@openlfcp/client 0.1.5 → 0.2.0-beta.1

package/dist/revoke.js

@@ -0,0 +1,108 @@
+import { bytesEqual, controlRecordId, toHex, } from "@openlfcp/core";
+import { ABILITY, ABILITY_NAMES, hasAbility, isGrantActive, KEY_EPOCH_REASON, parseKeyPackage, rotateEpoch, sealKeyPackage, signControlRecord, validateControlChain, verifyKeyPackage, } from "@openlfcp/wire";
+export class RevocationRefused extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "RevocationRefused";
+    }
+}
+const name = (a) => ABILITY_NAMES.get(a) ?? `${a}`;
+/**
+ * Plans the removal of `subject` by `revoker` on the validated chain
+ * `view`. `frontier` is the closing epoch's accepted final frontier (the
+ * local Have). With `rotate: false`, or when the member keeps read access
+ * through a remaining path, the epoch is not rotated. Throws
+ * RevocationRefused.
+ */
+export async function planRevocation(options) {
+    const { view, revoker, subject } = options;
+    const state0 = view.state;
+    const R = state0.resourceId;
+    if (bytesEqual(state0.owner.principalId, subject))
+        throw new RevocationRefused("would-remove-owner", "the owner's access is not revoked (§17.3)");
+    const grants = [...state0.grants.values()].filter((g) => bytesEqual(g.subject, subject) && isGrantActive(state0, g.id));
+    if (grants.length === 0)
+        throw new RevocationRefused("not-member", "no active grant names this Principal");
+    let bytes = view.records.map((r) => r.signed.bytes);
+    let running = view;
+    const records = [];
+    const revoked = [];
+    const remainingPaths = [];
+    for (const g of grants) {
+        // Already inactive through an earlier revocation of its ancestor (§17.2).
+        if (!isGrantActive(running.state, g.id))
+            continue;
+        const signed = signControlRecord({ resourceId: R, controlSeq: running.state.seq + 1n, prevControlId: running.state.head }, { type: "CAPABILITY_REVOKE", grantId: g.id }, revoker);
+        const next = validateControlChain([...bytes, signed.bytes]);
+        if (next.kind !== "linear") {
+            remainingPaths.push(Object.freeze({
+                grantId: g.id,
+                issuer: g.issuer,
+                abilities: Object.freeze(g.abilities.map(name)),
+            }));
+            continue;
+        }
+        bytes = [...bytes, signed.bytes];
+        running = next;
+        records.push({ recordId: signed.recordId, bytes: signed.bytes });
+        revoked.push(g.id);
+    }
+    if (revoked.length === 0)
+        throw new RevocationRefused("not-authorized", "the revoker may revoke none of this Principal's grants (§17.3)");
+    const revokedKeys = new Set(revoked.map((id) => toHex(id)));
+    const deactivated = [...state0.grants.values()]
+        .filter((g) => !revokedKeys.has(toHex(g.id)) &&
+        isGrantActive(state0, g.id) &&
+        !isGrantActive(running.state, g.id))
+        .map((g) => g.id);
+    let rotation = null;
+    const keyPackages = [];
+    const recipients = [];
+    const stillReads = hasAbility(running.state, subject, ABILITY.DATA_READ);
+    if (options.rotate !== false && !stillReads) {
+        const r = rotateEpoch(running.state, revoker, {
+            reason: KEY_EPOCH_REASON.MEMBER_REVOKED,
+            finalFrontier: options.frontier,
+        });
+        const next = validateControlChain([...bytes, r.bytes]);
+        if (next.kind !== "linear")
+            throw new RevocationRefused("not-authorized", "the revoker may not rotate the Data Epoch (key/rotate, §19)");
+        running = next;
+        records.push({ recordId: controlRecordId(r.recordId), bytes: r.bytes });
+        rotation = Object.freeze({ epoch: r.epoch, dek: r.dek });
+        // Every remaining reader but the revoker, who keeps the DEK it made.
+        const readers = [
+            running.state.owner,
+            ...[...running.state.principals.values()],
+        ].filter((d, i, all) => all.findIndex((x) => bytesEqual(x.principalId, d.principalId)) === i &&
+            !bytesEqual(d.principalId, revoker.descriptor.principalId) &&
+            hasAbility(running.state, d.principalId, ABILITY.DATA_READ));
+        for (const recipient of readers) {
+            const sealed = await sealKeyPackage({
+                resourceId: R,
+                epoch: r.epoch,
+                controlHead: r.recordId,
+                recipient,
+                dek: r.dek,
+                signer: revoker,
+            });
+            const check = verifyKeyPackage(running, parseKeyPackage(sealed.bytes));
+            if (check.kind !== "authorized")
+                throw new RevocationRefused("not-authorized", `the revoker may not distribute the new key: ${check.message}`);
+            keyPackages.push(sealed.bytes);
+            recipients.push(recipient.principalId);
+        }
+    }
+    return Object.freeze({
+        revoked: Object.freeze(revoked),
+        deactivated: Object.freeze(deactivated),
+        records: Object.freeze(records),
+        rotation,
+        keyPackages: Object.freeze(keyPackages),
+        recipients: Object.freeze(recipients),
+        remainingPaths: Object.freeze(remainingPaths),
+    });
+}
+//# sourceMappingURL=revoke.js.map

package/dist/section-status.d.ts

@@ -0,0 +1,94 @@
+import type { DataUnitId, ResourceId } from "@openlfcp/core";
+import type { LfcpStorage } from "@openlfcp/storage";
+import type { BatchStatus } from "./batch-status.js";
+import type { AccessState } from "./write-access.js";
+/**
+ * The status stream of a Resource (SDK-SECTIONS-INTEGRATION-01 §4, §5,
+ * LFCP-02-026): what an editor adapter shows as saved, waiting, accepted
+ * or not, and what it knows about units received from others. Every fact
+ * comes from evidence the SDK holds; none is derived from a sent frame.
+ */
+/** §4.2: the signal that showed the server lost units it had acknowledged. */
+export type ReofferReason = "unknown-previous" | "have-gap" | "rehost";
+/** §4.3: what became of a unit received from others. */
+export type ReceivedFact = "held" | "waiting" | "refused";
+/**
+ * LFCP-02-028: how far this session caught up with the Resource.
+ * "current-at-checkpoint" only once the Resource was live (Control, keys
+ * and every offered unit received and applied), at `checkedAt`; it stays
+ * so offline, as of that check. "unknown" while a Control conflict or a
+ * missing key blocks the catch-up.
+ */
+export type CatchUp = "not-started" | "receiving" | "current-at-checkpoint" | "unknown";
+/** §4.3: a section without `ready` is importing. */
+export type SectionState = "ready" | "importing";
+/**
+ * §5: one event of a Resource's status stream. `revision` grows by one with
+ * each event of that Resource in this SDK session; a consumer that sees a
+ * revision other than the next one asks for statusSnapshot.
+ */
+export type StatusEvent = {
+    readonly revision: number;
+} & (({
+    readonly kind: "batch";
+} & BatchStatus) | {
+    readonly kind: "reoffered";
+    readonly unitIds: readonly DataUnitId[];
+    readonly reason: ReofferReason;
+} | {
+    readonly kind: "received";
+    readonly fact: ReceivedFact;
+    readonly unitIds: readonly DataUnitId[];
+    /** The admission or merge diagnostic, when refused. */
+    readonly diagnostic?: string;
+} | {
+    readonly kind: "section-state";
+    readonly state: SectionState;
+} | {
+    readonly kind: "access";
+    readonly access: AccessState;
+} | {
+    readonly kind: "catch-up";
+    readonly state: CatchUp;
+    /** The local time the Resource was last live; null before. */
+    readonly checkedAt: number | null;
+}
+/** The Resource was hosted again on this route (§41.1). */
+ | {
+    readonly kind: "rehost";
+    readonly route: string;
+});
+/** The body of a status event, before its revision is assigned. */
+export type StatusEventBody = StatusEvent extends infer E ? E extends {
+    readonly revision: number;
+} ? Omit<E, "revision"> : never : never;
+/** §4.3: the received units that are not merged, as stored. */
+export interface ReceivedState {
+    readonly held: readonly DataUnitId[];
+    readonly waiting: readonly DataUnitId[];
+    readonly refused: readonly {
+        readonly unitId: DataUnitId;
+        readonly diagnostic: string;
+    }[];
+}
+/** §5: the complete state of a Resource's status, at `revision`. */
+export interface StatusSnapshot {
+    readonly revision: number;
+    readonly batches: readonly BatchStatus[];
+    readonly received: ReceivedState;
+    /** Unknown without a section binding, or before the section exists. */
+    readonly section: SectionState | "unknown";
+    readonly access: AccessState;
+    readonly catchUp: {
+        readonly state: CatchUp;
+        readonly checkedAt: number | null;
+    };
+}
+/**
+ * The received units of `resource` that wait or were refused: held behind
+ * a change with their actor and sequence (SOP §14.1), waiting for a
+ * dependency (the profile's, or the previous unit of their actor, §26.2),
+ * refused when merging. Units of this client are never among them.
+ */
+export declare function receivedState(storage: Pick<LfcpStorage, "dataUnits">, resource: ResourceId): Promise<ReceivedState>;
+//# sourceMappingURL=section-status.d.ts.map

package/dist/section-status.js

@@ -0,0 +1,16 @@
+/**
+ * The received units of `resource` that wait or were refused: held behind
+ * a change with their actor and sequence (SOP §14.1), waiting for a
+ * dependency (the profile's, or the previous unit of their actor, §26.2),
+ * refused when merging. Units of this client are never among them.
+ */
+export async function receivedState(storage, resource) {
+    const ids = async (status) => (await storage.dataUnits.withStatus(resource, status)).map((u) => u.unitId);
+    const refused = (await storage.dataUnits.withStatus(resource, "profile-rejected")).map((u) => Object.freeze({ unitId: u.unitId, diagnostic: u.detail ?? "" }));
+    return Object.freeze({
+        held: Object.freeze(await ids("profile-held")),
+        waiting: Object.freeze([...(await ids("profile-pending")), ...(await ids("held"))]),
+        refused: Object.freeze(refused),
+    });
+}
+//# sourceMappingURL=section-status.js.map

package/dist/storage.d.ts

@@ -3,6 +3,7 @@ import { type ResourceDEK } from "@openlfcp/crypto";
 import { type CommitResult, type DataUnitRow, type LfcpStorage, type SecretStore, type StorageWrite } from "@openlfcp/storage";
 import { type ChainResult, type SeenRecord, type SeenUnits } from "@openlfcp/wire";
 import { type CreateDataUnitOptions, type CreatedDataUnit } from "./data-unit.js";
+import { type Receipt } from "./receipts.js";
 /**
  * The client code on top of the storage interfaces (LFCP-034), so that a
  * durable adapter (LFCP-035) is all a platform has to write.
@@ -93,4 +94,32 @@ export declare function createQueuedDataUnit<T>(storage: Pick<LfcpStorage, "acto
      */
     readonly onCreated?: (created: CreatedDataUnit, value: T) => void;
 }, also?: readonly StorageWrite[] | ((created: CreatedDataUnit) => readonly StorageWrite[])): Promise<CreatedDataUnit>;
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.1 (LFCP-02-025): commits one operation, a
+ * batch of a profile's changes, as Data Units with their outbound entries,
+ * the caller's writes (`also`: its profile checkpoint) and the receipt, in
+ * ONE storage transaction: after a crash either all of it exists or none.
+ * The units chain their previous units in order (§26.2).
+ *
+ * Idempotent per (Resource, operationId) (§3.3): an operation that already
+ * has a receipt for the same intents returns it and writes nothing; for
+ * different intents it throws OperationIdReusedError. The caller stages
+ * its changes first and adopts them only once this resolves.
+ */
+export interface CommitOperationOptions<T> extends Omit<CreateDataUnitOptions<T>, "sequences" | "previousUnitId" | "value"> {
+    readonly operationId: string;
+    /** The batch's intents, as the caller submitted them (their canonical form is hashed, §3.3). */
+    readonly intents: readonly unknown[];
+    /** The batch's changes in order; each becomes one Data Unit. */
+    readonly values: readonly T[];
+    readonly affectedNodeIds: readonly string[];
+    /** The document's heads after the batch, sorted, as one string. */
+    readonly modelRevision: string;
+    /** Called for each sealed unit before the commit (e.g. the profile's recordLocal). */
+    readonly onCreated?: (created: CreatedDataUnit, value: T, index: number) => void;
+}
+export declare function commitOperation<T>(storage: Pick<LfcpStorage, "actorSequences" | "commit" | "dataUnits" | "localMarks">, options: CommitOperationOptions<T>, also?: readonly StorageWrite[] | ((units: readonly CreatedDataUnit[]) => readonly StorageWrite[])): Promise<{
+    readonly receipt: Receipt;
+    readonly committed: boolean;
+}>;
 //# sourceMappingURL=storage.d.ts.map

package/dist/storage.js

@@ -2,7 +2,9 @@ import { actorSequence, bytesEqual, hash32, LfcpError, toHex, } from "@openlfcp/
 import { dekCommitment, importResourceDEK } from "@openlfcp/crypto";
 import { dekSecretRef, } from "@openlfcp/storage";
 import { parseDataUnit, validateControlChain, } from "@openlfcp/wire";
+import { receiptIndexWrites, replaceReleasedWrites } from "./batch-status.js";
 import { createDataUnit } from "./data-unit.js";
+import { intentsHash, OperationIdReusedError, receiptOf, receiptWrite, } from "./receipts.js";
 /**
  * The client code on top of the storage interfaces (LFCP-034), so that a
  * durable adapter (LFCP-035) is all a platform has to write.
@@ -286,4 +288,67 @@ async function createQueuedDataUnitNow(storage, options, also, resource, actor)
         throw new Error(`the local unit was not stored: ${result.reason}`);
     return created;
 }
+export async function commitOperation(storage, options, also = []) {
+    const resource = options.view.state.resourceId;
+    const actor = options.actor.descriptor.principalId;
+    return serialized(storage, `${toHex(resource)}:${toHex(actor)}`, async () => {
+        const hash = intentsHash(options.intents);
+        const existing = await receiptOf(storage, resource, options.operationId);
+        if (existing !== undefined) {
+            if (existing.intentsHash !== hash)
+                throw new OperationIdReusedError(options.operationId);
+            return { receipt: existing, committed: false };
+        }
+        const { onCreated, operationId, intents, values, affectedNodeIds, modelRevision, ...create } = options;
+        void intents;
+        const first = await latestAcceptedOwnUnit(storage, resource, actor);
+        const created = [];
+        let previous = first;
+        for (const [i, value] of values.entries()) {
+            const unit = await createDataUnit({
+                ...create,
+                value,
+                previousUnitId: previous,
+                sequences: storage.actorSequences,
+            });
+            onCreated?.(unit, value, i);
+            created.push(unit);
+            previous = unit.unitId;
+        }
+        const receipt = Object.freeze({
+            operationId,
+            unitIds: Object.freeze(created.map((u) => u.unitId)),
+            affectedNodeIds: Object.freeze([...affectedNodeIds]),
+            modelRevision,
+            intentsHash: hash,
+            durable: true,
+        });
+        const writes = [
+            { op: "expect-previous-unit", resourceId: resource, actor, previous: first },
+        ];
+        for (const unit of created) {
+            const row = dataUnitRow(unit.bytes);
+            writes.push({ op: "put-data-unit", unit: row, status: "merged", detail: "local", accepted: true }, {
+                op: "enqueue",
+                item: {
+                    itemId: hash32(unit.unitId),
+                    resourceId: row.resourceId,
+                    kind: "data-unit",
+                    bytes: unit.bytes,
+                    attempts: 0,
+                    lastAttempt: null,
+                    nextAttempt: null,
+                    blocked: null,
+                },
+            });
+        }
+        writes.push(
+        // A released batch kept for its status under this operation ID is replaced.
+        ...(await replaceReleasedWrites(storage, resource, options.operationId)), receiptWrite(resource, receipt), ...receiptIndexWrites(resource, receipt), ...(typeof also === "function" ? also(created) : also));
+        const result = await storage.commit(writes);
+        if (!result.ok)
+            throw new Error(`the operation was not stored: ${result.reason}`);
+        return { receipt, committed: true };
+    });
+}
 //# sourceMappingURL=storage.js.map

package/dist/sync-client.d.ts

@@ -1,12 +1,51 @@
-import { type ControlRecordId, type DataEpoch, type DataUnitId, type Hash32, type ResourceId } from "@openlfcp/core";
+import { type ControlRecordId, type DataEpoch, type DataUnitId, type Hash32, type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type AgreementKeyPair } from "@openlfcp/crypto";
-import { type LfcpStorage, type SecretStore } from "@openlfcp/storage";
+import { type LfcpStorage, type SecretStore, type StorageWrite } from "@openlfcp/storage";
 import { type ClientConnectionState, type DataProfileCodec, type HaveVector, type Signer } from "@openlfcp/wire";
 import type { ApplyOutcome, DataUnitApplier, EpochReconciliation } from "./apply.js";
 import type { ProfileCheckpointer } from "./checkpoint.js";
 import { type WebSocketFactory } from "./connection.js";
 import type { AckOutcome, NackOutcome, OutboundQueue, StaleOutboundUnit } from "./outbound.js";
+import { type Receipt } from "./receipts.js";
 import { type ResourcePhase } from "./resource-state.js";
+import { type RemainingPath, type RevocationRefusal } from "./revoke.js";
+import { type SectionState, type StatusEvent, type StatusSnapshot } from "./section-status.js";
+import { type AccessState, type WriteAccess } from "./write-access.js";
+/** LFCP-02-060: what revokeAccess did. */
+export type RevokeAccessResult = {
+    readonly kind: "queued";
+    /** The grants revoked, and those delegated from them that this deactivates (§17.2). */
+    readonly revoked: readonly ControlRecordId[];
+    readonly deactivated: readonly ControlRecordId[];
+    /** The queued Control Records: the revocations, then the Key Epoch if any. */
+    readonly recordIds: readonly ControlRecordId[];
+    /** The new Data Epoch, or null when it was not rotated. */
+    readonly epoch: DataEpoch | null;
+    /** The remaining readers who get the new DEK in Key Packages. */
+    readonly recipients: readonly PrincipalId[];
+    /** Grants this revoker may not revoke: the member keeps access through them. */
+    readonly remainingPaths: readonly RemainingPath[];
+} | {
+    readonly kind: "refused";
+    /**
+     * offline: the Resource is not live in this session; stale: the
+     * validated chain is behind what the server reported; control-pending:
+     * Control Records of this client are not committed yet. Nothing is
+     * queued: a removal never waits in an offline queue.
+     */
+    readonly reason: RevocationRefusal | "offline" | "stale" | "control-pending";
+    readonly message: string;
+};
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.6: a batch the SDK refuses before the
+ * profile sees it, with the same codes and fields as the profile's
+ * refusals. Nothing is written.
+ */
+export declare class CommitRefusedError extends Error {
+    readonly code: string;
+    readonly intentIndex: number;
+    constructor(code: string, message: string, intentIndex: number);
+}
 /**
  * The client sync session (LFCP-039a): one LFCP connection to a server and
  * the §65 machine of every Resource opened on it, orchestrating the parts
@@ -41,6 +80,37 @@ export interface SnapshotBinding<T> {
     load(value: T): void;
     current(): T;
 }
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.1: a batch of intents a Data Profile has
+ * validated and changed on a copy of its state (for Shared Sections:
+ * SharedSectionsDataProfile.commitBinding().stage).
+ */
+export interface StagedOperation<T> {
+    /** The batch's changes in order: one Data Unit each. */
+    readonly values: readonly T[];
+    readonly affectedNodeIds: readonly string[];
+    /** The profile state's revision after the batch. */
+    readonly modelRevision: string;
+    /** Adopts the batch in the profile state, before the commit is stored. */
+    apply(): void;
+    /** Undoes apply(): the commit did not happen, or had happened before. */
+    revert(): void;
+    /** Writes stored with the units: the profile checkpoint that includes them. */
+    writes(units: readonly {
+        readonly unitId: DataUnitId;
+    }[]): readonly StorageWrite[];
+    /** Called once the commit is durable, with the units in order. */
+    committed(unitIds: readonly DataUnitId[]): void;
+}
+/** How a Resource's Data Profile commits local batches (§3.1). */
+export interface CommitBinding<T> {
+    /** The codec of this client's own units. */
+    readonly codec: DataProfileCodec<T>;
+    /** Validates and changes the batch on a copy; null when it writes nothing. Throws to refuse it. */
+    stage(intents: readonly unknown[]): StagedOperation<T> | null;
+    /** The section's state (SDK-SECTIONS-INTEGRATION-01 §4.3); undefined before there is a section. */
+    section?(): SectionState | undefined;
+}
 /** A Resource to synchronize: its Data Profile applier (and optional checkpoints and Snapshots). */
 export interface ResourceBinding {
     readonly resourceId: ResourceId;
@@ -48,6 +118,8 @@ export interface ResourceBinding {
     readonly checkpointer?: ProfileCheckpointer;
     /** Load an offered Snapshot instead of replaying every unit, and allow publishing. */
     readonly snapshot?: SnapshotBinding<unknown>;
+    /** Commit local batches with receipts (commit, receiptOf). */
+    readonly commit?: CommitBinding<unknown>;
 }
 /** When to try connecting again after the `attempt`-th failure (1, 2, …): a delay in ms, or null to stop. */
 export type ReconnectPolicy = (attempt: number) => number | null;
@@ -80,7 +152,8 @@ export interface SyncClientOptions {
     readonly dataProfiles?: readonly string[];
     /**
      * Whether to publish a Snapshot of a LIVE Resource now, asked on every
-     * tick with the number of units merged since the last one; no automatic
+     * tick with the number of units merged since the last one, received or
+     * committed here (a section's only writer reaches it too); no automatic
      * schedule otherwise (publishSnapshot can also be called directly).
      */
     readonly snapshotPolicy?: (resourceId: ResourceId, unitsSinceLast: number) => boolean;
@@ -142,6 +215,12 @@ export type SyncEvent = {
     readonly type: "ack";
     readonly outcome: AckOutcome;
 }
+/** SDK-SECTIONS-INTEGRATION-01 §5: the Resource's status stream (statusSnapshot after a gap). */
+ | {
+    readonly type: "status";
+    readonly resourceId: ResourceId;
+    readonly event: StatusEvent;
+}
 /** A NACK of an outbound object: stale, equivocation alarm, rejected, repropose, … */
  | {
     readonly type: "nack";
@@ -168,6 +247,22 @@ export type SyncEvent = {
     readonly outcome: "hosted" | "refused";
     readonly code?: string;
 }
+/**
+ * RESOURCE_OPEN was refused with AUTHORIZATION_FAILED although this
+ * client's validated chain grants it data/read: the server may have lost
+ * Control Records in a restore (LFCP-02-106). "started": the client
+ * re-supplies its chain with CONTROL_PUT; "recovered": the server opened
+ * the Resource again after it; "ended": no recovery, with the reason (see
+ * RecoveryEnd, or "still-refused" when the server holds our chain and
+ * still refuses), and the refusal stands.
+ */
+ | {
+    readonly type: "access-recovery";
+    readonly resourceId: ResourceId;
+    readonly url: string;
+    readonly outcome: "started" | "recovered" | "ended";
+    readonly reason?: string;
+}
 /**
  * The server refused the Resource for good (see ResourceRefusal): it is
  * CLOSED and is not opened again until open() is called for it.
@@ -212,6 +307,13 @@ export declare class SyncClient {
     constructor(options: SyncClientOptions);
     /** Subscribes to session events; returns the unsubscribe function. */
     on(listener: (event: SyncEvent) => void): () => void;
+    /**
+     * §5: the complete status of `resource` at the stream's current revision:
+     * every unreleased batch, the received units that wait or were refused,
+     * the section state and write access. Events at or below its revision
+     * are already in it.
+     */
+    statusSnapshot(resource: ResourceId): Promise<StatusSnapshot>;
     /** Resolves once every message received so far has been handled (tests and shutdown). */
     idle(): Promise<void>;
     get connectionState(): ClientConnectionState;
@@ -242,6 +344,49 @@ export declare class SyncClient {
      * that loads it never skips content the state does not hold. Queued and
      * sent like any object; returns its ID.
      */
+    /**
+     * LFCP-02-060: removes `subject`'s access to `resource`. Every active
+     * grant naming it that this client may revoke is revoked (§17.3); when it
+     * has no read access left, the Data Epoch is rotated with a fresh DEK
+     * (§19, member revoked) and the DEK goes in Key Packages to every other
+     * remaining reader (§25), so it cannot read new data. Built on the
+     * validated head and checked before anything is queued; the records, the
+     * Key Packages and (first) the new DEK are written at once, then sent.
+     * Refused, with nothing queued, unless the Resource is live and current
+     * here and no Control Record of this client is pending.
+     */
+    revokeAccess(resource: ResourceId, subject: PrincipalId, options?: {
+        readonly rotate?: boolean;
+    }): Promise<RevokeAccessResult>;
+    /**
+     * SDK-SECTIONS-INTEGRATION-01 §3.1: commits a batch of intents on an open
+     * Resource and returns its receipt once the batch is durable: its Data
+     * Units, outbound entries, the profile checkpoint and the receipt are
+     * stored in one transaction, then the batch is sent. An operation that
+     * has a receipt returns it for the same intents and writes nothing, and
+     * throws OperationIdReusedError for different ones (§3.3). Runs between
+     * received units, never during their merge.
+     */
+    commit(resource: ResourceId, intents: readonly unknown[], options: {
+        readonly operationId: string;
+    }): Promise<Receipt>;
+    /**
+     * SDK-SECTIONS-INTEGRATION-01 §6: whether this client may commit to
+     * `resource`, from the validated Control state only: the chain of the
+     * last Control sync, or the stored chain validated now. `verifiedAt` is
+     * the local time of that validation (the last sync's when the stored
+     * chain is still at its head). Unknown without a validated chain.
+     */
+    canWrite(resource: ResourceId): Promise<WriteAccess>;
+    /**
+     * LFCP-02-027: write access with its evidence: the Control sequence it
+     * was validated at against the highest one a server reported in this
+     * session (a stale view is not current), the effective abilities and
+     * the active grant paths giving them, and apart from them the
+     * invitations we issued, our Control Records not yet committed (SI14)
+     * and an unsettled invitation claim of ours.
+     */
+    accessState(resource: ResourceId): Promise<AccessState>;
     publishSnapshot(resource: ResourceId): Promise<Hash32>;
 }
 /**