@openlfcp/client 0.1.5 → 0.2.0-beta.10

package/dist/section-status.d.ts

@@ -0,0 +1,94 @@
+import type { DataUnitId, ResourceId } from "@openlfcp/core";
+import type { LfcpStorage } from "@openlfcp/storage";
+import type { BatchStatus } from "./batch-status.js";
+import type { AccessState } from "./write-access.js";
+/**
+ * The status stream of a Resource (SDK-SECTIONS-INTEGRATION-01 §4, §5,
+ * LFCP-02-026): what an editor adapter shows as saved, waiting, accepted
+ * or not, and what it knows about units received from others. Every fact
+ * comes from evidence the SDK holds; none is derived from a sent frame.
+ */
+/** §4.2: the signal that showed the server lost units it had acknowledged. */
+export type ReofferReason = "unknown-previous" | "have-gap" | "rehost";
+/** §4.3: what became of a unit received from others. */
+export type ReceivedFact = "held" | "waiting" | "refused";
+/**
+ * LFCP-02-028: how far this session caught up with the Resource.
+ * "current-at-checkpoint" only once the Resource was live (Control, keys
+ * and every offered unit received and applied), at `checkedAt`; it stays
+ * so offline, as of that check. "unknown" while a Control conflict or a
+ * missing key blocks the catch-up.
+ */
+export type CatchUp = "not-started" | "receiving" | "current-at-checkpoint" | "unknown";
+/** §4.3: a section without `ready` is importing. */
+export type SectionState = "ready" | "importing";
+/**
+ * §5: one event of a Resource's status stream. `revision` grows by one with
+ * each event of that Resource in this SDK session; a consumer that sees a
+ * revision other than the next one asks for statusSnapshot.
+ */
+export type StatusEvent = {
+    readonly revision: number;
+} & (({
+    readonly kind: "batch";
+} & BatchStatus) | {
+    readonly kind: "reoffered";
+    readonly unitIds: readonly DataUnitId[];
+    readonly reason: ReofferReason;
+} | {
+    readonly kind: "received";
+    readonly fact: ReceivedFact;
+    readonly unitIds: readonly DataUnitId[];
+    /** The admission or merge diagnostic, when refused. */
+    readonly diagnostic?: string;
+} | {
+    readonly kind: "section-state";
+    readonly state: SectionState;
+} | {
+    readonly kind: "access";
+    readonly access: AccessState;
+} | {
+    readonly kind: "catch-up";
+    readonly state: CatchUp;
+    /** The local time the Resource was last live; null before. */
+    readonly checkedAt: number | null;
+}
+/** The Resource was hosted again on this route (§41.1). */
+ | {
+    readonly kind: "rehost";
+    readonly route: string;
+});
+/** The body of a status event, before its revision is assigned. */
+export type StatusEventBody = StatusEvent extends infer E ? E extends {
+    readonly revision: number;
+} ? Omit<E, "revision"> : never : never;
+/** §4.3: the received units that are not merged, as stored. */
+export interface ReceivedState {
+    readonly held: readonly DataUnitId[];
+    readonly waiting: readonly DataUnitId[];
+    readonly refused: readonly {
+        readonly unitId: DataUnitId;
+        readonly diagnostic: string;
+    }[];
+}
+/** §5: the complete state of a Resource's status, at `revision`. */
+export interface StatusSnapshot {
+    readonly revision: number;
+    readonly batches: readonly BatchStatus[];
+    readonly received: ReceivedState;
+    /** Unknown without a section binding, or before the section exists. */
+    readonly section: SectionState | "unknown";
+    readonly access: AccessState;
+    readonly catchUp: {
+        readonly state: CatchUp;
+        readonly checkedAt: number | null;
+    };
+}
+/**
+ * The received units of `resource` that wait or were refused: held behind
+ * a change with their actor and sequence (SOP §14.1), waiting for a
+ * dependency (the profile's, or the previous unit of their actor, §26.2),
+ * refused when merging. Units of this client are never among them.
+ */
+export declare function receivedState(storage: Pick<LfcpStorage, "dataUnits">, resource: ResourceId): Promise<ReceivedState>;
+//# sourceMappingURL=section-status.d.ts.map

package/dist/section-status.js

@@ -0,0 +1,16 @@
+/**
+ * The received units of `resource` that wait or were refused: held behind
+ * a change with their actor and sequence (SOP §14.1), waiting for a
+ * dependency (the profile's, or the previous unit of their actor, §26.2),
+ * refused when merging. Units of this client are never among them.
+ */
+export async function receivedState(storage, resource) {
+    const ids = async (status) => (await storage.dataUnits.withStatus(resource, status)).map((u) => u.unitId);
+    const refused = (await storage.dataUnits.withStatus(resource, "profile-rejected")).map((u) => Object.freeze({ unitId: u.unitId, diagnostic: u.detail ?? "" }));
+    return Object.freeze({
+        held: Object.freeze(await ids("profile-held")),
+        waiting: Object.freeze([...(await ids("profile-pending")), ...(await ids("held"))]),
+        refused: Object.freeze(refused),
+    });
+}
+//# sourceMappingURL=section-status.js.map

package/dist/storage.d.ts

@@ -3,6 +3,7 @@ import { type ResourceDEK } from "@openlfcp/crypto";
 import { type CommitResult, type DataUnitRow, type LfcpStorage, type SecretStore, type StorageWrite } from "@openlfcp/storage";
 import { type ChainResult, type SeenRecord, type SeenUnits } from "@openlfcp/wire";
 import { type CreateDataUnitOptions, type CreatedDataUnit } from "./data-unit.js";
+import { type Receipt } from "./receipts.js";
 /**
  * The client code on top of the storage interfaces (LFCP-034), so that a
  * durable adapter (LFCP-035) is all a platform has to write.
@@ -33,6 +34,23 @@ export declare class StoredSeenUnits implements SeenUnits {
  * stored head back to Genesis. Undefined when nothing is stored.
  */
 export declare function loadControlChain(storage: Pick<LfcpStorage, "control">, resource: ResourceId): Promise<ChainResult | undefined>;
+/**
+ * The client's LOCAL Control Chain: the committed chain extended by this
+ * client's own queued Control Records that are still live (not yet
+ * acknowledged, and not blocked). A writer chains a new record on this
+ * local head, not the committed head, so records authored back to back
+ * (e.g. two invitations) carry consecutive sequence numbers and a linear
+ * `previous` instead of colliding on the committed head (§47,
+ * CONTROL_HEAD_MISMATCH). Blocked items are excluded: they will not land as
+ * they are, so nothing is chained on them (the re-proposal re-authors them).
+ *
+ * Returns the committed chain unchanged when there are no live pending
+ * records, `undefined` when the Resource has no stored chain, and the
+ * committed chain when the pending records do not extend it linearly (they
+ * are then left for the re-proposal to sort out, and the caller sees the
+ * committed head).
+ */
+export declare function localControlChain(storage: Pick<LfcpStorage, "control" | "outbound">, resource: ResourceId): Promise<ChainResult | undefined>;
 /**
  * Persists a validated linear chain in one atomic batch: its exact records,
  * the head (compare-and-set against `expected`), the epoch history (keeping
@@ -93,4 +111,32 @@ export declare function createQueuedDataUnit<T>(storage: Pick<LfcpStorage, "acto
      */
     readonly onCreated?: (created: CreatedDataUnit, value: T) => void;
 }, also?: readonly StorageWrite[] | ((created: CreatedDataUnit) => readonly StorageWrite[])): Promise<CreatedDataUnit>;
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.1 (LFCP-02-025): commits one operation, a
+ * batch of a profile's changes, as Data Units with their outbound entries,
+ * the caller's writes (`also`: its profile checkpoint) and the receipt, in
+ * ONE storage transaction: after a crash either all of it exists or none.
+ * The units chain their previous units in order (§26.2).
+ *
+ * Idempotent per (Resource, operationId) (§3.3): an operation that already
+ * has a receipt for the same intents returns it and writes nothing; for
+ * different intents it throws OperationIdReusedError. The caller stages
+ * its changes first and adopts them only once this resolves.
+ */
+export interface CommitOperationOptions<T> extends Omit<CreateDataUnitOptions<T>, "sequences" | "previousUnitId" | "value"> {
+    readonly operationId: string;
+    /** The batch's intents, as the caller submitted them (their canonical form is hashed, §3.3). */
+    readonly intents: readonly unknown[];
+    /** The batch's changes in order; each becomes one Data Unit. */
+    readonly values: readonly T[];
+    readonly affectedNodeIds: readonly string[];
+    /** The document's heads after the batch, sorted, as one string. */
+    readonly modelRevision: string;
+    /** Called for each sealed unit before the commit (e.g. the profile's recordLocal). */
+    readonly onCreated?: (created: CreatedDataUnit, value: T, index: number) => void;
+}
+export declare function commitOperation<T>(storage: Pick<LfcpStorage, "actorSequences" | "commit" | "dataUnits" | "localMarks">, options: CommitOperationOptions<T>, also?: readonly StorageWrite[] | ((units: readonly CreatedDataUnit[]) => readonly StorageWrite[])): Promise<{
+    readonly receipt: Receipt;
+    readonly committed: boolean;
+}>;
 //# sourceMappingURL=storage.d.ts.map

package/dist/storage.js

@@ -1,8 +1,10 @@
 import { actorSequence, bytesEqual, hash32, LfcpError, toHex, } from "@openlfcp/core";
 import { dekCommitment, importResourceDEK } from "@openlfcp/crypto";
 import { dekSecretRef, } from "@openlfcp/storage";
-import { parseDataUnit, validateControlChain, } from "@openlfcp/wire";
+import { parseControlRecord, parseDataUnit, validateControlChain, } from "@openlfcp/wire";
+import { receiptIndexWrites, replaceReleasedWrites } from "./batch-status.js";
 import { createDataUnit } from "./data-unit.js";
+import { intentsHash, OperationIdReusedError, receiptOf, receiptWrite, } from "./receipts.js";
 /**
  * The client code on top of the storage interfaces (LFCP-034), so that a
  * durable adapter (LFCP-035) is all a platform has to write.
@@ -85,6 +87,38 @@ export async function loadControlChain(storage, resource) {
         throw new LfcpError("INVALID_CONTROL_CHAIN", `the stored Control Records validate to sequence ${result.state.seq}, not the stored head at ${head.controlSeq} (local corruption)`);
     return result;
 }
+/**
+ * The client's LOCAL Control Chain: the committed chain extended by this
+ * client's own queued Control Records that are still live (not yet
+ * acknowledged, and not blocked). A writer chains a new record on this
+ * local head, not the committed head, so records authored back to back
+ * (e.g. two invitations) carry consecutive sequence numbers and a linear
+ * `previous` instead of colliding on the committed head (§47,
+ * CONTROL_HEAD_MISMATCH). Blocked items are excluded: they will not land as
+ * they are, so nothing is chained on them (the re-proposal re-authors them).
+ *
+ * Returns the committed chain unchanged when there are no live pending
+ * records, `undefined` when the Resource has no stored chain, and the
+ * committed chain when the pending records do not extend it linearly (they
+ * are then left for the re-proposal to sort out, and the caller sees the
+ * committed head).
+ */
+export async function localControlChain(storage, resource) {
+    const committed = await loadControlChain(storage, resource);
+    if (committed === undefined || committed.kind !== "linear")
+        return committed;
+    const pending = (await storage.outbound.list(resource))
+        .filter((i) => i.kind === "control-record" && i.blocked === null)
+        .map((i) => parseControlRecord(i.bytes))
+        .sort((a, b) => (a.payload.controlSeq < b.payload.controlSeq ? -1 : 1));
+    if (pending.length === 0)
+        return committed;
+    const extended = validateControlChain([
+        ...committed.records.map((r) => r.signed.bytes),
+        ...pending.map((p) => p.signed.bytes),
+    ]);
+    return extended.kind === "linear" ? extended : committed;
+}
 /**
  * Persists a validated linear chain in one atomic batch: its exact records,
  * the head (compare-and-set against `expected`), the epoch history (keeping
@@ -249,9 +283,13 @@ export async function createQueuedDataUnit(storage, options, also = []) {
 }
 async function createQueuedDataUnitNow(storage, options, also, resource, actor) {
     const { onCreated, previousUnitId, ...create } = options;
-    const previous = previousUnitId !== undefined
-        ? previousUnitId
-        : await latestAcceptedOwnUnit(storage, resource, actor);
+    const latest = await latestAcceptedOwnUnit(storage, resource, actor);
+    // §26.2: a null previous only when the writer holds no own unit as
+    // accepted (before its first, or after a first that went stale); while it
+    // holds one, a receiver that accepted it would hold this unit for good.
+    if (previousUnitId === null && latest !== null)
+        throw new LfcpError("INVALID_STRUCTURE", "the writer still holds an accepted own unit: its next unit names it as previous (§26.2)");
+    const previous = previousUnitId !== undefined ? previousUnitId : latest;
     const created = await createDataUnit({
         ...create,
         previousUnitId: previous,
@@ -286,4 +324,67 @@ async function createQueuedDataUnitNow(storage, options, also, resource, actor)
         throw new Error(`the local unit was not stored: ${result.reason}`);
     return created;
 }
+export async function commitOperation(storage, options, also = []) {
+    const resource = options.view.state.resourceId;
+    const actor = options.actor.descriptor.principalId;
+    return serialized(storage, `${toHex(resource)}:${toHex(actor)}`, async () => {
+        const hash = intentsHash(options.intents);
+        const existing = await receiptOf(storage, resource, options.operationId);
+        if (existing !== undefined) {
+            if (existing.intentsHash !== hash)
+                throw new OperationIdReusedError(options.operationId);
+            return { receipt: existing, committed: false };
+        }
+        const { onCreated, operationId, intents, values, affectedNodeIds, modelRevision, ...create } = options;
+        void intents;
+        const first = await latestAcceptedOwnUnit(storage, resource, actor);
+        const created = [];
+        let previous = first;
+        for (const [i, value] of values.entries()) {
+            const unit = await createDataUnit({
+                ...create,
+                value,
+                previousUnitId: previous,
+                sequences: storage.actorSequences,
+            });
+            onCreated?.(unit, value, i);
+            created.push(unit);
+            previous = unit.unitId;
+        }
+        const receipt = Object.freeze({
+            operationId,
+            unitIds: Object.freeze(created.map((u) => u.unitId)),
+            affectedNodeIds: Object.freeze([...affectedNodeIds]),
+            modelRevision,
+            intentsHash: hash,
+            durable: true,
+        });
+        const writes = [
+            { op: "expect-previous-unit", resourceId: resource, actor, previous: first },
+        ];
+        for (const unit of created) {
+            const row = dataUnitRow(unit.bytes);
+            writes.push({ op: "put-data-unit", unit: row, status: "merged", detail: "local", accepted: true }, {
+                op: "enqueue",
+                item: {
+                    itemId: hash32(unit.unitId),
+                    resourceId: row.resourceId,
+                    kind: "data-unit",
+                    bytes: unit.bytes,
+                    attempts: 0,
+                    lastAttempt: null,
+                    nextAttempt: null,
+                    blocked: null,
+                },
+            });
+        }
+        writes.push(
+        // A released batch kept for its status under this operation ID is replaced.
+        ...(await replaceReleasedWrites(storage, resource, options.operationId)), receiptWrite(resource, receipt), ...receiptIndexWrites(resource, receipt), ...(typeof also === "function" ? also(created) : also));
+        const result = await storage.commit(writes);
+        if (!result.ok)
+            throw new Error(`the operation was not stored: ${result.reason}`);
+        return { receipt, committed: true };
+    });
+}
 //# sourceMappingURL=storage.js.map

package/dist/sync-client.d.ts

@@ -1,12 +1,52 @@
-import { type ControlRecordId, type DataEpoch, type DataUnitId, type Hash32, type ResourceId } from "@openlfcp/core";
+import { type ControlRecordId, type DataEpoch, type DataUnitId, type Hash32, type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type AgreementKeyPair } from "@openlfcp/crypto";
-import { type LfcpStorage, type SecretStore } from "@openlfcp/storage";
+import { type LfcpStorage, type SecretStore, type StorageWrite } from "@openlfcp/storage";
 import { type ClientConnectionState, type DataProfileCodec, type HaveVector, type Signer } from "@openlfcp/wire";
 import type { ApplyOutcome, DataUnitApplier, EpochReconciliation } from "./apply.js";
 import type { ProfileCheckpointer } from "./checkpoint.js";
 import { type WebSocketFactory } from "./connection.js";
 import type { AckOutcome, NackOutcome, OutboundQueue, StaleOutboundUnit } from "./outbound.js";
+import { type Receipt } from "./receipts.js";
+import { type ReproposeOutcome } from "./repropose.js";
 import { type ResourcePhase } from "./resource-state.js";
+import { type RemainingPath, type RevocationRefusal } from "./revoke.js";
+import { type SectionState, type StatusEvent, type StatusSnapshot } from "./section-status.js";
+import { type AccessState, type WriteAccess } from "./write-access.js";
+/** LFCP-02-060: what revokeAccess did. */
+export type RevokeAccessResult = {
+    readonly kind: "queued";
+    /** The grants revoked, and those delegated from them that this deactivates (§17.2). */
+    readonly revoked: readonly ControlRecordId[];
+    readonly deactivated: readonly ControlRecordId[];
+    /** The queued Control Records: the revocations, then the Key Epoch if any. */
+    readonly recordIds: readonly ControlRecordId[];
+    /** The new Data Epoch, or null when it was not rotated. */
+    readonly epoch: DataEpoch | null;
+    /** The remaining readers who get the new DEK in Key Packages. */
+    readonly recipients: readonly PrincipalId[];
+    /** Grants this revoker may not revoke: the member keeps access through them. */
+    readonly remainingPaths: readonly RemainingPath[];
+} | {
+    readonly kind: "refused";
+    /**
+     * offline: the Resource is not live in this session; stale: the
+     * validated chain is behind what the server reported; control-pending:
+     * Control Records of this client are not committed yet. Nothing is
+     * queued: a removal never waits in an offline queue.
+     */
+    readonly reason: RevocationRefusal | "offline" | "stale" | "control-pending";
+    readonly message: string;
+};
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.6: a batch the SDK refuses before the
+ * profile sees it, with the same codes and fields as the profile's
+ * refusals. Nothing is written.
+ */
+export declare class CommitRefusedError extends Error {
+    readonly code: string;
+    readonly intentIndex: number;
+    constructor(code: string, message: string, intentIndex: number);
+}
 /**
  * The client sync session (LFCP-039a): one LFCP connection to a server and
  * the §65 machine of every Resource opened on it, orchestrating the parts
@@ -41,6 +81,37 @@ export interface SnapshotBinding<T> {
     load(value: T): void;
     current(): T;
 }
+/**
+ * SDK-SECTIONS-INTEGRATION-01 §3.1: a batch of intents a Data Profile has
+ * validated and changed on a copy of its state (for Shared Sections:
+ * SharedSectionsDataProfile.commitBinding().stage).
+ */
+export interface StagedOperation<T> {
+    /** The batch's changes in order: one Data Unit each. */
+    readonly values: readonly T[];
+    readonly affectedNodeIds: readonly string[];
+    /** The profile state's revision after the batch. */
+    readonly modelRevision: string;
+    /** Adopts the batch in the profile state, before the commit is stored. */
+    apply(): void;
+    /** Undoes apply(): the commit did not happen, or had happened before. */
+    revert(): void;
+    /** Writes stored with the units: the profile checkpoint that includes them. */
+    writes(units: readonly {
+        readonly unitId: DataUnitId;
+    }[]): readonly StorageWrite[];
+    /** Called once the commit is durable, with the units in order. */
+    committed(unitIds: readonly DataUnitId[]): void;
+}
+/** How a Resource's Data Profile commits local batches (§3.1). */
+export interface CommitBinding<T> {
+    /** The codec of this client's own units. */
+    readonly codec: DataProfileCodec<T>;
+    /** Validates and changes the batch on a copy; null when it writes nothing. Throws to refuse it. */
+    stage(intents: readonly unknown[]): StagedOperation<T> | null;
+    /** The section's state (SDK-SECTIONS-INTEGRATION-01 §4.3); undefined before there is a section. */
+    section?(): SectionState | undefined;
+}
 /** A Resource to synchronize: its Data Profile applier (and optional checkpoints and Snapshots). */
 export interface ResourceBinding {
     readonly resourceId: ResourceId;
@@ -48,6 +119,8 @@ export interface ResourceBinding {
     readonly checkpointer?: ProfileCheckpointer;
     /** Load an offered Snapshot instead of replaying every unit, and allow publishing. */
     readonly snapshot?: SnapshotBinding<unknown>;
+    /** Commit local batches with receipts (commit, receiptOf). */
+    readonly commit?: CommitBinding<unknown>;
 }
 /** When to try connecting again after the `attempt`-th failure (1, 2, …): a delay in ms, or null to stop. */
 export type ReconnectPolicy = (attempt: number) => number | null;
@@ -80,7 +153,8 @@ export interface SyncClientOptions {
     readonly dataProfiles?: readonly string[];
     /**
      * Whether to publish a Snapshot of a LIVE Resource now, asked on every
-     * tick with the number of units merged since the last one; no automatic
+     * tick with the number of units merged since the last one, received or
+     * committed here (a section's only writer reaches it too); no automatic
      * schedule otherwise (publishSnapshot can also be called directly).
      */
     readonly snapshotPolicy?: (resourceId: ResourceId, unitsSinceLast: number) => boolean;
@@ -142,6 +216,12 @@ export type SyncEvent = {
     readonly type: "ack";
     readonly outcome: AckOutcome;
 }
+/** SDK-SECTIONS-INTEGRATION-01 §5: the Resource's status stream (statusSnapshot after a gap). */
+ | {
+    readonly type: "status";
+    readonly resourceId: ResourceId;
+    readonly event: StatusEvent;
+}
 /** A NACK of an outbound object: stale, equivocation alarm, rejected, repropose, … */
  | {
     readonly type: "nack";
@@ -168,6 +248,34 @@ export type SyncEvent = {
     readonly outcome: "hosted" | "refused";
     readonly code?: string;
 }
+/**
+ * RESOURCE_OPEN was refused with AUTHORIZATION_FAILED although this
+ * client's validated chain grants it data/read: the server may have lost
+ * Control Records in a restore (LFCP-02-106). "started": the client
+ * re-supplies its chain with CONTROL_PUT; "recovered": the server opened
+ * the Resource again after it; "ended": no recovery, with the reason (see
+ * RecoveryEnd, or "still-refused" when the server holds our chain and
+ * still refuses), and the refusal stands.
+ */
+ | {
+    readonly type: "access-recovery";
+    readonly resourceId: ResourceId;
+    readonly url: string;
+    readonly outcome: "started" | "recovered" | "ended";
+    readonly reason?: string;
+}
+/**
+ * This client's own Control Records that a moved head refused
+ * (CONTROL_HEAD_MISMATCH) were re-proposed on the current head, or dropped
+ * when no longer authorized or meaningful (repropose.ts). One outcome per
+ * record; a copied invitation link keeps working, as a re-proposed grant
+ * keeps the same Invitation Principal and claim parameters.
+ */
+ | {
+    readonly type: "repropose";
+    readonly resourceId: ResourceId;
+    readonly outcomes: readonly ReproposeOutcome[];
+}
 /**
  * The server refused the Resource for good (see ResourceRefusal): it is
  * CLOSED and is not opened again until open() is called for it.
@@ -212,6 +320,13 @@ export declare class SyncClient {
     constructor(options: SyncClientOptions);
     /** Subscribes to session events; returns the unsubscribe function. */
     on(listener: (event: SyncEvent) => void): () => void;
+    /**
+     * §5: the complete status of `resource` at the stream's current revision:
+     * every unreleased batch, the received units that wait or were refused,
+     * the section state and write access. Events at or below its revision
+     * are already in it.
+     */
+    statusSnapshot(resource: ResourceId): Promise<StatusSnapshot>;
     /** Resolves once every message received so far has been handled (tests and shutdown). */
     idle(): Promise<void>;
     get connectionState(): ClientConnectionState;
@@ -242,6 +357,49 @@ export declare class SyncClient {
      * that loads it never skips content the state does not hold. Queued and
      * sent like any object; returns its ID.
      */
+    /**
+     * LFCP-02-060: removes `subject`'s access to `resource`. Every active
+     * grant naming it that this client may revoke is revoked (§17.3); when it
+     * has no read access left, the Data Epoch is rotated with a fresh DEK
+     * (§19, member revoked) and the DEK goes in Key Packages to every other
+     * remaining reader (§25), so it cannot read new data. Built on the
+     * validated head and checked before anything is queued; the records, the
+     * Key Packages and (first) the new DEK are written at once, then sent.
+     * Refused, with nothing queued, unless the Resource is live and current
+     * here and no Control Record of this client is pending.
+     */
+    revokeAccess(resource: ResourceId, subject: PrincipalId, options?: {
+        readonly rotate?: boolean;
+    }): Promise<RevokeAccessResult>;
+    /**
+     * SDK-SECTIONS-INTEGRATION-01 §3.1: commits a batch of intents on an open
+     * Resource and returns its receipt once the batch is durable: its Data
+     * Units, outbound entries, the profile checkpoint and the receipt are
+     * stored in one transaction, then the batch is sent. An operation that
+     * has a receipt returns it for the same intents and writes nothing, and
+     * throws OperationIdReusedError for different ones (§3.3). Runs between
+     * received units, never during their merge.
+     */
+    commit(resource: ResourceId, intents: readonly unknown[], options: {
+        readonly operationId: string;
+    }): Promise<Receipt>;
+    /**
+     * SDK-SECTIONS-INTEGRATION-01 §6: whether this client may commit to
+     * `resource`, from the validated Control state only: the chain of the
+     * last Control sync, or the stored chain validated now. `verifiedAt` is
+     * the local time of that validation (the last sync's when the stored
+     * chain is still at its head). Unknown without a validated chain.
+     */
+    canWrite(resource: ResourceId): Promise<WriteAccess>;
+    /**
+     * LFCP-02-027: write access with its evidence: the Control sequence it
+     * was validated at against the highest one a server reported in this
+     * session (a stale view is not current), the effective abilities and
+     * the active grant paths giving them, and apart from them the
+     * invitations we issued, our Control Records not yet committed (SI14)
+     * and an unsettled invitation claim of ours.
+     */
+    accessState(resource: ResourceId): Promise<AccessState>;
     publishSnapshot(resource: ResourceId): Promise<Hash32>;
 }
 /**