@smthrs/sync 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/SyncError.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Stable, schema-backed failures for the sync boundary.
+ *
+ * @since 0.1.0
+ */
+import * as Schema from "effect/Schema";
+/**
+ * Stable error codes returned by sync operations.
+ *
+ * `unsupported` reports an unavailable host operation or presence transport
+ * (since 1.0.0). It never implies an empty roster.
+ *
+ * `compacted` reports that the request's cursor for one run starts below that
+ * run's compaction floor, so the entries it asks for have been deleted. It is
+ * its own code rather than an `unknown` because it is RECOVERABLE and nothing
+ * else here is: the accompanying {@link SyncError.resync} names the checkpoint
+ * to resume from, and a follower that applies it converges. Folding it into
+ * `unknown` cost the checkpoint, and with it every path back.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export declare const ErrorCode: Schema.Literals<readonly ["invalid_request", "unsupported", "unauthorized", "not_found", "backpressure", "frame_too_large", "decode_failed", "transport_failed", "protocol_violation", "lineage_changed", "compacted", "closed", "unknown"]>;
+/**
+ * Stable error code returned by a sync operation.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type ErrorCode = typeof ErrorCode.Type;
+declare const SyncError_base: Schema.Class<SyncError, Schema.TaggedStruct<"@smthrs/sync/SyncError", {
+    readonly code: Schema.Literals<readonly ["invalid_request", "unsupported", "unauthorized", "not_found", "backpressure", "frame_too_large", "decode_failed", "transport_failed", "protocol_violation", "lineage_changed", "compacted", "closed", "unknown"]>;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.String>;
+    readonly resync: Schema.optional<Schema.Struct<{
+        readonly runId: Schema.brand<Schema.String, "@smthrs/journal/JournalEvent/RunId">;
+        readonly checkpointSeq: Schema.brand<Schema.Int, "@smthrs/journal/JournalEvent/Seq">;
+        readonly generation: Schema.optional<Schema.Int>;
+    }>>;
+    readonly rewind: Schema.optional<Schema.Struct<{
+        readonly runId: Schema.brand<Schema.String, "@smthrs/journal/JournalEvent/RunId">;
+        readonly generation: Schema.Int;
+        readonly afterSeq: Schema.Int;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Error raised by sync validation, transport, framing, or subscription work.
+ *
+ * `resync` is set only on `compacted`, and names the run and the checkpoint
+ * sequence a follower resumes from. It is optional so every other code keeps
+ * the shape it already had on the wire.
+ *
+ * `rewind` is set on server-side `lineage_changed` refusals and names the
+ * current generation and archive boundary. The caller rebuilds its projection
+ * from retained history and creates a fresh client; the client never retries this failure.
+ *
+ * `cause` is a bounded STRING, not the host object that failed. This error is
+ * the declared error schema of every RPC in both groups, so whatever it
+ * carries reaches a remote follower that may hold nothing but a branch share
+ * link. A `Schema.Unknown` cause published the host's own failure verbatim —
+ * a driver message with SQL text, a rejected credential — counted against no
+ * size ceiling, and had no defined wire form for a class instance or a cyclic
+ * value. `internal/CauseText` is the one renderer that fills it.
+ *
+ * @category errors
+ * @since 0.1.0
+ */
+export declare class SyncError extends SyncError_base {
+    /**
+     * Returns `true` when a value carries this error's shape: the tag, a `code`
+     * this package declares, a string `message`, and a `resync` only alongside
+     * `compacted`.
+     *
+     * It is a STRUCTURAL check, not a class check, deliberately. Everything that
+     * reaches it on a shipped path has crossed a boundary that rebuilds the
+     * value — the RPC client's schema-decoded error channel, or a browser
+     * `postMessage` that keeps the fields and drops the prototype — and a check
+     * that demanded the prototype would refuse an error the package itself sent.
+     * What it does not verify is that the value was produced by this package: a
+     * value constructed in-process with the right fields passes.
+     *
+     * It is TOTAL. The value is `unknown`, so ANY property read on it may be a
+     * throwing getter — the tag included, which is the first one read and was
+     * the one read outside the protection — and this guard decides whether a
+     * follow reconnects and whether a cursor moves past a compaction floor: a
+     * question about a value's shape must answer, never raise.
+     *
+     * @since 0.1.0
+     */
+    static readonly is: (value: unknown) => value is SyncError;
+}
+declare const SyncGapError_base: Schema.Class<SyncGapError, Schema.TaggedStruct<"@smthrs/sync/SyncGapError", {
+    readonly runId: Schema.brand<Schema.String, "@smthrs/journal/JournalEvent/RunId">;
+    readonly expectedFrom: Schema.brand<Schema.Int, "@smthrs/journal/JournalEvent/Seq">;
+    readonly receivedFrom: Schema.brand<Schema.Int, "@smthrs/journal/JournalEvent/Seq">;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Terminal error raised when a server frame starts beyond the client's
+ * covered cursor.
+ *
+ * @category errors
+ * @since 0.1.0
+ */
+export declare class SyncGapError extends SyncGapError_base {
+}
+export {};
+//# sourceMappingURL=SyncError.d.ts.map

package/dist/cjs/SyncError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncError.d.ts","sourceRoot":"","sources":["../../src/SyncError.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAoBvC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,8OAAiF,CAAA;AAIvG;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;;;;;;;;;;;;;;;;AAQ7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,SAAU,SAAQ,cAM7B;IACA;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,SAAS,CAoBxD;CACF;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,SAAQ,iBAIhC;CAAG"}

package/dist/cjs/SyncError.js

@@ -0,0 +1,110 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SyncError_exports = {};
+__export(SyncError_exports, {
+  ErrorCode: () => ErrorCode,
+  SyncError: () => SyncError,
+  SyncGapError: () => SyncGapError
+});
+module.exports = __toCommonJS(SyncError_exports);
+var JournalEvent = __toESM(require("@smthrs/journal/JournalEvent"), 1);
+var Predicate = __toESM(require("effect/Predicate"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var import_SyncProtocol = require("./SyncProtocol.js");
+const errorCodes = [
+  "invalid_request",
+  "unsupported",
+  "unauthorized",
+  "not_found",
+  "backpressure",
+  "frame_too_large",
+  "decode_failed",
+  "transport_failed",
+  "protocol_violation",
+  "lineage_changed",
+  "compacted",
+  "closed",
+  "unknown"
+];
+const ErrorCode = Schema.Literals(errorCodes).annotate({ identifier: "@smthrs/sync/ErrorCode" });
+const codes = new Set(errorCodes);
+const Rewind = Schema.Struct({
+  runId: JournalEvent.RunId,
+  generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+  afterSeq: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1))
+});
+class SyncError extends Schema.TaggedError()("@smthrs/sync/SyncError", {
+  code: ErrorCode,
+  message: Schema.String,
+  cause: Schema.optional(Schema.String),
+  resync: Schema.optional(import_SyncProtocol.Resync),
+  rewind: Schema.optional(Rewind)
+}) {
+  /**
+   * Returns `true` when a value carries this error's shape: the tag, a `code`
+   * this package declares, a string `message`, and a `resync` only alongside
+   * `compacted`.
+   *
+   * It is a STRUCTURAL check, not a class check, deliberately. Everything that
+   * reaches it on a shipped path has crossed a boundary that rebuilds the
+   * value — the RPC client's schema-decoded error channel, or a browser
+   * `postMessage` that keeps the fields and drops the prototype — and a check
+   * that demanded the prototype would refuse an error the package itself sent.
+   * What it does not verify is that the value was produced by this package: a
+   * value constructed in-process with the right fields passes.
+   *
+   * It is TOTAL. The value is `unknown`, so ANY property read on it may be a
+   * throwing getter — the tag included, which is the first one read and was
+   * the one read outside the protection — and this guard decides whether a
+   * follow reconnects and whether a cursor moves past a compaction floor: a
+   * question about a value's shape must answer, never raise.
+   *
+   * @since 0.1.0
+   */
+  static is = (value) => {
+    try {
+      if (!Predicate.isTagged(value, "@smthrs/sync/SyncError")) return false;
+      const candidate = value;
+      if (typeof candidate.message !== "string") return false;
+      if (typeof candidate.code !== "string" || !codes.has(candidate.code)) return false;
+      if (candidate.rewind !== void 0 && (candidate.code !== "lineage_changed" || !Schema.is(Rewind)(candidate.rewind))) return false;
+      if (candidate.resync === void 0) return true;
+      return candidate.code === "compacted" && Schema.is(import_SyncProtocol.Resync)(candidate.resync);
+    } catch {
+      return false;
+    }
+  };
+}
+class SyncGapError extends Schema.TaggedError()("@smthrs/sync/SyncGapError", {
+  runId: JournalEvent.RunId,
+  expectedFrom: JournalEvent.Seq,
+  receivedFrom: JournalEvent.Seq
+}) {
+}
+//# sourceMappingURL=SyncError.js.map

package/dist/cjs/SyncError.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/SyncError.ts"],
+  "sourcesContent": ["/**\n * Stable, schema-backed failures for the sync boundary.\n *\n * @since 0.1.0\n */\n\nimport * as JournalEvent from \"@smthrs/journal/JournalEvent\"\nimport * as Predicate from \"effect/Predicate\"\nimport * as Schema from \"effect/Schema\"\nimport { Resync } from \"./SyncProtocol.ts\"\n\n/** The literals behind {@link ErrorCode}, also read by {@link SyncError.is}. */\nconst errorCodes = [\n  \"invalid_request\",\n  \"unsupported\",\n  \"unauthorized\",\n  \"not_found\",\n  \"backpressure\",\n  \"frame_too_large\",\n  \"decode_failed\",\n  \"transport_failed\",\n  \"protocol_violation\",\n  \"lineage_changed\",\n  \"compacted\",\n  \"closed\",\n  \"unknown\"\n] as const\n\n/**\n * Stable error codes returned by sync operations.\n *\n * `unsupported` reports an unavailable host operation or presence transport\n * (since 1.0.0). It never implies an empty roster.\n *\n * `compacted` reports that the request's cursor for one run starts below that\n * run's compaction floor, so the entries it asks for have been deleted. It is\n * its own code rather than an `unknown` because it is RECOVERABLE and nothing\n * else here is: the accompanying {@link SyncError.resync} names the checkpoint\n * to resume from, and a follower that applies it converges. Folding it into\n * `unknown` cost the checkpoint, and with it every path back.\n *\n * @category models\n * @since 0.1.0\n */\nexport const ErrorCode = Schema.Literals(errorCodes).annotate({ identifier: \"@smthrs/sync/ErrorCode\" })\n\nconst codes: ReadonlySet<string> = new Set(errorCodes)\n\n/**\n * Stable error code returned by a sync operation.\n *\n * @category models\n * @since 0.1.0\n */\nexport type ErrorCode = typeof ErrorCode.Type\n\nconst Rewind = Schema.Struct({\n  runId: JournalEvent.RunId,\n  generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  afterSeq: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1))\n})\n\n/**\n * Error raised by sync validation, transport, framing, or subscription work.\n *\n * `resync` is set only on `compacted`, and names the run and the checkpoint\n * sequence a follower resumes from. It is optional so every other code keeps\n * the shape it already had on the wire.\n *\n * `rewind` is set on server-side `lineage_changed` refusals and names the\n * current generation and archive boundary. The caller rebuilds its projection\n * from retained history and creates a fresh client; the client never retries this failure.\n *\n * `cause` is a bounded STRING, not the host object that failed. This error is\n * the declared error schema of every RPC in both groups, so whatever it\n * carries reaches a remote follower that may hold nothing but a branch share\n * link. A `Schema.Unknown` cause published the host's own failure verbatim \u2014\n * a driver message with SQL text, a rejected credential \u2014 counted against no\n * size ceiling, and had no defined wire form for a class instance or a cyclic\n * value. `internal/CauseText` is the one renderer that fills it.\n *\n * @category errors\n * @since 0.1.0\n */\nexport class SyncError extends Schema.TaggedError<SyncError>()(\"@smthrs/sync/SyncError\", {\n  code: ErrorCode,\n  message: Schema.String,\n  cause: Schema.optional(Schema.String),\n  resync: Schema.optional(Resync),\n  rewind: Schema.optional(Rewind)\n}) {\n  /**\n   * Returns `true` when a value carries this error's shape: the tag, a `code`\n   * this package declares, a string `message`, and a `resync` only alongside\n   * `compacted`.\n   *\n   * It is a STRUCTURAL check, not a class check, deliberately. Everything that\n   * reaches it on a shipped path has crossed a boundary that rebuilds the\n   * value \u2014 the RPC client's schema-decoded error channel, or a browser\n   * `postMessage` that keeps the fields and drops the prototype \u2014 and a check\n   * that demanded the prototype would refuse an error the package itself sent.\n   * What it does not verify is that the value was produced by this package: a\n   * value constructed in-process with the right fields passes.\n   *\n   * It is TOTAL. The value is `unknown`, so ANY property read on it may be a\n   * throwing getter \u2014 the tag included, which is the first one read and was\n   * the one read outside the protection \u2014 and this guard decides whether a\n   * follow reconnects and whether a cursor moves past a compaction floor: a\n   * question about a value's shape must answer, never raise.\n   *\n   * @since 0.1.0\n   */\n  static readonly is = (value: unknown): value is SyncError => {\n    try {\n      if (!Predicate.isTagged(value, \"@smthrs/sync/SyncError\")) return false\n      const candidate = value as {\n        readonly code?: unknown\n        readonly message?: unknown\n        readonly resync?: unknown\n        readonly rewind?: unknown\n      }\n      if (typeof candidate.message !== \"string\") return false\n      if (typeof candidate.code !== \"string\" || !codes.has(candidate.code)) return false\n      if (\n        candidate.rewind !== undefined &&\n        (candidate.code !== \"lineage_changed\" || !Schema.is(Rewind)(candidate.rewind))\n      ) return false\n      if (candidate.resync === undefined) return true\n      return candidate.code === \"compacted\" && Schema.is(Resync)(candidate.resync)\n    } catch {\n      return false\n    }\n  }\n}\n\n/**\n * Terminal error raised when a server frame starts beyond the client's\n * covered cursor.\n *\n * @category errors\n * @since 0.1.0\n */\nexport class SyncGapError extends Schema.TaggedError<SyncGapError>()(\"@smthrs/sync/SyncGapError\", {\n  runId: JournalEvent.RunId,\n  expectedFrom: JournalEvent.Seq,\n  receivedFrom: JournalEvent.Seq\n}) {}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,mBAA8B;AAC9B,gBAA2B;AAC3B,aAAwB;AACxB,0BAAuB;AAGvB,MAAM,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAkBO,MAAM,YAAY,OAAO,SAAS,UAAU,EAAE,SAAS,EAAE,YAAY,yBAAyB,CAAC;AAEtG,MAAM,QAA6B,IAAI,IAAI,UAAU;AAUrD,MAAM,SAAS,OAAO,OAAO;AAAA,EAC3B,OAAO,aAAa;AAAA,EACpB,YAAY,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAAA,EAC7D,UAAU,OAAO,IAAI,MAAM,OAAO,uBAAuB,EAAE,CAAC;AAC9D,CAAC;AAwBM,MAAM,kBAAkB,OAAO,YAAuB,EAAE,0BAA0B;AAAA,EACvF,MAAM;AAAA,EACN,SAAS,OAAO;AAAA,EAChB,OAAO,OAAO,SAAS,OAAO,MAAM;AAAA,EACpC,QAAQ,OAAO,SAAS,0BAAM;AAAA,EAC9B,QAAQ,OAAO,SAAS,MAAM;AAChC,CAAC,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBD,OAAgB,KAAK,CAAC,UAAuC;AAC3D,QAAI;AACF,UAAI,CAAC,UAAU,SAAS,OAAO,wBAAwB,EAAG,QAAO;AACjE,YAAM,YAAY;AAMlB,UAAI,OAAO,UAAU,YAAY,SAAU,QAAO;AAClD,UAAI,OAAO,UAAU,SAAS,YAAY,CAAC,MAAM,IAAI,UAAU,IAAI,EAAG,QAAO;AAC7E,UACE,UAAU,WAAW,WACpB,UAAU,SAAS,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,UAAU,MAAM,GAC5E,QAAO;AACT,UAAI,UAAU,WAAW,OAAW,QAAO;AAC3C,aAAO,UAAU,SAAS,eAAe,OAAO,GAAG,0BAAM,EAAE,UAAU,MAAM;AAAA,IAC7E,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AASO,MAAM,qBAAqB,OAAO,YAA0B,EAAE,6BAA6B;AAAA,EAChG,OAAO,aAAa;AAAA,EACpB,cAAc,aAAa;AAAA,EAC3B,cAAc,aAAa;AAC7B,CAAC,EAAE;AAAC;",
+  "names": []
+}

package/dist/cjs/SyncPrincipal.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The authenticated identity of one sync request.
+ *
+ * The principal is a `Context.Reference` whose default is
+ * {@link anonymous}, which is what makes the read path fail closed: code
+ * that never authenticates runs as anonymous, and the server refuses
+ * anonymous access to every non-branch run. The only ways to become the
+ * workspace principal are a workspace capability verified by
+ * `SyncAuth.layer` at the RPC boundary, or an in-process caller that
+ * provides the reference itself — which is the sanctioned path for code
+ * already holding the journal, and never for a transport.
+ *
+ * @since 0.1.0
+ */
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+/**
+ * A request that presented no credential. It may still read branch runs
+ * through per-request branch share capabilities.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Anonymous {
+    readonly _tag: "Anonymous";
+}
+/**
+ * A request authenticated for the workspace's non-branch runs.
+ * `capabilityId` names the credential for auditing; in-process callers name
+ * themselves.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Workspace {
+    readonly _tag: "Workspace";
+    readonly capabilityId: string;
+    /**
+     * When the credential that established this principal stops authorizing,
+     * in epoch milliseconds, or `Infinity` for an in-process owner that
+     * presented no credential at all.
+     *
+     * A signed expiry is this package's ONLY revocation mechanism, and an open
+     * subscription is not a sequence of requests: it is authorized once, at
+     * open, and then streams. Without the expiry on the identity itself,
+     * nothing downstream could tell a live subscription to stop, so a holder of
+     * an expired capability kept reading for as long as it declined to
+     * disconnect.
+     */
+    readonly expiresAtMs: number;
+}
+/**
+ * Any authenticated identity a sync request can carry.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type Principal = Anonymous | Workspace;
+/**
+ * The unauthenticated principal.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const anonymous: Principal;
+/**
+ * Constructs the workspace principal for a named credential.
+ *
+ * `expiresAtMs` defaults to `Infinity`, which is the honest answer for an
+ * in-process owner that already holds the journal: it presented no credential,
+ * so no credential can expire under it.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const workspace: (capabilityId: string, expiresAtMs?: number) => Principal;
+/**
+ * Returns `true` when a principal may read non-branch runs.
+ *
+ * @category predicates
+ * @since 0.1.0
+ */
+export declare const isWorkspace: (principal: Principal) => principal is Workspace;
+/**
+ * The current request's principal, defaulting to {@link anonymous}.
+ *
+ * @category references
+ * @since 0.1.0
+ */
+export declare const SyncPrincipal: Context.Reference<Principal>;
+/**
+ * Provides the workspace principal directly, bypassing credential
+ * verification. For in-process callers that already own the journal — a
+ * transport boundary must authenticate through `SyncAuth.layer` instead.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerWorkspace: (capabilityId: string) => Layer.Layer<never>;
+//# sourceMappingURL=SyncPrincipal.d.ts.map

package/dist/cjs/SyncPrincipal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncPrincipal.d.ts","sourceRoot":"","sources":["../../src/SyncPrincipal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,SAAiC,CAAA;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,GACpB,cAAc,MAAM,EACpB,cAAa,MAAiC,KAC7C,SAA+D,CAAA;AAElE;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,WAAW,SAAS,KAAG,SAAS,IAAI,SAA2C,CAAA;AAE3G;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,CAGtD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,cAAc,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAChB,CAAA"}

package/dist/cjs/SyncPrincipal.js

@@ -0,0 +1,48 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SyncPrincipal_exports = {};
+__export(SyncPrincipal_exports, {
+  SyncPrincipal: () => SyncPrincipal,
+  anonymous: () => anonymous,
+  isWorkspace: () => isWorkspace,
+  layerWorkspace: () => layerWorkspace,
+  workspace: () => workspace
+});
+module.exports = __toCommonJS(SyncPrincipal_exports);
+var Context = __toESM(require("effect/Context"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+const anonymous = { _tag: "Anonymous" };
+const workspace = (capabilityId, expiresAtMs = Number.POSITIVE_INFINITY) => ({ _tag: "Workspace", capabilityId, expiresAtMs });
+const isWorkspace = (principal) => principal._tag === "Workspace";
+const SyncPrincipal = Context.Reference(
+  "@smthrs/sync/SyncPrincipal",
+  { defaultValue: () => anonymous }
+);
+const layerWorkspace = (capabilityId) => Layer.succeed(SyncPrincipal, workspace(capabilityId));
+//# sourceMappingURL=SyncPrincipal.js.map

package/dist/cjs/SyncPrincipal.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/SyncPrincipal.ts"],
+  "sourcesContent": ["/**\n * The authenticated identity of one sync request.\n *\n * The principal is a `Context.Reference` whose default is\n * {@link anonymous}, which is what makes the read path fail closed: code\n * that never authenticates runs as anonymous, and the server refuses\n * anonymous access to every non-branch run. The only ways to become the\n * workspace principal are a workspace capability verified by\n * `SyncAuth.layer` at the RPC boundary, or an in-process caller that\n * provides the reference itself \u2014 which is the sanctioned path for code\n * already holding the journal, and never for a transport.\n *\n * @since 0.1.0\n */\n\nimport * as Context from \"effect/Context\"\nimport * as Layer from \"effect/Layer\"\n\n/**\n * A request that presented no credential. It may still read branch runs\n * through per-request branch share capabilities.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Anonymous {\n  readonly _tag: \"Anonymous\"\n}\n\n/**\n * A request authenticated for the workspace's non-branch runs.\n * `capabilityId` names the credential for auditing; in-process callers name\n * themselves.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Workspace {\n  readonly _tag: \"Workspace\"\n  readonly capabilityId: string\n  /**\n   * When the credential that established this principal stops authorizing,\n   * in epoch milliseconds, or `Infinity` for an in-process owner that\n   * presented no credential at all.\n   *\n   * A signed expiry is this package's ONLY revocation mechanism, and an open\n   * subscription is not a sequence of requests: it is authorized once, at\n   * open, and then streams. Without the expiry on the identity itself,\n   * nothing downstream could tell a live subscription to stop, so a holder of\n   * an expired capability kept reading for as long as it declined to\n   * disconnect.\n   */\n  readonly expiresAtMs: number\n}\n\n/**\n * Any authenticated identity a sync request can carry.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Principal = Anonymous | Workspace\n\n/**\n * The unauthenticated principal.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const anonymous: Principal = { _tag: \"Anonymous\" }\n\n/**\n * Constructs the workspace principal for a named credential.\n *\n * `expiresAtMs` defaults to `Infinity`, which is the honest answer for an\n * in-process owner that already holds the journal: it presented no credential,\n * so no credential can expire under it.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const workspace = (\n  capabilityId: string,\n  expiresAtMs: number = Number.POSITIVE_INFINITY\n): Principal => ({ _tag: \"Workspace\", capabilityId, expiresAtMs })\n\n/**\n * Returns `true` when a principal may read non-branch runs.\n *\n * @category predicates\n * @since 0.1.0\n */\nexport const isWorkspace = (principal: Principal): principal is Workspace => principal._tag === \"Workspace\"\n\n/**\n * The current request's principal, defaulting to {@link anonymous}.\n *\n * @category references\n * @since 0.1.0\n */\nexport const SyncPrincipal: Context.Reference<Principal> = Context.Reference<Principal>(\n  \"@smthrs/sync/SyncPrincipal\",\n  { defaultValue: () => anonymous }\n)\n\n/**\n * Provides the workspace principal directly, bypassing credential\n * verification. For in-process callers that already own the journal \u2014 a\n * transport boundary must authenticate through `SyncAuth.layer` instead.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerWorkspace = (capabilityId: string): Layer.Layer<never> =>\n  Layer.succeed(SyncPrincipal, workspace(capabilityId))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,cAAyB;AACzB,YAAuB;AAqDhB,MAAM,YAAuB,EAAE,MAAM,YAAY;AAYjD,MAAM,YAAY,CACvB,cACA,cAAsB,OAAO,uBACd,EAAE,MAAM,aAAa,cAAc,YAAY;AAQzD,MAAM,cAAc,CAAC,cAAiD,UAAU,SAAS;AAQzF,MAAM,gBAA8C,QAAQ;AAAA,EACjE;AAAA,EACA,EAAE,cAAc,MAAM,UAAU;AAClC;AAUO,MAAM,iBAAiB,CAAC,iBAC7B,MAAM,QAAQ,eAAe,UAAU,YAAY,CAAC;",
+  "names": []
+}