@hydranium/protocol 1.0.0-next.23 → 1.0.0-next.232

package/src/reconcile-write.ts

@@ -0,0 +1,124 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { type ConflictError, isConflictError } from './errors';
+import { type BaseVersion, type ModelVersion } from './model-service/base-version';
+import { type ConflictResolver } from './patch-merge';
+
+const DEFAULT_MAX_WRITES = 3;
+
+/** A model and the version of the text it was read from, which a write based on it names. */
+export interface VersionedModel<TModel> {
+   readonly model: TModel;
+   readonly baseVersion: ModelVersion;
+}
+
+/** The I/O and policy a {@link reconcileWrite} call needs. */
+export interface ReconcileWriteHooks<TModel> {
+   /**
+    * Write `model`. Called with the caller's own `baseVersion` first, with the
+    * refetch's on a merged write, and with `'any'` for a merge that refetched
+    * nothing, where the resolver has already decided to win.
+    */
+   persist(model: TModel, baseVersion: BaseVersion): Promise<void>;
+   /**
+    * Current server-side model, or `undefined` when unavailable. Its version is
+    * read in the tick its text is: a later one lets a merged write overwrite an
+    * edit the merge never saw.
+    */
+   refetch(): Promise<VersionedModel<TModel> | undefined>;
+   /** The last in-sync model the user's intent is measured against. */
+   readonly base: TModel;
+   readonly conflictResolver: ConflictResolver;
+   /** Writes, the first included, after which a still-conflicting edit is dropped; 3 when absent. */
+   readonly maxWrites?: number;
+   /** Runs when the refetch is unavailable; absent, the edit is left unwritten. */
+   onUnavailable?(model: TModel, conflict: ConflictError): Promise<void>;
+}
+
+/**
+ * What {@link reconcileWrite} did. Every status but `persisted` follows a
+ * conflict, and carries the last one and the writes made, the first included.
+ */
+export type ReconcileWriteOutcome =
+   /** The first write landed. */
+   | { readonly status: 'persisted' }
+   | {
+        /**
+         * `merged`: a merged write landed. `unchanged`: the edit was empty, so the
+         * caller is behind the server. `conflict`: the resolver found a same-path
+         * collision. `dropped`: the writes ran out. `unavailable`: the refetch
+         * produced nothing and {@link ReconcileWriteHooks.onUnavailable} ran.
+         */
+        readonly status: 'merged' | 'unchanged' | 'conflict' | 'dropped' | 'unavailable';
+        readonly conflict: ConflictError;
+        readonly writes: number;
+     };
+
+/**
+ * Persist `model`, and on a `ConflictError` reconcile the user's `base → model`
+ * intent onto the refetched server model and write the merge, gated on the
+ * refetch's version, again on each conflict up to `maxWrites` writes. A
+ * non-conflict error is re-thrown.
+ */
+export async function reconcileWrite<TModel extends object>(
+   model: TModel,
+   baseVersion: BaseVersion,
+   hooks: ReconcileWriteHooks<TModel>
+): Promise<ReconcileWriteOutcome> {
+   let candidate = model;
+   let candidateBaseVersion = baseVersion;
+   let previous: ConflictError | undefined;
+   const maxWrites = hooks.maxWrites ?? DEFAULT_MAX_WRITES;
+   for (let writes = 1; ; writes++) {
+      const conflict = await persistOrConflict(hooks, candidate, candidateBaseVersion);
+      if (!conflict) {
+         return previous ? { status: 'merged', conflict: previous, writes } : { status: 'persisted' };
+      }
+      previous = conflict;
+      if (writes >= maxWrites) {
+         return { status: 'dropped', conflict, writes };
+      }
+      let refetched: VersionedModel<TModel> | undefined;
+      const outcome = await hooks.conflictResolver.resolve(hooks.base, model, async () => {
+         refetched = await hooks.refetch();
+         return refetched?.model;
+      });
+      switch (outcome.status) {
+         case 'merged':
+            candidate = outcome.merged;
+            candidateBaseVersion = refetched?.baseVersion ?? 'any';
+            continue;
+         case 'no-op':
+            return { status: 'unchanged', conflict, writes };
+         case 'conflict':
+            return { status: 'conflict', conflict, writes };
+         case 'unavailable':
+            await hooks.onUnavailable?.(model, conflict);
+            return { status: 'unavailable', conflict, writes };
+      }
+   }
+}
+
+/** The `ConflictError` the write raised, or `undefined` when it landed. */
+async function persistOrConflict<TModel>(
+   hooks: ReconcileWriteHooks<TModel>,
+   model: TModel,
+   baseVersion: BaseVersion
+): Promise<ConflictError | undefined> {
+   try {
+      await hooks.persist(model, baseVersion);
+      return undefined;
+   } catch (err: unknown) {
+      if (!isConflictError(err)) {
+         throw err;
+      }
+      return err;
+   }
+}

package/src/rpc/README.md

@@ -1,9 +1,8 @@
 # JSON-RPC primitives
 
 Exported from the package root, `@hydranium/protocol`. There is no
-`@hydranium/protocol/rpc` subpath: the package's `exports` map publishes `.`,
-`./client`, `./data` and `./testing` (plus their `./lib/*` twins), so importing
-this directory by path fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
+`@hydranium/protocol/rpc` subpath: the package's `exports` map declares none,
+so importing this directory by path fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
 
 Generic JSON-RPC primitives for typed protocol heads over a vscode-jsonrpc
 `MessageConnection`. This page is the reference; the shape of the pattern and
@@ -44,8 +43,8 @@ data-server head ships with `'data-server/'` by default; adopters that
 combine the data-server with their own protocol head under one prefix pass
 their adopter namespace (e.g. `'myapp/'`) on both sides.
 
-Trailing-slash discipline is the adopter's responsibility — `'foo'` is a
-literal prefix, not interpreted as a namespace segment.
+A namespace ends in `/` or is empty: `bindRpcMethods` and `createRpcProxy`
+throw a `TypeError` for `'foo'`.
 
 ### Notification discrimination: `isNotification`
 

package/src/rpc/bind-rpc-methods.ts

@@ -7,7 +7,8 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import type { MessageConnection } from 'vscode-jsonrpc';
+import { ResponseError, type MessageConnection } from 'vscode-jsonrpc';
+import { isResponseError } from '../errors';
 import type { LatencyCollector } from '../latency-collector';
 import { type Disposable, DisposableCollection } from '../util';
 import { defaultIsNotification } from './create-rpc-proxy';
@@ -70,6 +71,44 @@ export interface BindRpcMethodsOptions {
     * Requests and notifications are both timed. Absent by default (no overhead).
     */
    readonly latency?: LatencyCollector;
+
+   /**
+    * Produce the `message` an outgoing rejection carries, so a user-facing
+    * error is rendered by the side that knows the reading user's language.
+    * Applied at this one chokepoint, which is what covers a caller's
+    * additional methods as well as the framework's own.
+    *
+    * Only a `ResponseError` is routed through it — a plain `Error` carries no
+    * identity to render from, and rewriting its message would relabel a
+    * developer-facing failure as a translated one. The rejection is
+    * RECONSTRUCTED rather than mutated, because the thrown value may be a
+    * shared constant; nothing is lost, since only `code`, `message` and `data`
+    * cross the wire and `instanceof` does not survive reconstruction anyway.
+    *
+    * Notifications are not covered, and "they have no reply channel" is only
+    * half the reason — a notification's own PAYLOAD can carry prose. What makes
+    * this sound is where that prose comes from: the only user-facing text on
+    * the data head's client surface is the diagnostics riding the
+    * document-updated and document-saved events, and those are read off
+    * `LangiumDocument.diagnostics`, which the document builder has already
+    * rendered at `Validated`. So they arrive rendered rather than escaping
+    * unrendered. A notification that ever carries prose of its OWN needs its
+    * own render at the raise site, as GLSP's actions do.
+    */
+   readonly renderErrorMessage?: (error: ResponseError<unknown>) => string;
+}
+
+/**
+ * The rejection to throw in place of `err`. A `ResponseError` from another copy
+ * of `vscode-jsonrpc` is rebuilt on this package's, since a connection keeps the
+ * code only of its own copy's errors; one from this copy is thrown as is, so a
+ * subclass keeps its `toJson`, unless `render` rewrites its message.
+ */
+function renderRejection(err: unknown, render?: (error: ResponseError<unknown>) => string): unknown {
+   if (!isResponseError(err) || (!render && err instanceof ResponseError)) {
+      return err;
+   }
+   return new ResponseError(err.code, render ? render(err) : err.message, err.data);
 }
 
 /**
@@ -91,8 +130,14 @@ export interface BindRpcMethodsOptions {
  *
  * Errors thrown synchronously from a request handler — or surfaced as a
  * rejected promise — propagate back to the caller through vscode-jsonrpc's
- * standard error envelope. Errors from a notification handler cannot, and are
- * routed to {@link BindRpcMethodsOptions.onNotificationError} instead.
+ * standard error envelope, its message rendered when
+ * {@link BindRpcMethodsOptions.renderErrorMessage} is supplied. A
+ * `ResponseError` from another copy of `vscode-jsonrpc` is rebuilt on this
+ * package's copy, so its code and data reach the caller when `connection` comes
+ * from that copy too, as the framework's own connections do; over a connection
+ * from another copy the caller receives a generic `InternalError`. Errors from a
+ * notification handler cannot propagate, and are routed to
+ * {@link BindRpcMethodsOptions.onNotificationError} instead.
  *
  * Accepts either a ready connection or a `Promise<MessageConnection>` —
  * registrations queue until the connection resolves, then attach. The
@@ -154,7 +199,17 @@ export function bindRpcMethods<T extends object>(
                })
             );
          } else {
-            disposables.push(resolved.onRequest(wireName, async (params: unknown) => dispatch(params)));
+            const render = options.renderErrorMessage;
+            disposables.push(
+               resolved.onRequest(wireName, async (params: unknown) => {
+                  try {
+                     // Awaited inside the try, or a rejected promise escapes it.
+                     return await dispatch(params);
+                  } catch (err: unknown) {
+                     throw renderRejection(err, render);
+                  }
+               })
+            );
          }
       }
    };

package/src/rpc/create-rpc-proxy.ts

@@ -8,6 +8,7 @@
  ********************************************************************************/
 
 import { Emitter, type Event, type MessageConnection } from 'vscode-jsonrpc';
+import { reviveProtocolError } from '../errors';
 import { type BindRpcMethodsOptions, bindRpcMethods } from './bind-rpc-methods';
 import { assertValidMethodNamespace } from './wire-prefix';
 
@@ -136,6 +137,14 @@ export interface CreateRpcProxyOptions<TLocal extends object = never> {
     * `bindRpcMethods` call) still capture per-method latency. Absent by default.
     */
    readonly latency?: BindRpcMethodsOptions['latency'];
+
+   /**
+    * Forwarded to the inbound {@link localTarget} binding: renders the message
+    * an outgoing rejection carries. Only the inbound direction has rejections
+    * to render — the outbound proxy is this side making requests, and a
+    * rejection it receives was rendered by whoever answered.
+    */
+   readonly renderErrorMessage?: BindRpcMethodsOptions['renderErrorMessage'];
 }
 
 /**
@@ -190,6 +199,9 @@ function assertSingleArg(wireName: string, args: unknown[]): void {
  * params, results and errors, and a second layer here would double every
  * traced line.
  *
+ * A rejection whose code names one of the framework's typed errors is rethrown
+ * as that class, through {@link reviveProtocolError}.
+ *
  * Accepts either a ready connection or a `Promise<MessageConnection>` —
  * proxy methods called before the promise resolves queue until it does,
  * then dispatch, so adopters can wire the proxy before its underlying
@@ -225,7 +237,12 @@ export function createRpcProxy<T extends object, TLocal extends object = never>(
    // connection; see `localTarget` for why no `Disposable` is surfaced.
    const { localTarget, localMethods } = options;
    if (localTarget && localMethods && localMethods.length > 0) {
-      const binding = bindRpcMethods(connection, localTarget, localMethods, { methodNamespace, isNotification, latency: options.latency });
+      const binding = bindRpcMethods(connection, localTarget, localMethods, {
+         methodNamespace,
+         isNotification,
+         latency: options.latency,
+         renderErrorMessage: options.renderErrorMessage
+      });
       resolvedConnection.then(conn => conn.onClose(() => binding.dispose())).catch(() => undefined);
    }
 
@@ -280,7 +297,8 @@ export function createRpcProxy<T extends object, TLocal extends object = never>(
             const capturedError = new Error(`RPC request '${wireName}' failed`);
             return resolvedConnection
                .then(connection => connection.sendRequest(wireName, args[0]))
-               .catch((err: unknown) => {
+               .catch((rejection: unknown) => {
+                  const err = reviveProtocolError(rejection);
                   if (err instanceof Error && capturedError.stack) {
                      err.stack = `${err.stack ?? err.message}\nCaused by request from:\n${capturedError.stack}`;
                   }

package/src/rpc/index.ts

@@ -13,4 +13,5 @@
 
 export * from './bind-rpc-methods';
 export * from './create-rpc-proxy';
+export * from './send-by-method-name';
 export * from './wire-prefix';

package/src/rpc/send-by-method-name.ts

@@ -0,0 +1,140 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { CancellationToken } from 'vscode-jsonrpc';
+
+/**
+ * `connection` with `sendRequest` and `sendNotification` sending a typed message
+ * by its method name, so it survives a message type built by another copy of
+ * `vscode-jsonrpc`. Wrap a connection wherever it is handed to code that sends
+ * another copy's typed messages, GLSP's clients and launchers in particular.
+ *
+ * **Why an install holds several copies.** Upstream pins exactly:
+ * - `@eclipse-glsp/*` 2.x pin `vscode-jsonrpc` `8.2.0`, and npm can nest a copy
+ *   under each GLSP package, so GLSP's packages can split from each other: a
+ *   connection one of them creates rejects the typed messages another builds.
+ *   GLSP's upgrade to 9.x, which could let it share the framework's copy, is
+ *   open as https://github.com/eclipse-glsp/glsp/issues/1720.
+ * - `vscode-languageserver@10.0.1` pins `vscode-languageserver-protocol`
+ *   `3.18.1`, which pins `vscode-jsonrpc` `9.0.0`.
+ * - Theia brings protocol `3.17.5` and with it `vscode-jsonrpc` 8.
+ *
+ * npm hoists one version per name and nests the rest. `overrides` are read from
+ * the root manifest alone and never ship with a package, so the framework cannot
+ * collapse an adopter's tree.
+ *
+ * **What breaks across copies.**
+ * - Sending: a connection compares a typed message's parameter structure with
+ *   its own copy's `ParameterStructures.auto` singleton by identity, so a
+ *   `RequestType` or `NotificationType` built by another copy throws
+ *   `Unknown parameter structure auto`. GLSP sends typed messages, in
+ *   `BaseJsonrpcGLSPClient` and in `JsonrpcClientProxy.process`.
+ *   `vscode-languageserver`'s connection resends by method name already, which
+ *   is why LSP sends are unaffected.
+ * - Types: `ParameterStructures` has a private member, so TypeScript treats each
+ *   copy's `MessageConnection` as a different type.
+ * - Errors: a connection keeps a thrown `ResponseError`'s code and data only
+ *   when the error is an instance of its own copy's class, and sends a returned
+ *   one of another copy as a successful result.
+ *
+ * **What is copy-safe.** Receiving a typed message from another copy, since the
+ * receive path compares only against its own `byName` and `byPosition`. With
+ * sends by method name, the LSP, data and GLSP heads run over a tree whose GLSP
+ * packages keep `vscode-jsonrpc` `8.2.0`.
+ *
+ * **How it works.** A `Proxy` whose `sendRequest` and `sendNotification` pass the
+ * typed message's `method` string; every other member is the connection's own.
+ * The parameters go out as the typed send packs them: the first
+ * `numberOfParams`, missing ones `null`, and a request's cancellation token
+ * from the position after them. Sent by method name, a single parameter goes by
+ * name when it is an object and by position otherwise, which matches `auto` and
+ * `byName` with an object, as `vscode-languageserver-protocol`'s types use it. A
+ * `byPosition` object or a `byName` non-object throws rather than going out in
+ * another shape, the packing read from the type's `toString()` since it cannot
+ * be compared by identity. So wrapping narrows what a connection accepts: its
+ * own copy sends such a type unwrapped. The result is typed as whichever copy's
+ * connection its context expects, or as `connection`'s own type without one.
+ * That type is the caller's assertion: it holds for the members both copies
+ * share, since the sends go by name and the receives are copy-safe.
+ *
+ * **Where it stops.** Errors: a rejection it produces is still its own copy's
+ * `ResponseError`, so recognise errors with `isResponseError`, and build a
+ * connection whose errors must keep their code from the framework's copy.
+ *
+ * See https://github.com/eclipse-emfcloud/hydranium/issues/279.
+ */
+export function sendByMethodName<
+   In extends {
+      sendRequest<R>(method: string, ...params: unknown[]): Promise<R>;
+      sendNotification(method: string, ...params: unknown[]): Promise<void>;
+   },
+   Out extends {
+      sendRequest<R>(method: string, ...params: unknown[]): Promise<R>;
+      sendNotification(method: string, ...params: unknown[]): Promise<void>;
+   } = In
+>(connection: In): Out {
+   const sendRequest = (type: string | TypedMessage, ...params: unknown[]) =>
+      typeof type === 'string'
+         ? connection.sendRequest(type, ...params)
+         : connection.sendRequest(type.method, ...argsOf(type, params, true));
+   const sendNotification = (type: string | TypedMessage, ...params: unknown[]) =>
+      typeof type === 'string'
+         ? connection.sendNotification(type, ...params)
+         : connection.sendNotification(type.method, ...argsOf(type, params, false));
+   const wrapped: Pick<In, 'sendRequest' | 'sendNotification'> = new Proxy(connection, {
+      get(target, property, receiver) {
+         if (property === 'sendRequest') {
+            return sendRequest;
+         }
+         if (property === 'sendNotification') {
+            return sendNotification;
+         }
+         return Reflect.get(target, property, receiver);
+      }
+   });
+   // Typed as the connection its context expects, which the doc above justifies.
+   return wrapped as Out;
+}
+
+/** A typed message as any copy of `vscode-jsonrpc` builds it, read by shape rather than identity. */
+interface TypedMessage {
+   readonly method: string;
+   readonly numberOfParams: number;
+   readonly parameterStructures: { toString(): string };
+}
+
+/** Whether `vscode-jsonrpc` sends `param` by name under `auto`. */
+function isNamedParam(param: unknown): boolean {
+   return param !== undefined && param !== null && !Array.isArray(param) && typeof param === 'object';
+}
+
+/**
+ * The arguments that send `type` by method name with the typed send's params:
+ * the first `numberOfParams` of `params`, missing ones `null`, then a request's
+ * cancellation token, which the typed send takes from that position. A request
+ * always ends in a token, `CancellationToken.None` when it has none, since a
+ * send by method name takes a token-shaped last argument for its token. Throws
+ * for the one-parameter packing a send by method name cannot express.
+ */
+function argsOf(type: TypedMessage, params: unknown[], isRequest: boolean): unknown[] {
+   const args = Array.from({ length: type.numberOfParams }, (_, i) => (i < params.length ? params[i] : null));
+   if (type.numberOfParams === 1) {
+      const packing = String(type.parameterStructures);
+      if ((packing === 'byPosition' && isNamedParam(args[0])) || (packing === 'byName' && !isNamedParam(args[0]))) {
+         throw new Error(
+            `sendByMethodName cannot send '${type.method}' ${packing}: by method name, a single object goes by name and anything else by position.`
+         );
+      }
+   }
+   if (!isRequest) {
+      return args;
+   }
+   const token = params[type.numberOfParams];
+   return [...args, CancellationToken.is(token) ? token : CancellationToken.None];
+}

package/src/testing/catalogue-audit.ts

@@ -0,0 +1,111 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { collectMessages } from '../messages/primitives';
+
+/**
+ * Audit a translation catalogue against the codes that actually exist.
+ *
+ * **The one failure mode a catalogue has, and the only one nothing else
+ * catches.** A key naming no declared code falls back to the English — which is
+ * byte-identical to a deliberate omission, so a typo is invisible at runtime and
+ * indistinguishable from the partial-catalogue behaviour every adopter relies
+ * on. Nothing on the render path can tell them apart, `theia nls-extract`
+ * reports what the SOURCE declares rather than whether a catalogue matches it,
+ * and the framework's own gates see only the framework's own files.
+ *
+ * Shipped as test support rather than as a runtime check on purpose: an
+ * orphaned key is an authoring mistake, and failing a server boot over one would
+ * take a running product down for a cosmetic defect.
+ */
+
+/**
+ * Flatten a nested catalogue into the `/`-joined keys a message code is spelled
+ * with, dropping `_`-prefixed keys as notes to a human reader.
+ *
+ * Nesting is a HOST convention, not the framework's: Theia flattens a nested
+ * catalogue by joining keys with `/`, which is the separator a code already
+ * uses, so an adopter on that host writes the file nested and one handed
+ * straight to a `DefaultMessageRenderer` writes it flat. Both end up here.
+ *
+ * `_`-prefixed keys are dropped by PREFIX rather than by matching one literal
+ * name, so a second note added to a file cannot silently become a catalogue
+ * entry. A code is three `/`-separated segments, so no real entry can begin
+ * with `_`.
+ */
+export function flattenCatalogue(catalogue: Record<string, unknown>, prefix = ''): Record<string, string> {
+   const flat: Record<string, string> = {};
+   for (const [key, value] of Object.entries(catalogue)) {
+      if (key.startsWith('_')) {
+         continue;
+      }
+      const joined = prefix ? `${prefix}/${key}` : key;
+      if (typeof value === 'string') {
+         flat[joined] = value;
+      } else if (typeof value === 'object' && value !== null) {
+         Object.assign(flat, flattenCatalogue(value as Record<string, unknown>, joined));
+      }
+   }
+   return flat;
+}
+
+/** Options for {@link findUndeclaredCodes}. */
+export interface CatalogueAuditOptions {
+   /**
+    * Key prefixes to skip, for entries whose codes are NOT declared through a
+    * `defineMessage` barrel.
+    *
+    * The real case is a host's own mechanism: Theia's `nls.localize` takes its
+    * key as an inline literal at the call site, so those keys exist only in
+    * source text and no barrel can enumerate them. Keep this as narrow as the
+    * host layer actually is — exempting a namespace is exempting every typo in
+    * it, which is what this function exists to find.
+    */
+   readonly exemptPrefixes?: readonly string[];
+}
+
+/**
+ * Every catalogue key that names no code any of `barrels` declares.
+ *
+ * Barrels are taken as opaque objects and read with {@link collectMessages},
+ * which is what lets a caller pass a `import * as messages` namespace directly:
+ * a barrel's value type is a union of its declarations AND its functions, and
+ * filtering that union will not narrow to a `MessageDefinition`.
+ *
+ * Returns the offending keys rather than a boolean, so a failing assertion names
+ * WHICH key is wrong — a count says only that something is.
+ */
+export function findUndeclaredCodes(
+   catalogueKeys: readonly string[],
+   barrels: readonly object[],
+   options: CatalogueAuditOptions = {}
+): string[] {
+   const declared = new Set(barrels.flatMap(barrel => collectMessages(barrel).map(message => message.code)));
+   const exempt = options.exemptPrefixes ?? [];
+   return catalogueKeys.filter(key => !exempt.some(prefix => key.startsWith(prefix)) && !declared.has(key));
+}
+
+/**
+ * Keys present in more than one catalogue — the shape a split catalogue rots
+ * into.
+ *
+ * Exactly one side renders a given message, so two catalogues holding one code
+ * are two authorities over one sentence and they diverge on the first reword.
+ * Nothing at runtime notices: both sides render, and whichever ran last wins on
+ * its own surface.
+ *
+ * Takes the key sets rather than a boolean answer for the same reason as
+ * {@link findUndeclaredCodes}, and reports NOTHING when a set is empty — an
+ * empty catalogue shares no key with anything, so a caller must assert
+ * non-emptiness separately or a failed read passes this vacuously.
+ */
+export function findSharedCodes(first: readonly string[], second: readonly string[]): string[] {
+   const other = new Set(second);
+   return first.filter(key => other.has(key));
+}