@peabody-soft/mbs-model-ts 1.0.0

package/dist/Model.js

@@ -0,0 +1,629 @@
+import { Constants as proto_Constants } from "./generated/Constants";
+import { CreateUserRequest as proto_CreateUserRequest } from "./generated/CreateUserRequest";
+import { FulfillmentMode as proto_FulfillmentMode } from "./generated/FulfillmentMode";
+import AuthTokens from "./AuthTokens";
+import * as ContainerNames from "./ContainerNames";
+import { IllegalOperationException, InvalidArgumentException } from "./Exceptions";
+import Ids from "./Ids";
+import LiveData from "./LiveData";
+import * as ProtoMap from "./ProtoMap";
+import { InternalServerException } from "./ServiceExceptions";
+import SyncCache from "./SyncCache";
+// The root of the object model, and the only thing a UI has to be given. Call initialize once,
+// then always fetch the current instance via getInstance.
+class Model {
+    constructor() {
+        this._business = new LiveData(null);
+        this._profile = new LiveData(null);
+        this._authenticationMethod = null;
+        this._subjectId = null;
+        this._authenticationToken = null;
+        this._businessId = null;
+    }
+    // Sets the service and store to use, and forgets who is signed in and what was being browsed
+    static initialize(service, database) {
+        Model._service = service;
+        Model._cache = new SyncCache(database);
+        Model._instance = null;
+    }
+    // The model as it is now. Ask for it every time; never keep it - see the note on this class.
+    static getInstance() {
+        return Model._instance ?? (Model._instance = new Model());
+    }
+    // The business being browsed. Null until setBusinessId has named one and it has loaded.
+    get business() {
+        return this._business;
+    }
+    // The customer, their businesses, and the link to each - one LiveData since useful questions
+    // span all three. Null until signed in and loaded.
+    get profile() {
+        return this._profile;
+    }
+    // Signs in with the given credentials and syncs this subject's profile in - for a subject the
+    // server already has a profile for; createUser is what a subject with none yet uses instead. Also
+    // reads in the business being browsed, if any, now signed in as this customer.
+    async signIn(authenticationMethod, subjectId, authenticationToken) {
+        this.beginSignIn(authenticationMethod, subjectId, authenticationToken);
+        const authTokens = await this.requireProfileAuthTokens();
+        await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequestFromCache(await Model.getCache().readProfile(this.requireProfileContainerName())), authTokens);
+        if (this._businessId !== null)
+            await this.businessSyncIn();
+    }
+    // Signs up with the given credentials, creating userToCreate as this subject's profile - for a
+    // subject the server has no profile for yet; signIn is what an already known subject uses instead.
+    // Also reads in the business being browsed, if any, now signed in as this customer.
+    async createUser(authenticationMethod, subjectId, authenticationToken, userToCreate) {
+        this.beginSignIn(authenticationMethod, subjectId, authenticationToken);
+        const authTokens = await this.requireProfileAuthTokens();
+        await this.createProfileOnServer(proto_CreateUserRequest.create({ user: ProtoMap.buildUser(userToCreate) }), authTokens);
+        if (this._businessId !== null)
+            await this.businessSyncIn();
+    }
+    // Updates this customer's own profile with what userProfile now holds. Service.updateUser matches
+    // the caller against the User it is sent by entity id - see ProtoMap.buildUpdateUser - so
+    // userProfile must be this customer's own, previously read in rather than built fresh.
+    // Requires a profile already read, the same "signed in" a business write needs of its profile half
+    // - see requireCustomerOfBusiness. Not paged, and today publishes nothing: its response carries no
+    // entities, only whatever the server reissued - see writeProfileResponse.
+    async updateUser(userProfile) {
+        if (this._profile.value === null)
+            throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
+        await this.writeProfileResponse(await Model.getService().updateUser(ProtoMap.buildUpdateUser(userProfile), await this.requireProfileAuthTokens()));
+    }
+    // Discards this model outright: the next getInstance() builds a fresh one, signed out and
+    // browsing nothing.
+    async signOut() {
+        Model._instance = null;
+    }
+    // Names the business to browse and reads it in, publishing null first so a stale or
+    // about-to-be-replaced Business is never shown as the one now being browsed.
+    async setBusinessId(businessId) {
+        this._businessId = businessId;
+        this.publishBusiness(null);
+        await this.businessSyncIn();
+    }
+    // #region What a customer writes
+    //
+    // The only writes in this library: this customer's cart at the business being browsed, and an
+    // order placed from it. An order pushes to the server and touches the store only once the server
+    // accepts, so a failed call leaves nothing to reconcile and a caller just retries: an order
+    // stored here that the server never saw would be one a customer believes they placed and a
+    // merchant has never heard of. A cart is not held to that, and updateCartLocalOnly is the whole
+    // of the difference.
+    // Both need this customer to be a member of the business being browsed - three separate things
+    // to be missing, so three separate failures; see requireCustomerOfBusiness.
+    // Creates or replaces this customer's cart, in the store and on the server both. An empty list
+    // empties the cart - an emptied cart and one never created are the same state here, on the wire
+    // and in what Business.cart answers.
+    // Signed out this is updateCartLocalOnly, there being no cart on the server for a visitor the
+    // server has not been told about. Signed in it is a push, so it costs a request: a caller
+    // editing a cart a tap at a time writes with updateCartLocalOnly and calls this one on whatever
+    // schedule it likes.
+    // Calling it with a cart the server already has costs nothing: it returns without a request. So a
+    // caller is free to call it on every event it cares about - a page hidden, a timer, both at
+    // once - without tracking what it last sent, and what it checks against is the store's own copy
+    // rather than a caller's idea of one. It is not a substitute for reading the business, though: a
+    // push answers with whatever else of this customer's changed, and a call that does not go out
+    // brings none of that back.
+    async updateCart(shoppingList) {
+        if (this._profile.value === null)
+            return this.updateCartLocalOnly(shoppingList);
+        const target = this.requireCustomerOfBusiness();
+        const stored = await Model.getCache().readCart(target.containerName);
+        const cartMessage = ProtoMap.buildCartMessage(Ids.getPartyPreferencesMessageId(target.businessLink.id), stored, target.senderId, shoppingList, BigInt(Date.now()));
+        if (!ProtoMap.isCartWorthPushing(stored, cartMessage))
+            return;
+        await this.pushBusinessMessages(target, [cartMessage]);
+    }
+    // The same, stored here and not sent. This is the call to make on every edit: a cart is worth
+    // keeping the moment a customer changes it, and a request per tap of a quantity stepper is not
+    // worth making. updateCart then sends whatever the caller has reached whenever it decides to -
+    // debounced, on the page being hidden, before signing in.
+    //
+    // Little is lost by a cart that is only ever stored. It survives the tab closing, the next
+    // updateCart sends it, and createOrder reads the cart from the store and carries that list in
+    // the order message itself - so an order placed from a cart never sent on its own is still the
+    // right order. What a caller gives up is that the server, and so this customer's other devices,
+    // learn of a change only when the next updateCart goes out.
+    //
+    // The store keeps whichever copy has the greater eTag, and buildCartMessage dates an amendment
+    // past the copy it replaces, so a cart stored here cannot be undone by a sync in bringing the
+    // server's older one back.
+    async updateCartLocalOnly(shoppingList) {
+        // No membership to derive a cart id from while nobody is signed in (see
+        // Ids.getPartyPreferencesMessageId) and none to be had until somebody signs in, so one is
+        // drawn - once, and only once: buildCartMessage amends the cart already stored and keeps its
+        // own id, so a second write cannot leave two behind. The sender is ENTITY_ID_NULL for want of
+        // a User, and the first push after signing in names the real one.
+        if (this._profile.value === null)
+            return this.storeCart(ContainerNames.forBusiness(this.requireBusinessBeingBrowsed()), Ids.getNewId(proto_Constants.MESSAGE_ENTITY_TYPE_ID), BigInt(proto_Constants.ENTITY_ID_NULL), shoppingList);
+        const target = this.requireCustomerOfBusiness();
+        return this.storeCart(target.containerName, Ids.getPartyPreferencesMessageId(target.businessLink.id), target.senderId, shoppingList);
+    }
+    // Places an order for what is in the cart, and empties it - the list is used up becoming the
+    // order, as Java SalesOrderViewModel.saveChanges does on MODE_CREATE. Takes no shopping list
+    // itself for that reason: the cart is the order.
+    // A delivery must name an address, either an id from this customer's own list or a full address
+    // sent directly - see requireDeliveryAddress.
+    async createOrder(fulfillmentMode, deliveryAddressId, deliveryAddress, note) {
+        const target = this.requireCustomerOfBusiness();
+        // Read from the store, not the published Business, so the order reflects the cart as the
+        // server last confirmed it, not a value some observer may still hold
+        const cartMessage = await Model.getCache().readCart(target.containerName);
+        const shoppingList = cartMessage === null ? null : ProtoMap.buildCart(cartMessage);
+        if (shoppingList === null || shoppingList.existingItems.length === 0)
+            throw new IllegalOperationException("The cart holds nothing, so there is no order to place");
+        Model.requireDeliveryAddress(target.addresses, fulfillmentMode, deliveryAddressId, deliveryAddress);
+        // One creation time for both, and it is what the order was placed at
+        const now = BigInt(Date.now());
+        // Order and emptied cart in one request: two calls could leave a customer with an order placed
+        // but a cart still full, if the second one failed
+        await this.pushBusinessMessages(target, [
+            ProtoMap.buildOrderMessage(Ids.getNewId(proto_Constants.MESSAGE_ENTITY_TYPE_ID), target.senderId, shoppingList, fulfillmentMode, deliveryAddressId, deliveryAddress, note, now),
+            ProtoMap.buildCartMessage(Ids.getPartyPreferencesMessageId(target.businessLink.id), cartMessage, target.senderId, null, now),
+        ]);
+    }
+    // #endregion
+    // Throws if a profile is already held; otherwise stores the credentials every later call signs
+    // with. The one step signIn and createUser share before parting ways over how each gets a profile.
+    beginSignIn(authenticationMethod, subjectId, authenticationToken) {
+        if (this._profile.value !== null)
+            throw new IllegalOperationException("A user is already signed in");
+        this._authenticationMethod = authenticationMethod;
+        this._subjectId = subjectId;
+        this._authenticationToken = authenticationToken;
+    }
+    // #region Pushing
+    // One push, plus everything that follows a server accepting it. The messages go out in one
+    // request, over this business container's own cursor, and the server answers with what has
+    // changed since - these messages under their assigned update numbers, plus anything else of this
+    // customer's a later sync would also pick up. A server that refuses the push fails the call
+    // itself, same as any other Service call on a bad status, so there is nothing left here to check:
+    // reaching the write below already means the server took it.
+    async pushBusinessMessages(target, messages) {
+        const cache = Model.getCache();
+        const messageUpdateNumber = await cache.readMessageUpdateNumber(target.containerName);
+        const authTokens = await this.requireBusinessAuthTokens(target.containerName, target.businessLink);
+        const response = await Model.getService().businessSyncIn(ProtoMap.buildBusinessSyncInRequest(messageUpdateNumber, messages), ProtoMap.buildAuthTokens(authTokens));
+        await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(response), target.containerName);
+        // Stored exactly as the response carried it, entities and all - no stamping step, because the
+        // server already answered with the messages themselves rather than a bare number to reapply
+        const changeCount = await cache.writeMessages(target.containerName, ProtoMap.getSyncInResponseMessages(response));
+        // What the store took decides whether anything is published - see the Publishing region
+        if (changeCount !== 0)
+            this.publishBusiness(await cache.readBusiness(target.containerName));
+    }
+    // One cart into one container, amending whatever is there already. Both halves of
+    // updateCartLocalOnly end here, differing only in which container, which id and which sender:
+    // the container an anonymous read filled, with a drawn id and no sender, or the membership's,
+    // with the id derived from it and the customer's own.
+    // A visitor's copy goes into the container the anonymous read filled, which is what carries it
+    // across a sign in: the container named for a new membership is seeded from that one - see
+    // syncCustomerBusiness.
+    async storeCart(containerName, cartMessageId, senderId, shoppingList) {
+        const cache = Model.getCache();
+        const changeCount = await cache.writeCart(containerName, ProtoMap.buildCartMessage(cartMessageId, await cache.readCart(containerName), senderId, shoppingList, BigInt(Date.now())));
+        // Published on what the store took, the same rule every read and push keeps
+        if (changeCount !== 0)
+            this.publishBusiness(await cache.readBusiness(containerName));
+    }
+    // The business being browsed, refused by name when there is none or it has not been read yet.
+    // Shared by every write, because neither has anything to write to without it.
+    requireBusinessBeingBrowsed() {
+        const businessId = this._businessId;
+        if (businessId === null)
+            throw new IllegalOperationException("No business is being browsed, so there is nothing to write to");
+        if (this._business.value === null)
+            throw new IllegalOperationException(`Business ${businessId} has not been read yet, so there is nothing to write to`);
+        return businessId;
+    }
+    // Everything a write needs, gathered before anything is built. Each precondition is refused by
+    // name rather than one unhelpful "not ready": no business browsed, one not yet loaded, no profile
+    // loaded, or a customer who isn't a member - the last being what the server would refuse anyway,
+    // for want of a link token to sign with.
+    requireCustomerOfBusiness() {
+        const businessId = this.requireBusinessBeingBrowsed();
+        const profile = this._profile.value;
+        const user = profile?.user ?? null;
+        if (profile === null || user === null)
+            throw new IllegalOperationException("No profile has been read, so who is writing is not known");
+        const businessLink = profile.getBusinessLinkFor(businessId);
+        if (businessLink === null)
+            throw new IllegalOperationException(`This customer is not a member of business ${businessId}, so they may not write to it`);
+        return {
+            businessLink: businessLink,
+            containerName: Model.getBusinessContainerName(businessLink),
+            senderId: user.id,
+            addresses: user.addresses,
+        };
+    }
+    // Where an order is delivered: an id into this customer's own address list (the same list
+    // Order.deliveryAddressId resolves against) or a full address sent directly. An id not in that
+    // list would leave the business holding an order it can't read, so it's refused here rather than
+    // sent; a full address carries everything it needs and so isn't checked against the list.
+    static requireDeliveryAddress(addresses, fulfillmentMode, deliveryAddressId, deliveryAddress) {
+        if (deliveryAddress !== null)
+            return;
+        if (deliveryAddressId === BigInt(proto_Constants.ENTITY_ID_NULL)) {
+            // Pick-up is the case that names neither, which is normal - see Order.deliveryAddressId
+            if (fulfillmentMode === proto_FulfillmentMode.DELIVERY)
+                throw new InvalidArgumentException("An order to be delivered has to name a delivery address");
+            return;
+        }
+        if (addresses.getAddress(deliveryAddressId) === null)
+            throw new InvalidArgumentException(`This customer has no address ${deliveryAddressId}, so an order cannot be delivered to it`);
+    }
+    // #endregion
+    // #region The four calls of Service, each as this model makes it
+    //
+    // Each is complete in itself: it pages, caches every page as it arrives, files what the server
+    // issued, and publishes what the cache then holds.
+    // Reads in the business being browsed. An anonymous visitor reads it straight, under its own
+    // businessId. A signed-in customer reads it under their own container instead - see
+    // getBusinessContainerName - joining as a customer first if not already linked - see
+    // requireBusinessLink.
+    async businessSyncIn() {
+        const businessId = this._businessId;
+        if (businessId === null || businessId.length === 0)
+            throw new IllegalOperationException("No business is being browsed, so there is nothing to read");
+        const profile = this._profile.value;
+        if (profile === null) {
+            await this.syncAnonymousBusiness(businessId);
+            return;
+        }
+        const link = await this.requireBusinessLink(businessId, profile);
+        const cache = Model.getCache();
+        const containerName = Model.getBusinessContainerName(link);
+        // Seeded from the plain businessId container's cache, the one time this customer's own
+        // container does not exist yet - sparing a full redownload of a business already browsed, and
+        // carrying over the cart of the visit before this sign in.
+        if ((await cache.readBusiness(containerName)) === null) {
+            const anonymousName = ContainerNames.forBusiness(businessId);
+            const anonymous = await cache.readBusiness(anonymousName);
+            if (anonymous !== null) {
+                await cache.writeBusiness(containerName, anonymous);
+                // That cart now belongs to this membership, so the copy left behind is dropped. The plain
+                // container is what the next anonymous visitor reads, and what the next customer to sign in
+                // is seeded from, and a cart is one customer's. Deleted after the copy and not before, so a
+                // failed copy leaves the cart where it was rather than losing it.
+                await cache.deleteCart(anonymousName);
+            }
+        }
+        const authTokens = await this.requireBusinessAuthTokens(containerName, link);
+        await this.syncBusinessContainer(containerName, businessId, ProtoMap.buildAuthTokens(authTokens));
+    }
+    // The plain businessId-named container: an anonymous read, before signing in or joining, or to
+    // learn a business's entity id while joining - see readJoinBusinessId.
+    async syncAnonymousBusiness(businessId) {
+        await this.syncBusinessContainer(ContainerNames.forBusiness(businessId), businessId, null);
+    }
+    // One business, cache first: what's already held publishes before the network is touched, so a
+    // returning customer sees the shop at once instead of a loading state. Cursors start from
+    // whatever containerName already holds, not zero, so a repeat call asks only what changed - see
+    // ProtoMap.buildBusinessSyncOutRequestFromCache.
+    async syncBusinessContainer(containerName, businessId, firstAuthTokens) {
+        const cache = Model.getCache();
+        const cached = await cache.readBusiness(containerName);
+        this.publishBusiness(cached);
+        let request = ProtoMap.buildBusinessSyncOutRequestFromCache(businessId, cached);
+        let authTokens = firstAuthTokens;
+        // What the store accepted - blobs stored plus ids deleted - which decides the publish at the end
+        let changeCount = 0;
+        for (;;) {
+            const page = await Model.getService().businessSyncOut(request, authTokens);
+            const issued = ProtoMap.getResponseAuthTokens(page);
+            // Written as it arrives, not at the end, so an interrupted read merely repeats itself instead
+            // of losing pages already received. Entities and tombstones go in together, one write per page.
+            changeCount += await cache.writeBusiness(containerName, page);
+            await this.storeIssuedTokens(issued, containerName);
+            // Null when this was the last page: fewer than a full page came back, or a full one advanced
+            // no cursor - which only a server breaking its own ordering can do
+            const next = ProtoMap.nextBusinessSyncOutRequest(request, page);
+            if (next === null)
+                break;
+            // The next page asks from where this one got to, signed with any token this one reissued
+            request = next;
+            authTokens = ProtoMap.refreshAuthTokens(authTokens, issued);
+        }
+        // A read the store took nothing from re-renders nobody - already published above from cache,
+        // and nothing here changes what a later read of this container answers
+        if (changeCount === 0)
+            return;
+        this.publishBusiness(await cache.readBusiness(containerName));
+    }
+    // The BusinessLink of this profile for the named business, joining as a customer first (once) if
+    // not linked yet. A business in the profile with no matching link is a server inconsistency, not
+    // something a join would fix, so that case throws directly.
+    async requireBusinessLink(businessId, profile) {
+        if (profile.user === null)
+            throw new IllegalOperationException("No profile has been read, so who is browsing is not known");
+        const link = Model.findBusinessLink(profile, businessId);
+        if (link !== null)
+            return link;
+        if (Model.findBusinessEntity(profile, businessId) !== null)
+            throw new InternalServerException(`This customer has no BusinessLink to business ${businessId}`);
+        const joinBusinessId = await this.readJoinBusinessId(businessId);
+        await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequestFromCache(await Model.getCache().readProfile(this.requireProfileContainerName()), joinBusinessId), await this.requireProfileAuthTokens());
+        // Attempted once: a join that still leaves no link is the server contradicting itself, not
+        // something retrying would fix.
+        const joined = this._profile.value;
+        const joinedLink = joined === null ? null : Model.findBusinessLink(joined, businessId);
+        if (joinedLink === null)
+            throw new InternalServerException(`Joining business ${businessId} did not leave this customer's profile naming it`);
+        return joinedLink;
+    }
+    // The entity id to join, for a business this profile doesn't list yet. Read off the Business
+    // already held, if an anonymous visit left one behind, or off a fresh anonymous read otherwise.
+    async readJoinBusinessId(businessId) {
+        const alreadyHeld = this._business.value;
+        if (alreadyHeld !== null)
+            return alreadyHeld.id;
+        await this.syncAnonymousBusiness(businessId);
+        const business = this._business.value;
+        if (business === null)
+            throw new InternalServerException(`Business ${businessId} does not exist`);
+        return business.id;
+    }
+    static findBusinessEntity(profile, businessId) {
+        for (const business of profile.businesses)
+            if (business.businessId === businessId)
+                return business;
+        return null;
+    }
+    // Null unless both the business and a link naming this profile's own user are present - a
+    // membership is both of those together, not either alone.
+    static findBusinessLink(profile, businessId) {
+        const user = profile.user;
+        const businessEntity = Model.findBusinessEntity(profile, businessId);
+        if (user === null || businessEntity === null)
+            return null;
+        for (const link of profile.businessLinks)
+            if (link.businessId === businessEntity.id && link.linkedEntityId === user.id)
+                return link;
+        return null;
+    }
+    // Where this customer's own copy of a business lives, named for the BusinessLink rather than
+    // Business.businessId so a signed-in customer's data never mixes with an anonymous visit to the
+    // same storefront. Hex for the same reason as Ids.toStorageHexString: a fixed-width,
+    // case-sensitive name.
+    static getBusinessContainerName(link) {
+        return ContainerNames.forBusiness(Ids.toStorageHexString(link.id));
+    }
+    // The credentials that sign a call about a customer's own business container. The authentication
+    // token always comes from memory, never a cache read, for the same reason buildProfileAuthTokens
+    // reads it that way: a stored AuthTokens never persists it.
+    // The user token and link token are read independently off whatever this container has reissued,
+    // rather than as one object - storeIssuedTokens overwrites the whole blob per call, so trusting
+    // only that would lose whichever of the two a call didn't reissue. Each falls back to its own
+    // source instead: the profile container's user token, and this link's own linkToken - exactly
+    // what a fresh membership lacks, and what the write below now gives this container to reissue
+    // over. A link with no linkToken at all could never sign a call, so that is a server
+    // inconsistency, thrown rather than sent unsigned.
+    async requireBusinessAuthTokens(containerName, link) {
+        const authenticationMethod = this._authenticationMethod;
+        const authenticationToken = this._authenticationToken;
+        if (authenticationMethod === null || authenticationToken === null)
+            throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
+        const cache = Model.getCache();
+        const issuedHere = await cache.readAuthTokens(containerName);
+        const linkToken = issuedHere?.linkToken ?? link.linkToken;
+        if (linkToken === null)
+            throw new InternalServerException(`BusinessLink ${link.id} carries no linkToken, so it cannot sign a call`);
+        const profileContainerName = this.getProfileContainerName();
+        const userToken = issuedHere?.userToken ??
+            (profileContainerName === null
+                ? null
+                : ((await cache.readAuthTokens(profileContainerName))?.userToken ?? null));
+        const authTokens = new AuthTokens(authenticationMethod, authenticationToken, userToken, linkToken);
+        if (issuedHere === null)
+            await cache.writeAuthTokens(containerName, authTokens);
+        return authTokens;
+    }
+    // The profile of whoever is signed in, paged the same way. Everything it earns files in the
+    // profile container - this call is entirely about the caller, so its AuthTokens never carries a
+    // link token; the only linkToken the protocol sends travels inside a BusinessLink, stored as part
+    // of the profile.
+    async profileSyncIn(firstRequest, firstAuthTokens) {
+        const containerName = this.getProfileContainerName();
+        if (containerName === null)
+            return null;
+        const cached = await Model.getCache().readProfile(containerName);
+        this.publishProfile(cached);
+        let request = firstRequest;
+        let authTokens = firstAuthTokens;
+        let changeCount = 0;
+        // Tracked across every page, not just the first: a profile long enough to page could put the
+        // joined link and business on different pages, and two flags cost nothing next to relying on that.
+        const joinBusinessId = firstRequest.joinBusinessId;
+        let hasJoinedLink = false;
+        let hasJoinedBusiness = false;
+        for (;;) {
+            const page = await Model.getService().profileSyncOut(request, authTokens);
+            changeCount += await this.cacheProfileResponse(containerName, page);
+            if (ProtoMap.hasJoinedBusinessLink(joinBusinessId, page))
+                hasJoinedLink = true;
+            if (ProtoMap.hasJoinedBusiness(joinBusinessId, page))
+                hasJoinedBusiness = true;
+            const next = ProtoMap.nextProfileSyncOutRequest(request, page);
+            if (next === null)
+                break;
+            request = next;
+            // Each call after the first is signed with whatever the page before it reissued - a read of
+            // many pages is where a token can fall due part way through
+            authTokens = ProtoMap.refreshAuthTokens(authTokens, ProtoMap.getResponseAuthTokens(page));
+        }
+        // As above: nothing the store took, nothing published
+        let response = cached;
+        if (changeCount !== 0) {
+            response = await Model.getCache().readProfile(containerName);
+            this.publishProfile(response);
+        }
+        // Last, so everything that arrived is cached and published first: those pages weren't at
+        // fault, the join was
+        Model.requireJoinedBusiness(joinBusinessId, hasJoinedLink, hasJoinedBusiness);
+        return response;
+    }
+    // The sign-up call. Never paged: resending it would create a second user, and a caller signing up
+    // has at most their new User, one BusinessLink and the Business it names. It can join a business
+    // in the same call, and a join's requirements are the same as on a profile read - one response
+    // instead of several is the only difference.
+    async createProfileOnServer(request, authTokens) {
+        const response = await this.writeProfileResponse(await Model.getService().createUser(request, authTokens));
+        const joinBusinessId = request.joinBusinessId;
+        // Raised after the response is cached and published, as on a profile read - sharper here since
+        // the User exists regardless of the join, so discarding this response and signing up again
+        // would create a second one
+        Model.requireJoinedBusiness(joinBusinessId, ProtoMap.hasJoinedBusinessLink(joinBusinessId, response), ProtoMap.hasJoinedBusiness(joinBusinessId, response));
+        return response;
+    }
+    // #endregion
+    // #region Driving one call
+    // A join that was asked for but not answered. Shared by both calls that can carry a
+    // joinBusinessId, since what a join must return doesn't depend on which one asked: the
+    // BusinessLink (the membership) and the Business it names. Both are needed to reach a business -
+    // the link for its token, the Business for the url-friendly id everything else is built from - so
+    // either one missing leaves the caller told it's a customer of something it can't reach.
+    //
+    // A ServiceException, not one of Exceptions.ts: nothing the caller passed was wrong - the server
+    // answered 200 and left out what was asked for - so a caller can retry or carry on with what's
+    // cached. 500 is the closest code, and the one that says retrying is worth it.
+    //
+    // Only a joinBusinessId a server could act on is checked (Java Business.isValidBusinessId's test,
+    // which Constants.ENTITY_ID_NULL also fails, so "no join asked" needs no case of its own). An id
+    // that isn't a business entity id isn't a failure here: a server ignores it rather than refusing
+    // it (see THE MOCKS), and sending one is the caller's bug, not the server's.
+    static requireJoinedBusiness(joinBusinessId, hasBusinessLink, hasBusiness) {
+        if (Ids.getEntityTypeId(joinBusinessId) !== proto_Constants.BUSINESS_ENTITY_TYPE_ID)
+            return;
+        if (hasBusinessLink && hasBusiness)
+            return;
+        const missing = hasBusinessLink === hasBusiness
+            ? "BusinessLink or Business"
+            : hasBusinessLink
+                ? "Business"
+                : "BusinessLink";
+        throw new InternalServerException(`A join of business ${joinBusinessId} was answered with no ${missing}`);
+    }
+    // What every profile response leaves in the store: its entities cached, and whatever it reissued
+    // filed against the same container. Answers how much of it the store took, which is what decides
+    // whether anything is published. Shared by all three calls that receive one - each page of a read,
+    // a sign up and an update - so none of them can come to cache a response differently from the
+    // others, or file a token in a different place. Publishing is not in here: a read publishes once
+    // for a whole loop of these, and the other two once each.
+    async cacheProfileResponse(containerName, response) {
+        const changeCount = await Model.getCache().writeProfile(containerName, response);
+        await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(response), containerName);
+        return changeCount;
+    }
+    // What a non-sync-out profile call leaves behind: the response cached and published, same as a
+    // paged read, minus paging neither needs. Both calls that come through here - a sign up and an
+    // update - publish on exactly the rule a read keeps, which is what the store took. An update
+    // publishes nothing today only because the server puts no entities in that response: it answers
+    // with whatever it reissued and nothing else, the caller already knowing what it sent. The day it
+    // answers with the stored User - whose update number and updated time a caller cannot know - this
+    // publishes it with no change here.
+    async writeProfileResponse(response) {
+        const containerName = this.getProfileContainerName();
+        if (containerName === null)
+            return response;
+        if ((await this.cacheProfileResponse(containerName, response)) !== 0)
+            this.publishProfile(await Model.getCache().readProfile(containerName));
+        return response;
+    }
+    // Files what a call earned against the container that call was about: a profile call's tokens in
+    // the subject's profile container, a business call's in that business's container. Which call it
+    // was decides this, not which token arrived - a token carries nothing saying what it's about, so
+    // only the caller, which knows what it asked, can attribute one. A business sync out that reissues
+    // a user token still files that copy with the business it came back from.
+    // A profile call never carries a link token here - a membership's link token travels inside its
+    // BusinessLink entity instead, stored with the rest of the profile.
+    // A failed write is swallowed: the server issues another next call, so losing one costs a round
+    // trip, where surfacing it would turn a working read into a thrown one.
+    async storeIssuedTokens(issued, containerName) {
+        if (issued === undefined)
+            return;
+        try {
+            await Model.getCache().writeAuthTokens(containerName, ProtoMap.authTokensFromProto(issued));
+        }
+        catch {
+            // Swallowed - see the comment above
+        }
+    }
+    // #endregion
+    // #region Containers and credentials
+    // Where this subject's profile and tokens are cached, keyed by authentication method plus
+    // subject id since two identity providers could otherwise issue the same subject id. Null when
+    // signed out; several can coexist, so signing back in finds this subject's own profile.
+    getProfileContainerName() {
+        return this._authenticationMethod === null || this._subjectId === null
+            ? null
+            : ContainerNames.forProfile(`${this._authenticationMethod}.${this._subjectId}`);
+    }
+    // The profile container name, when a profile is already known to exist - throws rather than
+    // silently building on a signed-out state the caller has already ruled out.
+    requireProfileContainerName() {
+        const containerName = this.getProfileContainerName();
+        if (containerName === null)
+            throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
+        return containerName;
+    }
+    // Signs a call about the caller alone, or null if signed out. Rereads the user token from the
+    // profile container each time, since a call can reissue it. Carries no linkToken - see
+    // requireBusinessAuthTokens for a business call.
+    async buildProfileAuthTokens() {
+        const authenticationMethod = this._authenticationMethod;
+        const authenticationToken = this._authenticationToken;
+        const profileContainerName = this.getProfileContainerName();
+        if (authenticationMethod === null ||
+            authenticationToken === null ||
+            profileContainerName === null)
+            return null;
+        const issued = await Model.getCache().readAuthTokens(profileContainerName);
+        return ProtoMap.buildAuthTokens(new AuthTokens(authenticationMethod, authenticationToken, issued?.userToken ?? null, null));
+    }
+    // Every profile-only call must be signed; a signed-out visitor cannot make one.
+    async requireProfileAuthTokens() {
+        const authTokens = await this.buildProfileAuthTokens();
+        if (authTokens === null)
+            throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
+        return authTokens;
+    }
+    // #endregion
+    // #region Publishing
+    //
+    // What a read publishes turns on how much the store accepted - blobs stored plus ids deleted,
+    // summed across every page - not on what the response carried. They differ because the store
+    // keeps a blob only when its eTag is later, so a response the server sent can still be rejected
+    // in full - a cursor that moved without its eTag moving is resent an entity already cached.
+    // Publishing that would re-render every observer over an identical value, which the count avoids,
+    // and nothing is lost: a response the store took nothing from can't change what a later read
+    // answers.
+    // All four calls use this, which is why an update publishes nothing - see writeProfileResponse.
+    publishBusiness(response) {
+        this._business.value =
+            response === null ? null : ProtoMap.buildBusiness(response);
+    }
+    publishProfile(response) {
+        this._profile.value =
+            response === null || this._subjectId === null
+                ? null
+                : ProtoMap.buildProfile(this._subjectId, response);
+    }
+    // #endregion
+    static getService() {
+        const service = Model._service;
+        if (service === null)
+            throw new IllegalOperationException("Model.initialize has not been called");
+        return service;
+    }
+    static getCache() {
+        const cache = Model._cache;
+        if (cache === null)
+            throw new IllegalOperationException("Model.initialize has not been called");
+        return cache;
+    }
+}
+Model._service = null;
+Model._cache = null;
+Model._instance = null;
+export default Model;