges once against whatever actually
+         * landed; a fact that is still missing after that is reported rather than
+         * assumed. The residual window is stated in the delivery, not papered over.
+         */
+        async recordAudienceFact(input) {
+            const next = audienceFact(scope, input), path = factFile(next.agentSessionId);
+            /** True when what is stored already describes this run at or after `next`. */
+            const supersedes = (stored) => stored !== null && audienceFactSameRun(stored, next) && !audienceFactIsOlder(stored, next);
+            const current = await readFact(next.agentSessionId);
+            if (supersedes(current))
+                return current;
+            const text = JSON.stringify(next) + '\n';
+            await platform.writeSafeConfig(path, text, MAXIMUM_BYTES);
+            const saved = await readFact(next.agentSessionId);
+            if (saved === null)
+                throw new Error('The audience state record could not be verified after writing.');
+            if (supersedes(saved))
+                return saved;
+            // An older fact landed between the read and the write. Re-merge once against
+            // what is actually there; either way the store ends holding a fact some
+            // process really observed, never one invented to break a tie.
+            await platform.writeSafeConfig(path, text, MAXIMUM_BYTES);
+            const settled = await readFact(next.agentSessionId);
+            if (settled === null)
+                throw new Error('The audience state record could not be verified after writing.');
+            return settled;
+        },
+    };
+    return Object.freeze(store);
+}
+//# sourceMappingURL=owner-grant-operations.js.map

package/dist/runtime/owner-grant-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-grant-operations.js","sourceRoot":"","sources":["../../src/runtime/owner-grant-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,KAAK,EAAC,OAAO,EAAC,MAAM,EAAC,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAgD1D,MAAM,aAAa,GAAC,IAAI,CAAC;AACzB,MAAM,WAAW,GAAC,yEAAyE,CAAC;AAC5F,MAAM,WAAW,GAAC,yGAAyG,CAAC;AAC5H,MAAM,WAAW,GAAC,2FAA2F,CAAC;AAC9G,MAAM,aAAa,GAAC,sDAAsD,CAAC;AAE3E,SAAS,WAAW,CAAC,KAA8B;IAClD,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAG,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI,IAAE,CAAC,CAAC,QAAQ,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,CAAC,KAAK,CAAC,OAAO;QAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxK,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,EAAC,cAAc,CAAC,CAAC;IAAA,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAC,YAAY,CAAC,CAAC;IAC7G,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,yBAAyB,EAAC,GAAG,CAAC,IAAI,EAAC,KAAK,CAAC,OAAO,EAAC,KAAK,CAAC,gBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7J,CAAC;AACD,SAAS,MAAM,CAAC,KAA8B,EAAC,MAAgC;IAC9E,MAAM,MAAM,GAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAC,cAAc,CAAC,CAAC;IACvD,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAG,MAAM,CAAC,IAAI,KAAG,UAAU,EAAC,CAAC;QAC5B,IAAG,MAAM,CAAC,MAAM,KAAG,SAAS,IAAE,MAAM,CAAC,MAAM,KAAG,SAAS;YAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,UAAU,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC;IACzJ,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,EAAC,cAAc,CAAC,CAAC;IAC9D,IAAG,MAAM,CAAC,IAAI,KAAG,QAAQ,EAAC,CAAC;QAC1B,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,0BAA0B,CAAC,IAAE,MAAM,CAAC,0BAA0B,GAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjJ,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAE,MAAM,CAAC,WAAW,GAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,kBAAkB,EAAC,MAAM,CAAC,kBAAkB,EAAC,0BAA0B,EAAC,MAAM,CAAC,0BAA0B,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,CAAC,CAAC;IAC3Q,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAC,UAAU,CAAC,CAAC;IAC/C,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAE,MAAM,CAAC,gBAAgB,GAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,kBAAkB,EAAC,MAAM,CAAC,kBAAkB,EAAC,gBAAgB,EAAC,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;AAC/O,CAAC;AA4CD,MAAM,kBAAkB,GAAC,oFAAoF,CAAC;AAC9G;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiD;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAC,EAAE,GAAC,CAAC,IAAI,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC;AAClE,CAAC;AACD,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,SAAsD,EAAC,IAAiD;IAC3I,OAAO,gBAAgB,CAAC,SAAS,CAAC,GAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AACD,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,CAAiD,EAAC,CAAiD;IACtI,OAAO,CAAC,CAAC,kBAAkB,KAAG,CAAC,CAAC,kBAAkB,IAAE,CAAC,CAAC,YAAY,KAAG,CAAC,CAAC,YAAY,CAAC;AACrF,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAC,KAAgC;IACpF,MAAM,MAAM,GAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,mBAAmB,CAAC,KAAK,CAAC,cAAc,EAAC,iBAAiB,CAAC,CAAC;IAC5D,mBAAmB,CAAC,KAAK,CAAC,kBAAkB,EAAC,qBAAqB,CAAC,CAAC;IACpE,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAC,eAAe,CAAC,CAAC;IACxD,IAAG,KAAK,CAAC,IAAI,KAAG,YAAY,IAAE,KAAK,CAAC,IAAI,KAAG,SAAS;QAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpG,IAAG,KAAK,CAAC,KAAK,KAAG,QAAQ,IAAE,KAAK,CAAC,KAAK,KAAG,SAAS;QAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC9F,IAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAC,qBAAqB;QAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACvJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,cAAc,EAAC,KAAK,CAAC,cAAc,EAAC,kBAAkB,EAAC,KAAK,CAAC,kBAAkB,EAAC,YAAY,EAAC,KAAK,CAAC,YAAY,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,UAAU,EAAC,KAAK,CAAC,UAAU,EAAC,CAAC,CAAC;AAC9N,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,QAAwB,EAAC,KAA8B;IAC/F,MAAM,MAAM,GAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAC,yBAAyB,EAAC,MAAM,CAAC,CAAC;IACrF,MAAM,IAAI,GAAC,CAAC,WAAkB,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,EAAC,GAAG,WAAW,OAAO,CAAC,CAAC;IACvE,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,QAAQ,GAAC,CAAC,cAAqB,EAAC,EAAE,GAAC,mBAAmB,CAAC,cAAc,EAAC,iBAAiB,CAAC,CAAC,CAAA,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAC,yBAAyB,EAAC,MAAM,EAAC,GAAG,cAAc,OAAO,CAAC,CAAC,CAAA,CAAC,CAAC;IACtM,MAAM,QAAQ,GAAC,KAAK,EAAC,cAAqB,EAAqC,EAAE;QAChF,MAAM,IAAI,GAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAC,aAAa,CAAC,CAAC;QACjE,IAAG,CAAC,QAAQ,CAAC,MAAM;YAAC,OAAO,IAAI,CAAC;QAChC,IAAI,KAAa,CAAC;QAAA,IAAG,CAAC;YAAA,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAE,EAAE,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;QAAA,CAAC;QAC1I,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,KAAG,IAAI,IAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAC/H,MAAM,GAAG,GAAC,KAA+B,CAAC;QAC1C,IAAG,GAAG,CAAC,OAAO,KAAG,CAAC,IAAE,GAAG,CAAC,KAAK,KAAG,MAAM,IAAE,GAAG,CAAC,cAAc,KAAG,cAAc,IAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAG,kBAAkB;YAAC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QACpM,OAAO,YAAY,CAAC,KAAK,EAAC,GAA4C,CAAC,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,KAAK,GAA0B;QACpC,KAAK,CAAC,OAAO,CAAC,MAAM;YACnB,MAAM,KAAK,GAAC,MAAM,CAAC,KAAK,EAAC,MAAM,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC;YACvE,MAAM,QAAQ,GAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAC,aAAa,CAAC,CAAC;YACpF,IAAG,QAAQ,CAAC,MAAM;gBAAC,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;YAC9H,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAC,IAAI,EAAC,aAAa,CAAC,CAAC;YAC3E,MAAM,KAAK,GAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAC,aAAa,CAAC,CAAC;YACjF,IAAG,CAAC,KAAK,CAAC,MAAM,IAAE,KAAK,CAAC,IAAI,KAAG,IAAI;gBAAC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACrH,OAAO,KAAK,CAAC;QACd,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,WAAW;YACvB,mBAAmB,CAAC,WAAW,EAAC,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7B,IAAG,CAAC;gBAAA,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAA,IAAG,QAAQ,CAAC,cAAc,EAAE,IAAE,CAAC,QAAQ,CAAC,MAAM,EAAE;oBAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAAA,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAA,CAAC;YAClK,OAAM,KAAK,EAAC,CAAC;gBAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;oBAAC,OAAO;gBAAA,MAAM,KAAK,CAAC;YAAA,CAAC;QACtF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM;YAChB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,GAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAC,yBAAyB,CAAC,CAAC;YACzE,IAAG,CAAC;gBAAA,KAAI,MAAM,MAAM,IAAI,CAAC,IAAI,EAAC,SAAS,CAAC,EAAC,CAAC;oBAAA,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAA,IAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAE,QAAQ,CAAC,cAAc,EAAE;wBAAC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAAA,CAAC;YAAA,CAAC;YAChM,OAAM,KAAK,EAAC,CAAC;gBAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;oBAAC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAA,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAAA,CAAC;YACzK,MAAM,KAAK,GAA8B,EAAE,CAAC;YAAA,IAAI,OAAO,GAAC,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAC,CAAC;gBACnD,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAG,EAAE,OAAO,GAAC,IAAI;oBAAC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;gBAClH,MAAM,KAAK,GAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAA,IAAG,KAAK,KAAG,IAAI;oBAAC,SAAS;gBAClE,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAE,KAAK,CAAC,cAAc,EAAE;oBAAC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;gBAC3G,MAAM,QAAQ,GAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAC,aAAa,CAAC,CAAC;gBACjE,IAAI,KAAa,CAAC;gBAAA,IAAG,CAAC;oBAAA,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAE,EAAE,CAAC,CAAC;gBAAA,CAAC;gBAAA,MAAK,CAAC;oBAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,EAAE,CAAC,CAAC;gBAAA,CAAC;gBACjJ,yEAAyE;gBACzE,2EAA2E;gBAC3E,kDAAkD;gBAClD,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,KAAG,IAAI,IAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBACtI,MAAM,GAAG,GAAC,KAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAG,GAAG,CAAC,OAAO,KAAG,CAAC,IAAE,GAAG,CAAC,KAAK,KAAG,MAAM,IAAE,GAAG,CAAC,WAAW,KAAG,KAAK,CAAC,CAAC,CAAC,IAAE,CAAC,GAAG,CAAC,IAAI,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,KAAG,WAAW,CAAA,CAAC,CAAA,GAAG,CAAC,IAAI,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,KAAG,WAAW,CAAA,CAAC,CAAA,GAAG,CAAC,IAAI,KAAG,UAAU,CAAA,CAAC,CAAA,IAAI,KAAG,aAAa,CAAA,CAAC,CAAA,IAAI,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBAC3Q,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAC,GAA2C,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,gBAAgB,EAAC,cAAc,CAAA,EAAE,CAAA,QAAQ,CAAC,cAAc,CAAC;QACzD;;;;;;;;;;;;WAYG;QACH,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC7B,MAAM,IAAI,GAAC,YAAY,CAAC,KAAK,EAAC,KAAK,CAAC,EAAC,IAAI,GAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxE,8EAA8E;YAC9E,MAAM,UAAU,GAAC,CAAC,MAAiC,EAAiC,EAAE,CACrF,MAAM,KAAG,IAAI,IAAE,mBAAmB,CAAC,MAAM,EAAC,IAAI,CAAC,IAAE,CAAC,mBAAmB,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;YACpF,MAAM,OAAO,GAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClD,IAAG,UAAU,CAAC,OAAO,CAAC;gBAAC,OAAO,OAAO,CAAC;YACtC,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAC,IAAI,CAAC;YACrC,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAC,IAAI,EAAC,aAAa,CAAC,CAAC;YACxD,MAAM,KAAK,GAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAChD,IAAG,KAAK,KAAG,IAAI;gBAAC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAClG,IAAG,UAAU,CAAC,KAAK,CAAC;gBAAC,OAAO,KAAK,CAAC;YAClC,6EAA6E;YAC7E,wEAAwE;YACxE,8DAA8D;YAC9D,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAC,IAAI,EAAC,aAAa,CAAC,CAAC;YACxD,MAAM,OAAO,GAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClD,IAAG,OAAO,KAAG,IAAI;gBAAC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpG,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/runtime/owner-grants-screen.d.ts

@@ -0,0 +1,40 @@
+import type { ForegroundTerminalHost } from '../terminal/foreground.js';
+import { type ownerObserveGrantsApi } from '../api/owner-observe-grants-v2.js';
+import { type OwnerGrantOperationStore } from './owner-grant-operations.js';
+/** One session the owner may share. `projectId` undefined means the server did not name one. */
+export type ShareableSession = {
+    id: string;
+    name: string;
+    agent: string;
+    machineName: string;
+    state: string;
+    projectId?: string;
+};
+/**
+ * What one listing pass actually saw.
+ *
+ * The reads behind this are bounded -- a fixed number of Machines, one page of
+ * AgentSessions each -- so a listing can be a strict subset of what exists. A
+ * screen that shows a subset while implying completeness is a false statement
+ * about the owner's own account, so the bounds are reported, not hidden.
+ */
+export type ShareableSessionListing = {
+    items: ShareableSession[];
+    omittedMachines: number;
+    machinesWithMoreSessions: number;
+};
+export interface ShareableSessionSource {
+    list(signal: AbortSignal): Promise<ShareableSessionListing>;
+}
+type Api = ReturnType<typeof ownerObserveGrantsApi>;
+export declare function runOwnerGrantsScreen(api: Api, sessions: ShareableSessionSource, store: OwnerGrantOperationStore, identity: {
+    project: string;
+    owner: string;
+}, options?: {
+    host?: ForegroundTerminalHost;
+    signal?: AbortSignal;
+    initialGrantId?: string;
+    now?: () => number;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=owner-grants-screen.d.ts.map

package/dist/runtime/owner-grants-screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-grants-screen.d.ts","sourceRoot":"","sources":["../../src/runtime/owner-grants-screen.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAsF,KAAK,qBAAqB,EAA4I,MAAM,mCAAmC,CAAC;AAC7S,OAAO,EAAoG,KAAK,wBAAwB,EAAiC,MAAM,6BAA6B,CAAC;AAE7M,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GAAC;IAAC,EAAE,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,WAAW,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAA;CAAC,CAAC;AACpH;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAC;IAAC,KAAK,EAAC,gBAAgB,EAAE,CAAC;IAAA,eAAe,EAAC,MAAM,CAAC;IAAA,wBAAwB,EAAC,MAAM,CAAA;CAAC,CAAC;AACtH,MAAM,WAAW,sBAAsB;IAAC,IAAI,CAAC,MAAM,EAAC,WAAW,GAAE,OAAO,CAAC,uBAAuB,CAAC,CAAA;CAAC;AAClG,KAAK,GAAG,GAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAoDlD,wBAAsB,oBAAoB,CAAC,GAAG,EAAC,GAAG,EAAC,QAAQ,EAAC,sBAAsB,EAAC,KAAK,EAAC,wBAAwB,EAAC,QAAQ,EAAC;IAAC,OAAO,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAA;CAAC,EAAC,OAAO,GAAC;IAAC,IAAI,CAAC,EAAC,sBAAsB,CAAC;IAAA,MAAM,CAAC,EAAC,WAAW,CAAC;IAAA,cAAc,CAAC,EAAC,MAAM,CAAC;IAAA,GAAG,CAAC,EAAC,MAAI,MAAM,CAAA;CAAI,GAAE,OAAO,CAAC,IAAI,CAAC,CAolB3Q"}