@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.153

package/dist/app-host/cloud-copy-persistence.js

@@ -0,0 +1,341 @@
+/** Exact PUBLIC cloud-copy bootstrap outcome protection. Same original platform
+ * KEK, no token/password/epoch/device secret/SAS/r, reset or automatic retry. */
+import { decode, encode } from "../cbor.js";
+import { uuidToBytes } from "../codec.js";
+import { collectionDisplayName } from "./collection-display-name.js";
+export const APP_CLOUD_COPY_OUTCOME_MAX = 264 * 1024 + 256;
+const MAX_PLAIN = 264 * 1024;
+const bad = () => new Error("app cloud copy outcome unavailable; preserve storage and reopen");
+const same = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+const hex = (v) => Array.from(v, (b) => b.toString(16).padStart(2, "0")).join("");
+export class AppWebCloudCopyBootstrapPersistence {
+    source;
+    store;
+    closed = false;
+    key;
+    fields;
+    displayName;
+    current;
+    owned;
+    io;
+    keys;
+    aad;
+    mode;
+    lifetime;
+    constructor(source, receipt, key, store, options) {
+        this.source = source;
+        this.store = store;
+        this.key = key;
+        try {
+            this.mode = options.mode;
+            this.lifetime = options.signal;
+            this.fields = Object.freeze({
+                accountId: source.accountId,
+                connectorId: source.connectorId,
+                deviceId: source.deviceId,
+                installationId: source.installationId,
+                collection: source.collection,
+                purpose: source.purpose,
+                cpOrigin: source.cpOrigin,
+                logOrigin: source.logOrigin,
+                assetSha256: source.assetSha256,
+            });
+            const requestedName = source.displayName;
+            this.displayName = requestedName === undefined ? undefined : collectionDisplayName(requestedName);
+            if ((this.displayName !== undefined && source.purpose !== "create") || requestedName !== this.displayName)
+                throw bad();
+            this.current = source.isCurrent;
+            this.owned = source.installationOwned;
+            this.io = Object.freeze({
+                read: store.read,
+                cas: store.compareAndSet,
+            });
+            const ids = [
+                source.accountId,
+                source.connectorId,
+                source.deviceId,
+                source.installationId,
+                source.collection,
+            ].map(uuidToBytes);
+            if (ids.some((v) => v.every((b) => b === 0)) ||
+                !["create", "join"].includes(source.purpose) ||
+                !["fresh", "existing"].includes(this.mode) ||
+                !/^[0-9a-f]{64}$/.test(source.assetSha256))
+                throw bad();
+            this.keys = Object.freeze([
+                receipt.signPublicKey,
+                receipt.kemPublicKey,
+                receipt.noisePublicKey,
+            ].map((v) => {
+                if (!(v instanceof Uint8Array) ||
+                    v.length !== 32 ||
+                    v.every((b) => b === 0))
+                    throw bad();
+                return new Uint8Array(v);
+            }));
+            if (receipt.connectorId !== source.connectorId ||
+                receipt.deviceId !== source.deviceId ||
+                receipt.installationId !== source.installationId)
+                throw bad();
+            if (typeof globalThis.CryptoKey !== "function" ||
+                !(key instanceof CryptoKey) ||
+                key.type !== "secret" ||
+                key.extractable ||
+                key.algorithm.name !== "AES-GCM" ||
+                key.algorithm.length !== 256 ||
+                key.usages.length !== 2 ||
+                !key.usages.includes("encrypt") ||
+                !key.usages.includes("decrypt"))
+                throw bad();
+            // Full operation/trust/public tuple bound before ANY asynchronous IO/crypto.
+            this.aad = encode([
+                "mdbase/v1/app-cloud-copy-outcome-platform",
+                ...ids,
+                source.purpose,
+                source.cpOrigin,
+                source.logOrigin,
+                source.assetSha256,
+                ...this.keys,
+            ]);
+            this.check(this.lifetime);
+        }
+        catch {
+            throw bad();
+        }
+    }
+    check(signal) {
+        try {
+            if (this.closed ||
+                !this.key ||
+                signal !== this.lifetime ||
+                signal.aborted ||
+                this.source.displayName !== this.displayName ||
+                this.source.isCurrent !== this.current ||
+                this.source.installationOwned !== this.owned ||
+                this.current.call(this.source) !== true ||
+                this.owned.call(this.source) !== true ||
+                this.store.read !== this.io.read ||
+                this.store.compareAndSet !== this.io.cas ||
+                Object.entries(this.fields).some(([k, v]) => this.source[k] !== v))
+                throw bad();
+        }
+        catch {
+            throw bad();
+        }
+    }
+    operation(value) {
+        if (value) {
+            if (value.displayName !== this.displayName)
+                throw bad();
+            for (const k of Object.keys(this.fields))
+                if (value[k] !== this.fields[k])
+                    throw bad();
+            for (const [i, k] of [
+                "signPublicKey",
+                "kemPublicKey",
+                "noisePublicKey",
+            ].entries())
+                if (!(value[k] instanceof
+                    Uint8Array) ||
+                    !same(value[k], this.keys[i]))
+                    throw bad();
+        }
+        return Object.freeze({
+            ...this.fields,
+            ...(this.displayName === undefined ? {} : { displayName: this.displayName }),
+            signPublicKey: new Uint8Array(this.keys[0]),
+            kemPublicKey: new Uint8Array(this.keys[1]),
+            noisePublicKey: new Uint8Array(this.keys[2]),
+        });
+    }
+    metadata(value) {
+        const operation = this.operation(value.operation);
+        if (!(value.genesisItem instanceof Uint8Array) ||
+            !value.genesisItem.length ||
+            value.genesisItem.length > 256 * 1024 ||
+            typeof value.expectedGenesis !== "string" ||
+            !/^sha256:[0-9a-f]{64}$/.test(value.expectedGenesis))
+            throw bad();
+        return Object.freeze({
+            operation,
+            genesisItem: new Uint8Array(value.genesisItem),
+            expectedGenesis: value.expectedGenesis,
+        });
+    }
+    async hashChecked(metadata, signal) {
+        const domain = new TextEncoder().encode("mdbase/v1/chain"), input = new Uint8Array(1 + domain.length + metadata.genesisItem.length);
+        input[0] = domain.length;
+        input.set(domain, 1);
+        input.set(metadata.genesisItem, 1 + domain.length);
+        const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+        this.check(signal);
+        if (metadata.expectedGenesis !== `sha256:${hex(digest)}`)
+            throw bad();
+    }
+    async read(signal) {
+        let plain = null;
+        try {
+            this.check(signal);
+            const borrowed = await this.io.read.call(this.store, Object.freeze({ signal }));
+            this.check(signal);
+            if (borrowed === null) {
+                if (this.mode !== "fresh")
+                    throw bad();
+                return null;
+            }
+            if (!(borrowed instanceof Uint8Array) ||
+                !borrowed.length ||
+                borrowed.length > APP_CLOUD_COPY_OUTCOME_MAX)
+                throw bad();
+            const encrypted = new Uint8Array(borrowed), decodedOuter = decode(encrypted);
+            if (!(decodedOuter instanceof Map))
+                throw bad();
+            const outer = decodedOuter;
+            if (outer.size !== 3 || outer.get(0) !== 1)
+                throw bad();
+            const iv = outer.get(1), body = outer.get(2);
+            if (!(iv instanceof Uint8Array) ||
+                iv.length !== 12 ||
+                !(body instanceof Uint8Array) ||
+                body.length < 16 ||
+                body.length > MAX_PLAIN + 16)
+                throw bad();
+            plain = new Uint8Array(await crypto.subtle.decrypt({
+                name: "AES-GCM",
+                iv: new Uint8Array(iv),
+                additionalData: new Uint8Array(this.aad),
+                tagLength: 128,
+            }, this.key, new Uint8Array(body)));
+            this.check(signal);
+            if (plain.length > MAX_PLAIN)
+                throw bad();
+            const decodedRecord = decode(plain);
+            if (!(decodedRecord instanceof Map))
+                throw bad();
+            const record = decodedRecord;
+            // Preserve legacy omitted-name outcomes; never reinterpret them as
+            // an explicitly supplied default or let retries change a label.
+            const legacy = record.get(0) === 1 && record.size === 3;
+            if (!legacy && !(record.get(0) === 2 && record.size === 4))
+                throw bad();
+            if ((legacy ? null : record.get(3)) !== (this.displayName ?? null))
+                throw bad();
+            const keys = record.get(1);
+            if (!Array.isArray(keys) ||
+                keys.length !== 3 ||
+                keys.some((v, i) => !(v instanceof Uint8Array) || !same(v, this.keys[i])))
+                throw bad();
+            const raw = record.get(2);
+            let metadata = null;
+            if (raw !== null) {
+                if (!Array.isArray(raw) ||
+                    raw.length !== 2 ||
+                    !(raw[0] instanceof Uint8Array) ||
+                    typeof raw[1] !== "string")
+                    throw bad();
+                metadata = this.metadata({
+                    operation: this.operation(),
+                    genesisItem: raw[0],
+                    expectedGenesis: raw[1],
+                });
+                await this.hashChecked(metadata, signal);
+            }
+            return { encrypted, metadata };
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            plain?.fill(0);
+        }
+    }
+    async write(metadata, expected, signal) {
+        let plain = null, cipher = null;
+        try {
+            this.check(signal);
+            plain = encode(new Map([
+                [0, 2],
+                [1, this.keys.map((v) => new Uint8Array(v))],
+                [
+                    2,
+                    metadata === null
+                        ? null
+                        : [metadata.genesisItem, metadata.expectedGenesis],
+                ],
+                [3, this.displayName ?? null],
+            ]));
+            if (plain.length > MAX_PLAIN)
+                throw bad();
+            const iv = crypto.getRandomValues(new Uint8Array(12)), body = new Uint8Array(await crypto.subtle.encrypt({
+                name: "AES-GCM",
+                iv,
+                additionalData: new Uint8Array(this.aad),
+                tagLength: 128,
+            }, this.key, new Uint8Array(plain)));
+            this.check(signal);
+            cipher = encode(new Map([
+                [0, 1],
+                [1, iv],
+                [2, body],
+            ]));
+            if (cipher.length > APP_CLOUD_COPY_OUTCOME_MAX)
+                throw bad();
+            const confirmed = await this.io.cas.call(this.store, expected, cipher, Object.freeze({ signal }));
+            this.check(signal);
+            if (confirmed !== true)
+                throw bad();
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            plain?.fill(0);
+            cipher?.fill(0);
+        }
+    }
+    async restore(options) {
+        const { signal } = options;
+        const existing = await this.read(signal);
+        this.check(signal);
+        return existing === null
+            ? Object.freeze({ state: "none" })
+            : existing.metadata === null
+                ? Object.freeze({ state: "pending", operation: this.operation() })
+                : Object.freeze({
+                    state: "completed",
+                    metadata: this.metadata(existing.metadata),
+                });
+    }
+    async pending(operation, options) {
+        const { signal } = options;
+        this.check(signal);
+        this.operation(operation);
+        const existing = await this.read(signal);
+        this.check(signal);
+        if (existing)
+            return;
+        await this.write(null, null, signal);
+    }
+    async completed(metadata, options) {
+        const { signal } = options;
+        this.check(signal);
+        const owned = this.metadata(metadata);
+        await this.hashChecked(owned, signal);
+        const existing = await this.read(signal);
+        this.check(signal);
+        if (!existing)
+            throw bad();
+        if (existing.metadata) {
+            if (!same(existing.metadata.genesisItem, owned.genesisItem) ||
+                existing.metadata.expectedGenesis !== owned.expectedGenesis)
+                throw bad();
+            return;
+        }
+        await this.write(owned, existing.encrypted, signal);
+    }
+    close() {
+        this.closed = true;
+        this.key = null;
+    }
+}
+//# sourceMappingURL=cloud-copy-persistence.js.map

package/dist/app-host/cloud-copy-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-copy-persistence.js","sourceRoot":"","sources":["../../src/app-host/cloud-copy-persistence.ts"],"names":[],"mappings":"AAAA;iFACiF;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AASrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;AAC3D,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAC7B,MAAM,GAAG,GAAG,GAAG,EAAE,CACb,IAAI,KAAK,CACL,iEAAiE,CACpE,CAAC;AACN,MAAM,IAAI,GAAG,CAAC,CAAa,EAAE,CAAa,EAAE,EAAE,CAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAmBnE,MAAM,OAAO,mCAAmC;IA0BvB;IAGA;IA5Bb,MAAM,GAAG,KAAK,CAAC;IACf,GAAG,CAAmB;IACb,MAAM,CAUpB;IACc,WAAW,CAAqB;IAChC,OAAO,CAAwC;IAC/C,KAAK,CAAgD;IACrD,EAAE,CAGhB;IACc,IAAI,CAAwB;IAC5B,GAAG,CAAa;IAChB,IAAI,CAAuB;IAC3B,QAAQ,CAAc;IACvC,YACqB,MAAgC,EACjD,OAAqC,EACrC,GAAc,EACG,KAA+B,EAChD,OAA4D;QAJ3C,WAAM,GAAN,MAAM,CAA0B;QAGhC,UAAK,GAAL,KAAK,CAA0B;QAGhD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAClC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC;YACzC,IAAI,CAAC,WAAW,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAClG,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,aAAa,KAAK,IAAI,CAAC,WAAW;gBAAE,MAAM,GAAG,EAAE,CAAC;YACvH,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC;YACtC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,KAAK,CAAC,aAAa;aAC3B,CAAC,CAAC;YACH,MAAM,GAAG,GAAG;gBACR,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,cAAc;gBACrB,MAAM,CAAC,UAAU;aACpB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnB,IACI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC5C,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1C,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBAE1C,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CACrB;gBACI,OAAO,CAAC,aAAa;gBACrB,OAAO,CAAC,YAAY;gBACpB,OAAO,CAAC,cAAc;aACzB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACR,IACI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;oBAC1B,CAAC,CAAC,MAAM,KAAK,EAAE;oBACf,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBAEvB,MAAM,GAAG,EAAE,CAAC;gBAChB,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,CACL,CAAC;YACF,IACI,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAC1C,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;gBACpC,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;gBAEhD,MAAM,GAAG,EAAE,CAAC;YAChB,IACI,OAAO,UAAU,CAAC,SAAS,KAAK,UAAU;gBAC1C,CAAC,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC3B,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACrB,GAAG,CAAC,WAAW;gBACf,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;gBAC/B,GAAG,CAAC,SAA6B,CAAC,MAAM,KAAK,GAAG;gBACjD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACvB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAE/B,MAAM,GAAG,EAAE,CAAC;YAChB,6EAA6E;YAC7E,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;gBACd,2CAA2C;gBAC3C,GAAG,GAAG;gBACN,MAAM,CAAC,OAAO;gBACd,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,WAAW;gBAClB,GAAG,IAAI,CAAC,IAAI;aACf,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,GAAG,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IACO,KAAK,CAAC,MAAmB;QAC7B,IAAI,CAAC;YACD,IACI,IAAI,CAAC,MAAM;gBACX,CAAC,IAAI,CAAC,GAAG;gBACT,MAAM,KAAK,IAAI,CAAC,QAAQ;gBACxB,MAAM,CAAC,OAAO;gBACd,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;gBAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO;gBACtC,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,KAAK;gBAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI;gBACvC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI;gBACrC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,IAAI;gBAChC,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,EAAE,CAAC,GAAG;gBACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,CAAC,CAAmC,CAAC,KAAK,CAAC,CAC7D;gBAED,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,GAAG,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IACO,SAAS,CAAC,KAA6B;QAC3C,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,MAAM,CACkB;gBAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;gBACjB,eAAe;gBACf,cAAc;gBACd,gBAAgB;aACnB,CAAC,OAAO,EAAE;gBACP,IACI,CAAC,CACG,KAAK,CAAC,CAAgC,CAAC;oBACvC,UAAU,CACb;oBACD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAoB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;oBAEjD,MAAM,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,GAAG,IAAI,CAAC,MAAM;YACd,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAC,CAAC;YAC1E,aAAa,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAC5C,YAAY,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAC3C,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;SAChD,CAAC,CAAC;IACP,CAAC;IACO,QAAQ,CACZ,KAAoC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,IACI,CAAC,CAAC,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC;YAC1C,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YACzB,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI;YACrC,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACzC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAEpD,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,SAAS;YACT,WAAW,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;SACzC,CAAC,CAAC;IACP,CAAC;IACO,KAAK,CAAC,WAAW,CACrB,QAAuC,EACvC,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACtD,KAAK,GAAG,IAAI,UAAU,CAClB,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAClD,CAAC;QACN,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,UAAU,CACzB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,QAAQ,CAAC,eAAe,KAAK,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACO,KAAK,CAAC,IAAI,CACd,MAAmB;QAKnB,IAAI,KAAK,GAAsB,IAAI,CAAC;QACpC,IAAI,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CACpC,IAAI,CAAC,KAAK,EACV,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,GAAG,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,IACI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC;gBACjC,CAAC,QAAQ,CAAC,MAAM;gBAChB,QAAQ,CAAC,MAAM,GAAG,0BAA0B;gBAE5C,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,EACtC,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,YAAY,YAAY,GAAG,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,YAAyC,CAAC;YACxD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EACnB,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,IACI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC;gBAC3B,EAAE,CAAC,MAAM,KAAK,EAAE;gBAChB,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC;gBAC7B,IAAI,CAAC,MAAM,GAAG,EAAE;gBAChB,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,EAAE;gBAE5B,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,GAAG,IAAI,UAAU,CAClB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACvB;gBACI,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;gBACtB,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxC,SAAS,EAAE,GAAG;aACjB,EACD,IAAI,CAAC,GAAI,EACT,IAAI,UAAU,CAAC,IAAI,CAAC,CACvB,CACJ,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,aAAa,YAAY,GAAG,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,aAA0C,CAAC;YAC1D,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,IAAI,CAAC,IAAI,CACL,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAC5D;gBAED,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,QAAQ,GAAyC,IAAI,CAAC;YAC1D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACf,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBACnB,GAAG,CAAC,MAAM,KAAK,CAAC;oBAChB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;oBAC/B,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;oBAE1B,MAAM,GAAG,EAAE,CAAC;gBAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBAC3B,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;oBACnB,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;iBAC1B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,GAAG,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACO,KAAK,CAAC,KAAK,CACf,QAA8C,EAC9C,QAA2B,EAC3B,MAAmB;QAEnB,IAAI,KAAK,GAAsB,IAAI,EAC/B,MAAM,GAAsB,IAAI,CAAC;QACrC,IAAI,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,KAAK,GAAG,MAAM,CACV,IAAI,GAAG,CAAoB;gBACvB,CAAC,CAAC,EAAE,CAAC,CAAC;gBACN,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C;oBACI,CAAC;oBACD,QAAQ,KAAK,IAAI;wBACb,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC;iBACzD;gBACD,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;aAChC,CAAC,CACL,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACjD,IAAI,GAAG,IAAI,UAAU,CACjB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACvB;gBACI,IAAI,EAAE,SAAS;gBACf,EAAE;gBACF,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxC,SAAS,EAAE,GAAG;aACjB,EACD,IAAI,CAAC,GAAI,EACT,IAAI,UAAU,CAAC,KAAK,CAAC,CACxB,CACJ,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,GAAG,MAAM,CACX,IAAI,GAAG,CAAoB;gBACvB,CAAC,CAAC,EAAE,CAAC,CAAC;gBACN,CAAC,CAAC,EAAE,EAAE,CAAC;gBACP,CAAC,CAAC,EAAE,IAAI,CAAC;aACZ,CAAC,CACL,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,GAAG,0BAA0B;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CACpC,IAAI,CAAC,KAAK,EACV,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,SAAS,KAAK,IAAI;gBAAE,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,GAAG,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAEb;QACG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,QAAQ,KAAK,IAAI;YACpB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAClC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI;gBAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAClE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;oBACV,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC7C,CAAC,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CACT,SAAgC,EAChC,OAAgC;QAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,SAAS,CACX,QAAuC,EACvC,OAAgC;QAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ;YAAE,MAAM,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,IACI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC;gBACvD,QAAQ,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;gBAE3D,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;IACpB,CAAC;CACJ"}

package/dist/app-host/collection-control.d.ts

@@ -0,0 +1,111 @@
+/** Generic owner-only setup journal/control channel, separate from the ONE native
+ * UI data port. No SQL, host/session, ciphertext, signing or credential RPC. */
+import { AppCollectionSetupError, type AppCollectionSetupJournal } from "./collection-setup-journal.js";
+import type { ModelResourcePlan, ModelResourceSetupJournal, ModelSetupScope } from "./collection-setup-types.js";
+import type { PeopleAuthority } from "../people.js";
+import type { WriteLedgerStore } from "../write-ledger.js";
+import type { AppLedgerRows } from "../app-storage/collection-sql.js";
+export interface AppCollectionControlBinding {
+    readonly scope: ModelSetupScope;
+    readonly generation: string;
+}
+/** Native Core's reviewable setup (present only when decisions were sent). */
+export interface AppResourceReview {
+    readonly packs: readonly {
+        readonly id: string;
+        readonly version: string;
+        readonly status: "current" | "install" | "upgrade" | "downgrade" | "reconfigure" | "conflict";
+        readonly installedVersion: string | null;
+        readonly resources: readonly {
+            readonly target: string;
+            readonly kind: string;
+            readonly mode: "managed" | "seed";
+            readonly action: "create" | "update" | "delete" | "adopt" | "preserve" | "conflict";
+            readonly installed: boolean;
+            readonly currentDigest?: string;
+            readonly reason?: string;
+        }[];
+    }[];
+    readonly configuration: readonly {
+        readonly requirement: string;
+        readonly path: string;
+        readonly action: "add" | "conflict";
+        readonly value?: string | number | boolean | null;
+    }[];
+    readonly staged: readonly {
+        readonly path: string;
+        readonly document: string;
+    }[];
+}
+export interface AppResourceAssessment {
+    readonly status: "current" | "provision" | "conflict";
+    readonly assessmentDigest: string;
+    readonly review?: AppResourceReview;
+}
+/** Reviewed decisions: an unmanaged definition target → its exact reviewed digest. */
+export interface AppResourceDecisions {
+    readonly adopt?: Readonly<Record<string, string>>;
+}
+/** SDK-private producer port. Inputs are declaration DATA, outputs are Core
+ * resource DATA/guarded ops only; apply here never submits a mutation.
+ * Passing decisions (even `{}`) asks assess for the review. */
+export interface AppResourceSetupPort {
+    assess(manifest: unknown, signal: AbortSignal, decisions?: AppResourceDecisions): Promise<AppResourceAssessment>;
+    apply(manifest: unknown, assessmentDigest: string, signal: AbortSignal, decisions?: AppResourceDecisions): Promise<ModelResourcePlan>;
+    /** Native witness: true only for a FINAL rejected receipt of exactly this
+     * mutation on the original session. The only way a round is recorded rejected. */
+    rejected?(mutationId: string, signal: AbortSignal): Promise<boolean>;
+}
+export declare function resourceDecisions(value: unknown): AppResourceDecisions;
+export declare function resourceAssessment(value: unknown, reviewing?: boolean): AppResourceAssessment;
+export interface AppCollectionControlClient {
+    readonly resourceSetup: AppResourceSetupPort;
+    readonly journal: ModelResourceSetupJournal;
+    /** Fixed metadata READ proxy; present only with a people-enabled SDK handoff. */
+    readonly peopleAuthority?: PeopleAuthority;
+    /** The write ledger's durable store: rows in the replica database. */
+    readonly ledger: WriteLedgerStore;
+    /** Actual same-scope setup-engine assessment, NOT discovery/readiness authority. */
+    assess(state: "ready" | "setup_required", signal: AbortSignal): Promise<void>;
+    setForeground(active: boolean, signal: AbortSignal): Promise<void>;
+    close(): void;
+}
+export declare class AppCollectionControlError extends Error {
+    readonly reason: AppCollectionSetupError["reason"] | "busy";
+    constructor(reason: AppCollectionSetupError["reason"] | "busy");
+}
+/** Shared by every tab's control onto one open collection: the tab whose setup
+ * is between its prepare and its verified/rejected step. */
+export interface AppCollectionSetupTurn {
+    owner: object | null;
+}
+/** Worker-side fixed verbs under the original adapter's child lifetime. */
+export declare function attachAppCollectionControl(port: MessagePort, source: AppCollectionControlBinding, options: {
+    journal: AppCollectionSetupJournal;
+    /** Closure over the original native facade port, never a host/context loan. */
+    resourceSetup?: AppResourceSetupPort;
+    /** SAME original host authority; configured privately by the SDK adapter. */
+    peopleAuthority?: PeopleAuthority;
+    /** Write-ledger rows in the replica database; answered at once, beside other verbs. */
+    ledger?(): AppLedgerRows | null;
+    /** One per open collection, shared by every tab's control. While one tab's
+     * setup is in progress, another tab's journal requests are refused `busy`
+     * (not started), so it waits for that setup instead of racing its steps. */
+    setupTurn?: AppCollectionSetupTurn;
+    signal: AbortSignal;
+    isCurrent(): boolean;
+    assess(state: "ready" | "setup_required"): void;
+    foreground(active: boolean): void;
+    onProtocolFailure(): void;
+}): {
+    close(): Promise<void>;
+};
+/** UI-side original journal proxy. One outstanding request, no queue/retry/timer.
+ * Local cancellation retains the slot until its original reply or channel close. */
+export declare function appCollectionControlClient(port: MessagePort, source: AppCollectionControlBinding, options: {
+    signal: AbortSignal;
+    isCurrent(): boolean;
+    onClose(): void;
+    /** Set only for a handoff whose original Worker configured people authority. */
+    people?: boolean;
+}): AppCollectionControlClient;