@keyneom/sync-kit 0.2.0-rc.0 → 0.2.0-rc.10

package/README.md

@@ -36,9 +36,9 @@ Version `0.1.1` was published to npm on 2026-06-30. It removes the
 application-specific runtime presets from `0.1.0` and keeps compatibility
 profiles consumer-owned.
 
-The current worktree is the unpublished `0.2.0-rc.0` sharing release
-candidate. Publication remains gated on live Google validation and one
-external consumer integration.
+Version `0.2.0-rc.1` publishes shared encrypted backups, Tier A background
+detection helpers, and the Android sharing port. Live Google validation and
+one external consumer integration remain release gates for a stable `0.2.0`.
 
 The tests in this repository cover frozen compatibility vectors, mocked
 browser providers, package orchestration, and installation/imports from the
@@ -115,11 +115,12 @@ Available exports:
 - `/snapshot` — serialized snapshot synchronization
 - `/snapshot/lifecycle` — opt-in browser lifecycle binding
 - `/sharing` — browser-independent shared-backup protocol types, validation,
-  roles, invitations, and signed multi-recipient envelopes
+  roles, invitations, signed multi-recipient envelopes, and join-link helpers
 - `/sharing/web-crypto` — P-256 identities, ECDH key grants, signed revisions,
   invitation/key-response proofs, and decryption
 - `/sharing/controller` — headless multi-dataset orchestration, owner pinning,
-  serialized writes, exchange processing, roles, and revocation
+  serialized writes, exchange processing, roles, revocation, Drive permission
+  reconciliation, and optional IndexedDB registry persistence
 - `/sharing/web-passkey` — passkey-encrypted sharing identities with
   non-extractable runtime keys and optional IndexedDB ciphertext storage
 - `/sharing/account-binding` — backendless Google ID-token and WebAuthn
@@ -131,7 +132,8 @@ Available exports:
 - `/auth/google-web/identity` — uncached nonce-bound Google ID tokens for
   account-binding exchanges
 - `/stores/google-drive` — low-level `appDataFolder` objects, a typed snapshot
-  wrapper, and normal-Drive folder/per-file stores
+  wrapper, normal-Drive folder/per-file stores, folder-name helpers, and
+  accessible app-folder discovery
 - `/stores/google-drive/sharing` — managed app/exchange folders, conditional
   dataset writes, provenance checks, and per-dataset permissions
 - `/stores/google-drive/picker` — explicit folder Picker and Drive Open-with
@@ -182,7 +184,8 @@ not.
 - **Android:** `com.keyneom:sync-kit-android` (module `android/synckit`) provides
   private v1 snapshot crypto, `SnapshotSyncController`, Drive `appDataFolder`
   storage, and Credential Manager passkey PRF — the same contracts as the npm
-  `/crypto`, `/snapshot`, and appData store paths. See
+  `/crypto`, `/snapshot`, and appData store paths. Published to
+  [GitHub Packages](https://github.com/keyneom/sync-kit/packages). See
   [android-library.md](docs/android-library.md).
 - Shared backups (`/sharing`) are TypeScript-only for now.
 - React Native and other JavaScript-native runtimes can inject a
@@ -229,10 +232,11 @@ metadata, and ciphertext to app participants while cryptographic grants control
 decryption. Applications needing metadata isolation can instead use direct file
 sharing or limited-access subfolders.
 
-See the [protocol and threat model](docs/shared-backups.md) and
-[authoritative implementation handoff](docs/sharing-implementation-handoff.md).
-The phased gates remain in the
-[sharing execution plan](docs/sharing-execution-plan.md). The crypto and
+See the [protocol and threat model](docs/shared-backups.md),
+[authoritative implementation handoff](docs/sharing-implementation-handoff.md),
+[consumer responsibilities](docs/consumer-responsibilities.md), and
+[background notifications](docs/background-notifications.md). The phased gates
+remain in the [sharing execution plan](docs/sharing-execution-plan.md). The crypto and
 per-file transport, Picker, protected identity, account binding, signed
 ancestry/fork policy, key rotation, and controller primitives are implemented.
 The same sharing fixture is consumed by Java, and the packed package completes

package/dist/auth/google-web/cache.d.ts

@@ -0,0 +1,46 @@
+import type { Authorization, AuthorizationProvider } from "../../core/types.js";
+export type CachedAuthorizationRecord = {
+    profileId: string;
+    accessToken: string;
+    expiresAt: number;
+    accountHint?: string;
+};
+/**
+ * Opt-in persistence for short-lived Google access tokens used by Tier A
+ * background polling. Not enabled by default; memory-only auth remains the
+ * default policy.
+ */
+export declare class IndexedDbAuthorizationCache {
+    private readonly options;
+    constructor(options?: {
+        databaseName?: string;
+        storeName?: string;
+        indexedDB?: IDBFactory;
+    });
+    load(profileId: string): Promise<CachedAuthorizationRecord | null>;
+    save(record: CachedAuthorizationRecord): Promise<void>;
+    delete(profileId: string): Promise<void>;
+    private transaction;
+    private open;
+    private storeName;
+}
+export type CachingAuthorizationProviderOptions = {
+    profileId: string;
+    inner: AuthorizationProvider<Authorization>;
+    cache: IndexedDbAuthorizationCache;
+    accountHint?: string;
+    expirySkewMs?: number;
+    now?: () => number;
+};
+/**
+ * Wraps an authorization provider and mirrors valid access tokens into the
+ * opt-in IndexedDB cache for service-worker polling.
+ */
+export declare class CachingAuthorizationProvider implements AuthorizationProvider<Authorization> {
+    private readonly options;
+    constructor(options: CachingAuthorizationProviderOptions);
+    authorize(): Promise<Authorization>;
+    authorizeFromCache(): Promise<Authorization | null>;
+    clear(): void;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/auth/google-web/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,UAAU,CAAC;KACnB;IAGF,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAelE,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,WAAW;IAoBzB,OAAO,CAAC,IAAI;IAoCZ,OAAO,CAAC,SAAS;CAGlB;AAED,MAAM,MAAM,mCAAmC,GAAG;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC5C,KAAK,EAAE,2BAA2B,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,qBAAa,4BACX,YAAW,qBAAqB,CAAC,aAAa,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,mCAAmC;IAEnE,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAmBnC,kBAAkB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAezD,KAAK,IAAI,IAAI;CAId"}

package/dist/auth/google-web/cache.js

@@ -0,0 +1,111 @@
+import { SyncKitError } from "../../core/errors.js";
+/**
+ * Opt-in persistence for short-lived Google access tokens used by Tier A
+ * background polling. Not enabled by default; memory-only auth remains the
+ * default policy.
+ */
+export class IndexedDbAuthorizationCache {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async load(profileId) {
+        const stored = await this.transaction("readonly", (store) => store.get(profileId));
+        if (!stored || typeof stored !== "object")
+            return null;
+        const record = stored;
+        if (typeof record.accessToken !== "string" ||
+            typeof record.expiresAt !== "number") {
+            return null;
+        }
+        return structuredClone(record);
+    }
+    async save(record) {
+        await this.transaction("readwrite", (store) => store.put(structuredClone(record)));
+    }
+    async delete(profileId) {
+        await this.transaction("readwrite", (store) => store.delete(profileId));
+    }
+    async transaction(mode, operation) {
+        const database = await this.open();
+        return new Promise((resolve, reject) => {
+            const transaction = database.transaction(this.storeName(), mode);
+            const request = operation(transaction.objectStore(this.storeName()));
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new SyncKitError("state", "IndexedDB authorization cache failed.", {
+                cause: request.error,
+            }));
+            transaction.oncomplete = () => database.close();
+            transaction.onabort = () => database.close();
+        });
+    }
+    open() {
+        const indexedDBImplementation = this.options.indexedDB ??
+            (typeof indexedDB === "undefined" ? undefined : indexedDB);
+        if (!indexedDBImplementation) {
+            return Promise.reject(new SyncKitError("configuration", "IndexedDB is required for authorization cache storage."));
+        }
+        return new Promise((resolve, reject) => {
+            const request = indexedDBImplementation.open(this.options.databaseName ?? "sync-kit-auth-cache", 1);
+            request.onupgradeneeded = () => {
+                if (!request.result.objectStoreNames.contains(this.storeName())) {
+                    request.result.createObjectStore(this.storeName(), {
+                        keyPath: "profileId",
+                    });
+                }
+            };
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new SyncKitError("state", "IndexedDB authorization cache could not be opened.", { cause: request.error }));
+        });
+    }
+    storeName() {
+        return this.options.storeName ?? "google-authorization";
+    }
+}
+/**
+ * Wraps an authorization provider and mirrors valid access tokens into the
+ * opt-in IndexedDB cache for service-worker polling.
+ */
+export class CachingAuthorizationProvider {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async authorize() {
+        const authorization = await this.options.inner.authorize();
+        const now = this.options.now?.() ?? Date.now();
+        const skew = this.options.expirySkewMs ?? 60_000;
+        const expiresAt = authorization.expiresAt ?? now + 3_600_000;
+        if (expiresAt > now + skew) {
+            await this.options.cache.save({
+                profileId: this.options.profileId,
+                accessToken: authorization.accessToken,
+                expiresAt,
+                ...(this.options.accountHint
+                    ? { accountHint: this.options.accountHint }
+                    : {}),
+            });
+        }
+        return authorization;
+    }
+    async authorizeFromCache() {
+        const record = await this.options.cache.load(this.options.profileId);
+        if (!record)
+            return null;
+        const now = this.options.now?.() ?? Date.now();
+        const skew = this.options.expirySkewMs ?? 60_000;
+        if (record.expiresAt <= now + skew) {
+            await this.options.cache.delete(this.options.profileId);
+            return null;
+        }
+        return {
+            accessToken: record.accessToken,
+            expiresAt: record.expiresAt,
+        };
+    }
+    clear() {
+        this.options.inner.clear();
+        void this.options.cache.delete(this.options.profileId);
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/auth/google-web/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/auth/google-web/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AASpD;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAEnB;IADnB,YACmB,UAIb,EAAE;QAJW,YAAO,GAAP,OAAO,CAIlB;IACL,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,MAAmC,CAAC;QACnD,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAiC;QAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAwB,EACxB,SAAmD;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,YAAY,CAAC,OAAO,EAAE,uCAAuC,EAAE;gBACjE,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CACH,CAAC;YACJ,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChD,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI;QACV,MAAM,uBAAuB,GAC3B,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CACd,eAAe,EACf,wDAAwD,CACzD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,EAClD,CAAC,CACF,CAAC;YACF,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;oBAChE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;wBACjD,OAAO,EAAE,WAAW;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,YAAY,CACd,OAAO,EACP,oDAAoD,EACpD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CACF,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC1D,CAAC;CACF;AAWD;;;GAGG;AACH,MAAM,OAAO,4BAA4B;IAGV;IAA7B,YAA6B,OAA4C;QAA5C,YAAO,GAAP,OAAO,CAAqC;IAAG,CAAC;IAE7E,KAAK,CAAC,SAAS;QACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;QACjD,MAAM,SAAS,GACb,aAAa,CAAC,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC;QAC7C,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS;gBACT,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;oBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;QACjD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/sharing/appdata-identity-store.d.ts

@@ -0,0 +1,36 @@
+import type { Authorization } from "../core/types.js";
+import { GoogleDriveAppDataStore } from "../stores/google-drive/index.js";
+import { type ProtectedSharingIdentityStore, type ProtectedSharingIdentityV1 } from "./web-passkey.js";
+export type DriveAppDataProtectedSharingIdentityStoreOptions = {
+    /**
+     * Supplies a Drive authorization scoped to `drive.appdata`. The same Google
+     * account on any device returns the same private app-data folder, which is
+     * how a single sharing identity follows the user across devices.
+     */
+    authorization(): Promise<Authorization>;
+    /** Overrides the app-data filename derived from the app id. */
+    filename?(appId: string): string;
+    drive?: GoogleDriveAppDataStore;
+};
+/**
+ * Hosts the passkey-wrapped sharing identity in the signed-in Google account's
+ * private `drive.appdata` folder instead of device-local storage. Because the
+ * record is already AES-GCM-encrypted with the passkey PRF secret, app-data is
+ * a plaintext-safe transport: Drive only ever sees an opaque JSON blob whose
+ * `encryptedPrivateKeys` field it cannot read.
+ *
+ * The single-user, multi-device continuity this restores is deliberately
+ * distinct from the sharing (multi-user) protocol: the identity here is one
+ * account's own key, replicated to its own devices, never granted to another
+ * participant.
+ */
+export declare class DriveAppDataProtectedSharingIdentityStore implements ProtectedSharingIdentityStore {
+    private readonly options;
+    private readonly drive;
+    constructor(options: DriveAppDataProtectedSharingIdentityStoreOptions);
+    load(appId: string): Promise<ProtectedSharingIdentityV1 | null>;
+    save(record: ProtectedSharingIdentityV1): Promise<void>;
+    delete(appId: string): Promise<void>;
+    private filename;
+}
+//# sourceMappingURL=appdata-identity-store.d.ts.map

package/dist/sharing/appdata-identity-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appdata-identity-store.d.ts","sourceRoot":"","sources":["../../src/sharing/appdata-identity-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAChC,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,gDAAgD,GAAG;IAC7D;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,yCACX,YAAW,6BAA6B;IAKtC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;gBAG7B,OAAO,EAAE,gDAAgD;IAKtE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAQ/D,IAAI,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1C,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/sharing/appdata-identity-store.js

@@ -0,0 +1,49 @@
+import { GoogleDriveAppDataStore } from "../stores/google-drive/index.js";
+import { parseProtectedSharingIdentityV1, } from "./web-passkey.js";
+/**
+ * Hosts the passkey-wrapped sharing identity in the signed-in Google account's
+ * private `drive.appdata` folder instead of device-local storage. Because the
+ * record is already AES-GCM-encrypted with the passkey PRF secret, app-data is
+ * a plaintext-safe transport: Drive only ever sees an opaque JSON blob whose
+ * `encryptedPrivateKeys` field it cannot read.
+ *
+ * The single-user, multi-device continuity this restores is deliberately
+ * distinct from the sharing (multi-user) protocol: the identity here is one
+ * account's own key, replicated to its own devices, never granted to another
+ * participant.
+ */
+export class DriveAppDataProtectedSharingIdentityStore {
+    options;
+    drive;
+    constructor(options) {
+        this.options = options;
+        this.drive = options.drive ?? new GoogleDriveAppDataStore();
+    }
+    async load(appId) {
+        const authorization = await this.options.authorization();
+        const found = await this.drive.find(this.filename(appId), authorization);
+        if (!found)
+            return null;
+        const text = await this.drive.readText(found.fileId, authorization);
+        return parseProtectedSharingIdentityV1(text);
+    }
+    async save(record) {
+        const authorization = await this.options.authorization();
+        const name = this.filename(record.appId);
+        const found = await this.drive.find(name, authorization);
+        await this.drive.write(name, JSON.stringify(record), authorization, {
+            ...(found ? { existingId: found.fileId } : {}),
+            contentType: "application/json",
+        });
+    }
+    async delete(appId) {
+        const authorization = await this.options.authorization();
+        const found = await this.drive.find(this.filename(appId), authorization);
+        if (found)
+            await this.drive.delete(found.fileId, authorization);
+    }
+    filename(appId) {
+        return (this.options.filename?.(appId) ?? `sync-kit-sharing-identity-${appId}.json`);
+    }
+}
+//# sourceMappingURL=appdata-identity-store.js.map

package/dist/sharing/appdata-identity-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appdata-identity-store.js","sourceRoot":"","sources":["../../src/sharing/appdata-identity-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EACL,+BAA+B,GAGhC,MAAM,kBAAkB,CAAC;AAc1B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yCAAyC;IAMjC;IAHF,KAAK,CAA0B;IAEhD,YACmB,OAAyD;QAAzD,YAAO,GAAP,OAAO,CAAkD;QAE1E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,uBAAuB,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACpE,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkC;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE;YAClE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClE,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,6BAA6B,KAAK,OAAO,CAC5E,CAAC;IACJ,CAAC;CACF"}

package/dist/sharing/change-detector.d.ts

@@ -0,0 +1,40 @@
+import type { SharingChangeDetectionResult, SharingSyncCheckpoint, SharedDatasetHead } from "./checkpoint.js";
+export type { SharedDatasetHead, SharingChangeDetectionResult, SharingNotificationEvent, SharingSyncCheckpoint, } from "./checkpoint.js";
+export type SharingChangeDetectorOptions = {
+    now?: () => Date;
+    tokenExpiresAt?: number;
+    tokenExpiringSoonMs?: number;
+};
+/**
+ * Metadata-only poll for Tier A notifications. Does not decrypt, sign, or
+ * mutate Drive state.
+ */
+export declare function detectSharingChanges(listKeyResponses: () => Promise<readonly {
+    fileId: string;
+    exchangeId: string;
+}[]>, listDatasetHeads: () => Promise<readonly SharedDatasetHead[]>, checkpoint: SharingSyncCheckpoint, options?: SharingChangeDetectorOptions): Promise<SharingChangeDetectionResult>;
+export declare class SharingChangeDetector {
+    private readonly options;
+    constructor(options: {
+        listKeyResponses: () => Promise<readonly {
+            fileId: string;
+            exchangeId: string;
+        }[]>;
+        listDatasetHeads: () => Promise<readonly SharedDatasetHead[]>;
+        tokenExpiresAt?: () => number | undefined;
+        now?: () => Date;
+        tokenExpiringSoonMs?: number;
+    });
+    detect(checkpoint: SharingSyncCheckpoint): Promise<SharingChangeDetectionResult>;
+}
+export declare function createSharingChangeDetectorFromTransport(transport: {
+    listExchanges(options?: {
+        kind?: "invitation" | "key-response";
+    }): Promise<readonly {
+        fileId: string;
+        exchangeId: string;
+        kind: string;
+    }[]>;
+    listDatasetHeads(): Promise<readonly SharedDatasetHead[]>;
+}, options?: Omit<ConstructorParameters<typeof SharingChangeDetector>[0], "listKeyResponses" | "listDatasetHeads">): SharingChangeDetector;
+//# sourceMappingURL=change-detector.d.ts.map

package/dist/sharing/change-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-detector.d.ts","sourceRoot":"","sources":["../../src/sharing/change-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAE5B,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAWzB,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,MAAM,OAAO,CAC7B,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CAClD,EACD,gBAAgB,EAAE,MAAM,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,EAC7D,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,4BAA4B,CAAC,CAuDvC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE;QACxB,gBAAgB,EAAE,MAAM,OAAO,CAC7B,SAAS;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,EAAE,CAClD,CAAC;QACF,gBAAgB,EAAE,MAAM,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;QAC9D,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QAC1C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B;IAGH,MAAM,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,4BAA4B,CAAC;CAejF;AAED,wBAAgB,wCAAwC,CACtD,SAAS,EAAE;IACT,aAAa,CAAC,OAAO,CAAC,EAAE;QACtB,IAAI,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;KACtC,GAAG,OAAO,CACT,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAChE,CAAC;IACF,gBAAgB,IAAI,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;CAC3D,EACD,OAAO,GAAE,IAAI,CACX,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,EACtD,kBAAkB,GAAG,kBAAkB,CACnC,GACL,qBAAqB,CAYvB"}

package/dist/sharing/change-detector.js

@@ -0,0 +1,96 @@
+function datasetHeadSignature(head) {
+    return [
+        head.etag ?? "",
+        head.version ?? "",
+        head.headRevisionId ?? "",
+        head.modifiedTime ?? "",
+    ].join("|");
+}
+/**
+ * Metadata-only poll for Tier A notifications. Does not decrypt, sign, or
+ * mutate Drive state.
+ */
+export async function detectSharingChanges(listKeyResponses, listDatasetHeads, checkpoint, options = {}) {
+    const now = options.now ?? (() => new Date());
+    const events = [];
+    const tokenExpiringSoonMs = options.tokenExpiringSoonMs ?? 5 * 60_000;
+    if (options.tokenExpiresAt !== undefined) {
+        if (options.tokenExpiresAt <= now().getTime()) {
+            events.push({ kind: "token-expired" });
+            return {
+                checkpoint: { ...checkpoint, lastPollAt: now().toISOString() },
+                events,
+            };
+        }
+        if (options.tokenExpiresAt - now().getTime() <= tokenExpiringSoonMs) {
+            events.push({
+                kind: "token-expiring-soon",
+                expiresAt: new Date(options.tokenExpiresAt).toISOString(),
+            });
+        }
+    }
+    const seenResponses = new Set(checkpoint.lastSeenKeyResponseFileIds ?? []);
+    const responses = await listKeyResponses();
+    for (const response of responses) {
+        if (!seenResponses.has(response.fileId)) {
+            events.push({
+                kind: "pending-key-response",
+                exchangeId: response.exchangeId,
+                fileId: response.fileId,
+            });
+        }
+    }
+    const previousHeads = checkpoint.datasetHeads ?? {};
+    const nextHeads = {};
+    const heads = await listDatasetHeads();
+    for (const head of heads) {
+        nextHeads[head.datasetId] = head;
+        const previous = previousHeads[head.datasetId];
+        if (previous &&
+            datasetHeadSignature(previous) !== datasetHeadSignature(head)) {
+            events.push({
+                kind: "shared-dataset-changed",
+                datasetId: head.datasetId,
+                fileId: head.fileId,
+            });
+        }
+    }
+    return {
+        checkpoint: {
+            lastPollAt: now().toISOString(),
+            lastSeenKeyResponseFileIds: responses.map((response) => response.fileId),
+            datasetHeads: nextHeads,
+        },
+        events,
+    };
+}
+export class SharingChangeDetector {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    detect(checkpoint) {
+        const tokenExpiresAt = this.options.tokenExpiresAt?.();
+        return detectSharingChanges(this.options.listKeyResponses, this.options.listDatasetHeads, checkpoint, {
+            ...(this.options.now ? { now: this.options.now } : {}),
+            ...(tokenExpiresAt !== undefined ? { tokenExpiresAt } : {}),
+            ...(this.options.tokenExpiringSoonMs !== undefined
+                ? { tokenExpiringSoonMs: this.options.tokenExpiringSoonMs }
+                : {}),
+        });
+    }
+}
+export function createSharingChangeDetectorFromTransport(transport, options = {}) {
+    return new SharingChangeDetector({
+        listKeyResponses: async () => {
+            const exchanges = await transport.listExchanges({ kind: "key-response" });
+            return exchanges.map((exchange) => ({
+                fileId: exchange.fileId,
+                exchangeId: exchange.exchangeId,
+            }));
+        },
+        listDatasetHeads: () => transport.listDatasetHeads(),
+        ...options,
+    });
+}
+//# sourceMappingURL=change-detector.js.map

package/dist/sharing/change-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-detector.js","sourceRoot":"","sources":["../../src/sharing/change-detector.ts"],"names":[],"mappings":"AAaA,SAAS,oBAAoB,CAAC,IAAuB;IACnD,OAAO;QACL,IAAI,CAAC,IAAI,IAAI,EAAE;QACf,IAAI,CAAC,OAAO,IAAI,EAAE;QAClB,IAAI,CAAC,cAAc,IAAI,EAAE;QACzB,IAAI,CAAC,YAAY,IAAI,EAAE;KACxB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,gBAEC,EACD,gBAA6D,EAC7D,UAAiC,EACjC,UAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,MAAM,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,cAAc,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YACvC,OAAO;gBACL,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;gBAC9D,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,sBAAsB;gBAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,IACE,QAAQ;YACR,oBAAoB,CAAC,QAAQ,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAC7D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;YAC/B,0BAA0B,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxE,YAAY,EAAE,SAAS;SACxB;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IADnB,YACmB,OAQhB;QARgB,YAAO,GAAP,OAAO,CAQvB;IACA,CAAC;IAEJ,MAAM,CAAC,UAAiC;QACtC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QACvD,OAAO,oBAAoB,CACzB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,UAAU,EACV;YACE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAChD,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;SACR,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,wCAAwC,CACtD,SAOC,EACD,UAGI,EAAE;IAEN,OAAO,IAAI,qBAAqB,CAAC;QAC/B,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACpD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/sharing/checkpoint.d.ts

@@ -0,0 +1,32 @@
+export type SharedDatasetHead = {
+    datasetId: string;
+    fileId: string;
+    modifiedTime?: string;
+    version?: string;
+    headRevisionId?: string;
+    etag?: string;
+};
+export type SharingSyncCheckpoint = {
+    lastPollAt?: string;
+    lastSeenKeyResponseFileIds?: string[];
+    datasetHeads?: Record<string, SharedDatasetHead>;
+};
+export type SharingNotificationEvent = {
+    kind: "pending-key-response";
+    exchangeId: string;
+    fileId: string;
+} | {
+    kind: "shared-dataset-changed";
+    datasetId: string;
+    fileId: string;
+} | {
+    kind: "token-expiring-soon";
+    expiresAt: string;
+} | {
+    kind: "token-expired";
+};
+export type SharingChangeDetectionResult = {
+    checkpoint: SharingSyncCheckpoint;
+    events: SharingNotificationEvent[];
+};
+//# sourceMappingURL=checkpoint.d.ts.map

package/dist/sharing/checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../../src/sharing/checkpoint.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,qBAAqB,CAAC;IAClC,MAAM,EAAE,wBAAwB,EAAE,CAAC;CACpC,CAAC"}

package/dist/sharing/checkpoint.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkpoint.js.map

package/dist/sharing/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/sharing/checkpoint.ts"],"names":[],"mappings":""}