@smthrs/sync 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/internal/ProtocolVersion.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/ProtocolVersion.ts"],
+  "sourcesContent": ["/** The one protocol-version comparison every sync boundary answers with.\n * @since 1.0.0-rc.0\n */\n\nimport * as Effect from \"effect/Effect\"\nimport { SyncError } from \"../SyncError.ts\"\nimport { protocolVersion } from \"../SyncProtocol.ts\"\n\n/** Refuse a version this revision does not speak, on every path, with one code.\n *\n * Read, subscribe and snapshot all decode a mismatched version so the refusal\n * is this typed `protocol_violation` rather than three different decode\n * failures, and the accepted number is only ever\n * {@link SyncProtocol.protocolVersion}.\n *\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const requireVersion = (version: number | undefined): Effect.Effect<void, SyncError> =>\n  version === protocolVersion\n    ? Effect.void\n    : Effect.fail(\n      new SyncError({\n        code: \"protocol_violation\",\n        message: `Expected sync protocol version ${protocolVersion}; received ${version}`,\n        cause: \"protocol_version_mismatch\"\n      })\n    )\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,aAAwB;AACxB,uBAA0B;AAC1B,0BAAgC;AAYzB,MAAM,iBAAiB,CAAC,YAC7B,YAAY,sCACR,OAAO,OACP,OAAO;AAAA,EACP,IAAI,2BAAU;AAAA,IACZ,MAAM;AAAA,IACN,SAAS,kCAAkC,mCAAe,cAAc,OAAO;AAAA,IAC/E,OAAO;AAAA,EACT,CAAC;AACH;",
+  "names": []
+}

package/dist/cjs/internal/ShareSigner.d.ts

@@ -0,0 +1,173 @@
+/**
+ * HMAC-SHA-256 signing primitives shared by the branch and workspace share
+ * authorities.
+ *
+ * Both authorities sign a length-prefixed encoding of their claims: without
+ * length prefixes a field ending in the separator could be re-cut into a
+ * different, still-validly-signed claim set. Web Crypto is used directly so
+ * the same module runs in the browser and on node, and signature comparison
+ * is length-independent so a check leaks no prefix length.
+ *
+ * @since 0.1.0
+ */
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { Access } from "../BranchProtocol.ts";
+import { SyncError } from "../SyncError.ts";
+/**
+ * Length-prefixes each field so no two distinct field sequences share an
+ * encoding.
+ *
+ * The prefix counts UTF-8 BYTES, not UTF-16 code units, because the bytes are
+ * what {@link signHmac} covers. Counting code units let a two-byte field claim
+ * length one, so the prefix no longer separated the fields the signature was
+ * taken over.
+ *
+ * @category encoding
+ * @since 0.1.0
+ */
+export declare const lengthPrefixed: (fields: ReadonlyArray<string>) => string;
+/**
+ * Whether a string is exactly what its own UTF-8 bytes decode back to.
+ *
+ * `TextEncoder` replaces every unpaired surrogate with U+FFFD, so two claim
+ * sets differing only in a lone surrogate sign to identical bytes: a
+ * capability minted for a lone-surrogate branch id verifies after its
+ * `branchId` is rewritten to U+FFFD, which names a different branch. A length
+ * prefix cannot separate them either, because both encode to the same three
+ * bytes. The only correct answer is to refuse such a claim set before it is
+ * signed, and the round trip is the exact question — does this string survive
+ * the encoding the signature is taken over — rather than a proxy for it.
+ *
+ * @category encoding
+ * @since 1.0.0-rc.0
+ */
+export declare const utf8RoundTrips: (value: string, bytes: Uint8Array) => boolean;
+/**
+ * Renders signature bytes as lowercase hex.
+ *
+ * @category encoding
+ * @since 0.1.0
+ */
+export declare const hex: (bytes: Uint8Array) => string;
+/**
+ * Length-independent comparison, so a signature check leaks no prefix length.
+ *
+ * @category comparison
+ * @since 0.1.0
+ */
+export declare const constantTimeEquals: (left: string, right: string) => boolean;
+/**
+ * The fewest UTF-8 bytes a signing secret may carry: the HMAC-SHA-256 output
+ * length, the minimum RFC 2104 section 3 recommends.
+ *
+ * Every capability carries its claims and their signature in the clear, so one
+ * observed capability is an offline oracle for the secret. A short secret such
+ * as `a` falls to exhaustive search in seconds, and the attacker then mints
+ * branch and workspace capabilities of their own.
+ *
+ * @category constants
+ * @since 1.0.0-rc.1
+ */
+export declare const minSecretBytes = 32;
+/**
+ * Imports a raw secret as a non-extractable Web Crypto HMAC-SHA-256 signing
+ * key. Fails with `invalid_request` when the secret does not survive UTF-8
+ * (an unpaired surrogate) or is shorter than {@link minSecretBytes}, and with
+ * a `SyncError` carrying the rejection as `cause` when Web Crypto refuses the
+ * import.
+ *
+ * @category crypto
+ * @since 0.1.0
+ */
+export declare const importHmacKey: (secret: string) => Effect.Effect<CryptoKey, SyncError>;
+/**
+ * Signs a canonical claim encoding, returning the signature as lowercase hex.
+ *
+ * @category crypto
+ * @since 0.1.0
+ */
+export declare const signHmac: (key: CryptoKey, canonical: string) => Effect.Effect<string, SyncError>;
+/**
+ * The refusal both authorities issue. Declared once so a message added to one
+ * authority's verification cannot land under a different error code in the
+ * other.
+ *
+ * @category errors
+ * @since 1.0.0-rc.0
+ */
+export declare const unauthorized: (message: string) => SyncError;
+/**
+ * One named signing key. The secret is `Redacted` so a keyring never renders
+ * it into logs or inspection output.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Key {
+    readonly kid: string;
+    readonly secret: Redacted.Redacted<string>;
+}
+/**
+ * A keyring: the key that signs new capabilities plus every key still
+ * accepted for verification. Rotation adds a new active key and keeps the
+ * retired one in `keys` until its outstanding capabilities expire.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Keyring {
+    readonly activeKid: string;
+    readonly keys: ReadonlyArray<Key>;
+}
+/**
+ * A keyring whose every secret is already an imported Web Crypto key: the
+ * signer for new capabilities, and the map a verifier selects a retired key
+ * from by `kid`.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface ImportedKeyring {
+    readonly activeKid: string;
+    readonly active: CryptoKey;
+    readonly verification: ReadonlyMap<string, CryptoKey>;
+}
+/**
+ * Imports every key in a keyring, so a misconfigured ring — an unknown active
+ * kid, a duplicate kid, or a key Web Crypto refuses — fails at construction
+ * rather than at the first request. `subject` names the authority in the
+ * refusal ("branch", "workspace").
+ *
+ * @category crypto
+ * @since 1.0.0-rc.0
+ */
+export declare const importKeyring: (keyring: Keyring, subject: string) => Effect.Effect<ImportedKeyring, SyncError>;
+/**
+ * The authorization both capability authorities run once their signing key is
+ * selected: the signature, then the expiry, then the requested access.
+ *
+ * The order is the contract. A capability is authenticated before anything it
+ * claims is reported back, so a forged claim set is refused as a bad signature
+ * and never as a scope or an expiry. `scope` is the one check an authority
+ * adds for itself — the branch authority's cross-branch refusal — and it runs
+ * after the signature for exactly that reason.
+ *
+ * Both authorities called this sequence out by hand, which left a fix to the
+ * expiry boundary or the read-only refusal landing in one and not the other.
+ *
+ * @category crypto
+ * @since 1.0.0-rc.0
+ */
+export declare const verifyClaims: (options: {
+    readonly key: CryptoKey;
+    readonly canonical: string;
+    readonly signature: string;
+    readonly expiresAtMs: number;
+    readonly granted: Access;
+    readonly requested: Access;
+    /** The refused thing, named as it appears in the message: "The share capability". */
+    readonly subject: string;
+    readonly scope?: Effect.Effect<void, SyncError>;
+}) => Effect.Effect<void, SyncError>;
+//# sourceMappingURL=ShareSigner.d.ts.map

package/dist/cjs/internal/ShareSigner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShareSigner.d.ts","sourceRoot":"","sources":["../../../src/internal/ShareSigner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAK3C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,aAAa,CAAC,MAAM,CAAC,KAAG,MACa,CAAA;AAI5E;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,OAAO,UAAU,KAAG,OAA0C,CAAA;AAE5G;;;;;GAKG;AACH,eAAO,MAAM,GAAG,GAAI,OAAO,UAAU,KAAG,MACkC,CAAA;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAQhE,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,KAAK,CAAA;AAEhC;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAiChF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,SAAS,EAAE,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAsB3F,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,SAA6D,CAAA;AAE5G;;;;;;GAMG;AACH,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CACtD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,OAAO,EAAE,SAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CA6BtG,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS;IACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;CAChD,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAc7B,CAAA"}

package/dist/cjs/internal/ShareSigner.js

@@ -0,0 +1,150 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ShareSigner_exports = {};
+__export(ShareSigner_exports, {
+  constantTimeEquals: () => constantTimeEquals,
+  hex: () => hex,
+  importHmacKey: () => importHmacKey,
+  importKeyring: () => importKeyring,
+  lengthPrefixed: () => lengthPrefixed,
+  minSecretBytes: () => minSecretBytes,
+  signHmac: () => signHmac,
+  unauthorized: () => unauthorized,
+  utf8RoundTrips: () => utf8RoundTrips,
+  verifyClaims: () => verifyClaims
+});
+module.exports = __toCommonJS(ShareSigner_exports);
+var Clock = __toESM(require("effect/Clock"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Redacted = __toESM(require("effect/Redacted"), 1);
+var import_SyncError = require("../SyncError.js");
+var import_CauseText = require("./CauseText.js");
+const encoder = new TextEncoder();
+const lengthPrefixed = (fields) => fields.map((field) => `${encoder.encode(field).length}:${field}`).join("");
+const decoder = new TextDecoder();
+const utf8RoundTrips = (value, bytes) => decoder.decode(bytes) === value;
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+const constantTimeEquals = (left, right) => {
+  let difference = left.length ^ right.length;
+  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+    difference |= (left.charCodeAt(index) | 0) ^ (right.charCodeAt(index) | 0);
+  }
+  return difference === 0;
+};
+const minSecretBytes = 32;
+const importHmacKey = (secret) => {
+  const bytes = encoder.encode(secret);
+  if (!utf8RoundTrips(secret, bytes)) {
+    return Effect.fail(
+      new import_SyncError.SyncError({
+        code: "invalid_request",
+        message: "The HMAC signing secret carries an unpaired surrogate"
+      })
+    );
+  }
+  if (bytes.length < minSecretBytes) {
+    return Effect.fail(
+      new import_SyncError.SyncError({
+        code: "invalid_request",
+        message: `The HMAC signing secret must be at least ${minSecretBytes} bytes of UTF-8`
+      })
+    );
+  }
+  return Effect.tryPromise({
+    try: () => crypto.subtle.importKey("raw", bytes, { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign"
+    ]),
+    catch: (cause) => new import_SyncError.SyncError({
+      code: "unknown",
+      message: "Web Crypto could not import the HMAC signing key",
+      cause: (0, import_CauseText.causeText)(cause)
+    })
+  });
+};
+const signHmac = (key, canonical) => {
+  const bytes = encoder.encode(canonical);
+  if (!utf8RoundTrips(canonical, bytes)) {
+    return Effect.fail(
+      new import_SyncError.SyncError({
+        code: "invalid_request",
+        message: "Share claims carry an unpaired surrogate and cannot be signed"
+      })
+    );
+  }
+  return Effect.map(
+    Effect.tryPromise({
+      try: () => crypto.subtle.sign("HMAC", key, bytes),
+      catch: (cause) => new import_SyncError.SyncError({
+        code: "unknown",
+        message: "Web Crypto could not sign the share claims",
+        cause: (0, import_CauseText.causeText)(cause)
+      })
+    }),
+    (signature) => hex(new Uint8Array(signature))
+  );
+};
+const unauthorized = (message) => new import_SyncError.SyncError({ code: "unauthorized", message });
+const importKeyring = (keyring, subject) => Effect.gen(function* () {
+  const activeKid = keyring.activeKid;
+  const keys = keyring.keys.map((key) => ({ kid: key.kid, secret: key.secret }));
+  const verification = /* @__PURE__ */ new Map();
+  for (const key of keys) {
+    if (verification.has(key.kid)) {
+      return yield* Effect.fail(
+        new import_SyncError.SyncError({ code: "invalid_request", message: `The ${subject} keyring names kid ${key.kid} twice` })
+      );
+    }
+    verification.set(key.kid, yield* importHmacKey(Redacted.value(key.secret)));
+  }
+  const active = verification.get(activeKid);
+  if (active === void 0) {
+    return yield* Effect.fail(
+      new import_SyncError.SyncError({
+        code: "invalid_request",
+        message: `The ${subject} keyring's active kid names no key in the ring`
+      })
+    );
+  }
+  return { activeKid, active, verification };
+});
+const verifyClaims = (options) => Effect.gen(function* () {
+  const expected = yield* signHmac(options.key, options.canonical);
+  if (!constantTimeEquals(expected, options.signature)) {
+    return yield* Effect.fail(unauthorized(`${options.subject} signature is invalid`));
+  }
+  if (options.scope !== void 0) yield* options.scope;
+  const nowMs = yield* Clock.currentTimeMillis;
+  if (nowMs >= options.expiresAtMs) {
+    return yield* Effect.fail(unauthorized(`${options.subject} has expired`));
+  }
+  if (options.requested === "write" && options.granted !== "write") {
+    return yield* Effect.fail(unauthorized(`${options.subject} is read-only`));
+  }
+});
+//# sourceMappingURL=ShareSigner.js.map

package/dist/cjs/internal/ShareSigner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/ShareSigner.ts"],
+  "sourcesContent": ["/**\n * HMAC-SHA-256 signing primitives shared by the branch and workspace share\n * authorities.\n *\n * Both authorities sign a length-prefixed encoding of their claims: without\n * length prefixes a field ending in the separator could be re-cut into a\n * different, still-validly-signed claim set. Web Crypto is used directly so\n * the same module runs in the browser and on node, and signature comparison\n * is length-independent so a check leaks no prefix length.\n *\n * @since 0.1.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport * as Effect from \"effect/Effect\"\nimport * as Redacted from \"effect/Redacted\"\nimport type { Access } from \"../BranchProtocol.ts\"\nimport { SyncError } from \"../SyncError.ts\"\nimport { causeText } from \"./CauseText.ts\"\n\nconst encoder = new TextEncoder()\n\n/**\n * Length-prefixes each field so no two distinct field sequences share an\n * encoding.\n *\n * The prefix counts UTF-8 BYTES, not UTF-16 code units, because the bytes are\n * what {@link signHmac} covers. Counting code units let a two-byte field claim\n * length one, so the prefix no longer separated the fields the signature was\n * taken over.\n *\n * @category encoding\n * @since 0.1.0\n */\nexport const lengthPrefixed = (fields: ReadonlyArray<string>): string =>\n  fields.map((field) => `${encoder.encode(field).length}:${field}`).join(\"\")\n\nconst decoder = new TextDecoder()\n\n/**\n * Whether a string is exactly what its own UTF-8 bytes decode back to.\n *\n * `TextEncoder` replaces every unpaired surrogate with U+FFFD, so two claim\n * sets differing only in a lone surrogate sign to identical bytes: a\n * capability minted for a lone-surrogate branch id verifies after its\n * `branchId` is rewritten to U+FFFD, which names a different branch. A length\n * prefix cannot separate them either, because both encode to the same three\n * bytes. The only correct answer is to refuse such a claim set before it is\n * signed, and the round trip is the exact question \u2014 does this string survive\n * the encoding the signature is taken over \u2014 rather than a proxy for it.\n *\n * @category encoding\n * @since 1.0.0-rc.0\n */\nexport const utf8RoundTrips = (value: string, bytes: Uint8Array): boolean => decoder.decode(bytes) === value\n\n/**\n * Renders signature bytes as lowercase hex.\n *\n * @category encoding\n * @since 0.1.0\n */\nexport const hex = (bytes: Uint8Array): string =>\n  Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\")\n\n/**\n * Length-independent comparison, so a signature check leaks no prefix length.\n *\n * @category comparison\n * @since 0.1.0\n */\nexport const constantTimeEquals = (left: string, right: string): boolean => {\n  let difference = left.length ^ right.length\n  // `charCodeAt` past the end is NaN, and `NaN | 0` is 0, so the loop reads\n  // both strings to the longer length without an early return.\n  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {\n    difference |= (left.charCodeAt(index) | 0) ^ (right.charCodeAt(index) | 0)\n  }\n  return difference === 0\n}\n\n/**\n * The fewest UTF-8 bytes a signing secret may carry: the HMAC-SHA-256 output\n * length, the minimum RFC 2104 section 3 recommends.\n *\n * Every capability carries its claims and their signature in the clear, so one\n * observed capability is an offline oracle for the secret. A short secret such\n * as `a` falls to exhaustive search in seconds, and the attacker then mints\n * branch and workspace capabilities of their own.\n *\n * @category constants\n * @since 1.0.0-rc.1\n */\nexport const minSecretBytes = 32\n\n/**\n * Imports a raw secret as a non-extractable Web Crypto HMAC-SHA-256 signing\n * key. Fails with `invalid_request` when the secret does not survive UTF-8\n * (an unpaired surrogate) or is shorter than {@link minSecretBytes}, and with\n * a `SyncError` carrying the rejection as `cause` when Web Crypto refuses the\n * import.\n *\n * @category crypto\n * @since 0.1.0\n */\nexport const importHmacKey = (secret: string): Effect.Effect<CryptoKey, SyncError> => {\n  // An unpaired surrogate encodes to U+FFFD's bytes, so two distinct\n  // secrets would import the same key and rotating between them revokes\n  // nothing. Refused here, as `signHmac` refuses such claims.\n  const bytes = encoder.encode(secret)\n  if (!utf8RoundTrips(secret, bytes)) {\n    return Effect.fail(\n      new SyncError({\n        code: \"invalid_request\",\n        message: \"The HMAC signing secret carries an unpaired surrogate\"\n      })\n    )\n  }\n  if (bytes.length < minSecretBytes) {\n    return Effect.fail(\n      new SyncError({\n        code: \"invalid_request\",\n        message: `The HMAC signing secret must be at least ${minSecretBytes} bytes of UTF-8`\n      })\n    )\n  }\n  return Effect.tryPromise({\n    try: () =>\n      crypto.subtle.importKey(\"raw\", bytes, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n        \"sign\"\n      ]),\n    catch: (cause) =>\n      new SyncError({\n        code: \"unknown\",\n        message: \"Web Crypto could not import the HMAC signing key\",\n        cause: causeText(cause)\n      })\n  })\n}\n\n/**\n * Signs a canonical claim encoding, returning the signature as lowercase hex.\n *\n * @category crypto\n * @since 0.1.0\n */\nexport const signHmac = (key: CryptoKey, canonical: string): Effect.Effect<string, SyncError> => {\n  const bytes = encoder.encode(canonical)\n  if (!utf8RoundTrips(canonical, bytes)) {\n    return Effect.fail(\n      new SyncError({\n        code: \"invalid_request\",\n        message: \"Share claims carry an unpaired surrogate and cannot be signed\"\n      })\n    )\n  }\n  return Effect.map(\n    Effect.tryPromise({\n      try: () => crypto.subtle.sign(\"HMAC\", key, bytes),\n      catch: (cause) =>\n        new SyncError({\n          code: \"unknown\",\n          message: \"Web Crypto could not sign the share claims\",\n          cause: causeText(cause)\n        })\n    }),\n    (signature) => hex(new Uint8Array(signature))\n  )\n}\n\n/**\n * The refusal both authorities issue. Declared once so a message added to one\n * authority's verification cannot land under a different error code in the\n * other.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport const unauthorized = (message: string): SyncError => new SyncError({ code: \"unauthorized\", message })\n\n/**\n * One named signing key. The secret is `Redacted` so a keyring never renders\n * it into logs or inspection output.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Key {\n  readonly kid: string\n  readonly secret: Redacted.Redacted<string>\n}\n\n/**\n * A keyring: the key that signs new capabilities plus every key still\n * accepted for verification. Rotation adds a new active key and keeps the\n * retired one in `keys` until its outstanding capabilities expire.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Keyring {\n  readonly activeKid: string\n  readonly keys: ReadonlyArray<Key>\n}\n\n/**\n * A keyring whose every secret is already an imported Web Crypto key: the\n * signer for new capabilities, and the map a verifier selects a retired key\n * from by `kid`.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface ImportedKeyring {\n  readonly activeKid: string\n  readonly active: CryptoKey\n  readonly verification: ReadonlyMap<string, CryptoKey>\n}\n\n/**\n * Imports every key in a keyring, so a misconfigured ring \u2014 an unknown active\n * kid, a duplicate kid, or a key Web Crypto refuses \u2014 fails at construction\n * rather than at the first request. `subject` names the authority in the\n * refusal (\"branch\", \"workspace\").\n *\n * @category crypto\n * @since 1.0.0-rc.0\n */\nexport const importKeyring = (keyring: Keyring, subject: string): Effect.Effect<ImportedKeyring, SyncError> =>\n  Effect.gen(function*() {\n    // Copied BEFORE the first import, for the reason snapshots exist on the\n    // verify path: the keyring belongs to the caller and every import below is\n    // an await, so a `for..of` over the caller's own array re-reads it between\n    // them. A splice landing in that window changed which keys the authority\n    // ended up holding, and reading `activeKid` only after the loop let it name\n    // a key the ring was validated with rather than the one the caller passed.\n    const activeKid = keyring.activeKid\n    const keys = keyring.keys.map((key): Key => ({ kid: key.kid, secret: key.secret }))\n    const verification = new Map<string, CryptoKey>()\n    for (const key of keys) {\n      if (verification.has(key.kid)) {\n        return yield* Effect.fail(\n          new SyncError({ code: \"invalid_request\", message: `The ${subject} keyring names kid ${key.kid} twice` })\n        )\n      }\n      verification.set(key.kid, yield* importHmacKey(Redacted.value(key.secret)))\n    }\n    const active = verification.get(activeKid)\n    if (active === undefined) {\n      return yield* Effect.fail(\n        new SyncError({\n          code: \"invalid_request\",\n          message: `The ${subject} keyring's active kid names no key in the ring`\n        })\n      )\n    }\n    return { activeKid, active, verification }\n  })\n\n/**\n * The authorization both capability authorities run once their signing key is\n * selected: the signature, then the expiry, then the requested access.\n *\n * The order is the contract. A capability is authenticated before anything it\n * claims is reported back, so a forged claim set is refused as a bad signature\n * and never as a scope or an expiry. `scope` is the one check an authority\n * adds for itself \u2014 the branch authority's cross-branch refusal \u2014 and it runs\n * after the signature for exactly that reason.\n *\n * Both authorities called this sequence out by hand, which left a fix to the\n * expiry boundary or the read-only refusal landing in one and not the other.\n *\n * @category crypto\n * @since 1.0.0-rc.0\n */\nexport const verifyClaims = (options: {\n  readonly key: CryptoKey\n  readonly canonical: string\n  readonly signature: string\n  readonly expiresAtMs: number\n  readonly granted: Access\n  readonly requested: Access\n  /** The refused thing, named as it appears in the message: \"The share capability\". */\n  readonly subject: string\n  readonly scope?: Effect.Effect<void, SyncError>\n}): Effect.Effect<void, SyncError> =>\n  Effect.gen(function*() {\n    const expected = yield* signHmac(options.key, options.canonical)\n    if (!constantTimeEquals(expected, options.signature)) {\n      return yield* Effect.fail(unauthorized(`${options.subject} signature is invalid`))\n    }\n    if (options.scope !== undefined) yield* options.scope\n    const nowMs = yield* Clock.currentTimeMillis\n    if (nowMs >= options.expiresAtMs) {\n      return yield* Effect.fail(unauthorized(`${options.subject} has expired`))\n    }\n    if (options.requested === \"write\" && options.granted !== \"write\") {\n      return yield* Effect.fail(unauthorized(`${options.subject} is read-only`))\n    }\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,YAAuB;AACvB,aAAwB;AACxB,eAA0B;AAE1B,uBAA0B;AAC1B,uBAA0B;AAE1B,MAAM,UAAU,IAAI,YAAY;AAczB,MAAM,iBAAiB,CAAC,WAC7B,OAAO,IAAI,CAAC,UAAU,GAAG,QAAQ,OAAO,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE;AAE3E,MAAM,UAAU,IAAI,YAAY;AAiBzB,MAAM,iBAAiB,CAAC,OAAe,UAA+B,QAAQ,OAAO,KAAK,MAAM;AAQhG,MAAM,MAAM,CAAC,UAClB,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAQlE,MAAM,qBAAqB,CAAC,MAAc,UAA2B;AAC1E,MAAI,aAAa,KAAK,SAAS,MAAM;AAGrC,WAAS,QAAQ,GAAG,QAAQ,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM,GAAG,SAAS,GAAG;AAC3E,mBAAe,KAAK,WAAW,KAAK,IAAI,MAAM,MAAM,WAAW,KAAK,IAAI;AAAA,EAC1E;AACA,SAAO,eAAe;AACxB;AAcO,MAAM,iBAAiB;AAYvB,MAAM,gBAAgB,CAAC,WAAwD;AAIpF,QAAM,QAAQ,QAAQ,OAAO,MAAM;AACnC,MAAI,CAAC,eAAe,QAAQ,KAAK,GAAG;AAClC,WAAO,OAAO;AAAA,MACZ,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,MAAM,SAAS,gBAAgB;AACjC,WAAO,OAAO;AAAA,MACZ,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,4CAA4C,cAAc;AAAA,MACrE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,WAAW;AAAA,IACvB,KAAK,MACH,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO;AAAA,MAC9E;AAAA,IACF,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,2BAAU;AAAA,MACZ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAO,4BAAU,KAAK;AAAA,IACxB,CAAC;AAAA,EACL,CAAC;AACH;AAQO,MAAM,WAAW,CAAC,KAAgB,cAAwD;AAC/F,QAAM,QAAQ,QAAQ,OAAO,SAAS;AACtC,MAAI,CAAC,eAAe,WAAW,KAAK,GAAG;AACrC,WAAO,OAAO;AAAA,MACZ,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,WAAW;AAAA,MAChB,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,KAAK;AAAA,MAChD,OAAO,CAAC,UACN,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAO,4BAAU,KAAK;AAAA,MACxB,CAAC;AAAA,IACL,CAAC;AAAA,IACD,CAAC,cAAc,IAAI,IAAI,WAAW,SAAS,CAAC;AAAA,EAC9C;AACF;AAUO,MAAM,eAAe,CAAC,YAA+B,IAAI,2BAAU,EAAE,MAAM,gBAAgB,QAAQ,CAAC;AAkDpG,MAAM,gBAAgB,CAAC,SAAkB,YAC9C,OAAO,IAAI,aAAY;AAOrB,QAAM,YAAY,QAAQ;AAC1B,QAAM,OAAO,QAAQ,KAAK,IAAI,CAAC,SAAc,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE;AAClF,QAAM,eAAe,oBAAI,IAAuB;AAChD,aAAW,OAAO,MAAM;AACtB,QAAI,aAAa,IAAI,IAAI,GAAG,GAAG;AAC7B,aAAO,OAAO,OAAO;AAAA,QACnB,IAAI,2BAAU,EAAE,MAAM,mBAAmB,SAAS,OAAO,OAAO,sBAAsB,IAAI,GAAG,SAAS,CAAC;AAAA,MACzG;AAAA,IACF;AACA,iBAAa,IAAI,IAAI,KAAK,OAAO,cAAc,SAAS,MAAM,IAAI,MAAM,CAAC,CAAC;AAAA,EAC5E;AACA,QAAM,SAAS,aAAa,IAAI,SAAS;AACzC,MAAI,WAAW,QAAW;AACxB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,OAAO,OAAO;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,WAAW,QAAQ,aAAa;AAC3C,CAAC;AAkBI,MAAM,eAAe,CAAC,YAW3B,OAAO,IAAI,aAAY;AACrB,QAAM,WAAW,OAAO,SAAS,QAAQ,KAAK,QAAQ,SAAS;AAC/D,MAAI,CAAC,mBAAmB,UAAU,QAAQ,SAAS,GAAG;AACpD,WAAO,OAAO,OAAO,KAAK,aAAa,GAAG,QAAQ,OAAO,uBAAuB,CAAC;AAAA,EACnF;AACA,MAAI,QAAQ,UAAU,OAAW,QAAO,QAAQ;AAChD,QAAM,QAAQ,OAAO,MAAM;AAC3B,MAAI,SAAS,QAAQ,aAAa;AAChC,WAAO,OAAO,OAAO,KAAK,aAAa,GAAG,QAAQ,OAAO,cAAc,CAAC;AAAA,EAC1E;AACA,MAAI,QAAQ,cAAc,WAAW,QAAQ,YAAY,SAAS;AAChE,WAAO,OAAO,OAAO,KAAK,aAAa,GAAG,QAAQ,OAAO,eAAe,CAAC;AAAA,EAC3E;AACF,CAAC;",
+  "names": []
+}

package/dist/cjs/internal/SnapshotBoundary.d.ts

@@ -0,0 +1,17 @@
+/** Snapshot validation shared by the hosted and browser-side boundaries.
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import { SyncError } from "../SyncError.ts";
+import * as Protocol from "../SyncProtocol.ts";
+/** Decode a detached request before callbacks can mutate its expected identity.
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const request: (value: unknown) => Effect.Effect<Protocol.SnapshotRequest, SyncError>;
+/** Copy JSON bytes once, bound them, then check the exact requested projection.
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const response: (expected: Protocol.SnapshotRequest, value: unknown, maxBytes: number) => Effect.Effect<Protocol.Snapshot, SyncError>;
+//# sourceMappingURL=SnapshotBoundary.d.ts.map

package/dist/cjs/internal/SnapshotBoundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SnapshotBoundary.d.ts","sourceRoot":"","sources":["../../../src/internal/SnapshotBoundary.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,oBAAoB,CAAA;AAI9C;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAUvF,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,CAAC,eAAe,EAClC,OAAO,OAAO,EACd,UAAU,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAuDzC,CAAA"}

package/dist/cjs/internal/SnapshotBoundary.js

@@ -0,0 +1,97 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SnapshotBoundary_exports = {};
+__export(SnapshotBoundary_exports, {
+  request: () => request,
+  response: () => response
+});
+module.exports = __toCommonJS(SnapshotBoundary_exports);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var import_SyncError = require("../SyncError.js");
+var Protocol = __toESM(require("../SyncProtocol.js"), 1);
+var import_CauseText = require("./CauseText.js");
+var import_ProtocolVersion = require("./ProtocolVersion.js");
+const request = (value) => Effect.try({
+  try: () => Schema.decodeUnknownSync(Protocol.SnapshotRequest)(value, { onExcessProperty: "error" }),
+  catch: (cause) => new import_SyncError.SyncError({ code: "invalid_request", message: "Invalid public snapshot request", cause: (0, import_CauseText.causeCode)(cause) })
+}).pipe(
+  // The schema admits any integer version so this refusal, not a decode
+  // failure, is what a version mismatch produces here as on every other RPC.
+  Effect.tap((decoded) => (0, import_ProtocolVersion.requireVersion)(decoded.protocolVersion)),
+  Effect.map((decoded) => ({ ...decoded }))
+);
+const response = (expected, value, maxBytes) => Effect.gen(function* () {
+  const text = yield* Effect.try({
+    try: () => JSON.stringify(value),
+    catch: (cause) => new import_SyncError.SyncError({
+      code: "decode_failed",
+      message: "Public snapshot is not JSON encodable",
+      cause: (0, import_CauseText.causeCode)(cause)
+    })
+  });
+  if (text === void 0) {
+    return yield* Effect.fail(
+      new import_SyncError.SyncError({ code: "decode_failed", message: "Public snapshot is missing", cause: "undefined" })
+    );
+  }
+  if (new TextEncoder().encode(text).length > maxBytes) {
+    return yield* Effect.fail(
+      new import_SyncError.SyncError({ code: "frame_too_large", message: "Public snapshot exceeds the response byte limit" })
+    );
+  }
+  const snapshot = yield* Effect.try({
+    try: () => {
+      Schema.decodeUnknownSync(Protocol.Snapshot)(value, { onExcessProperty: "error" });
+      return Schema.decodeUnknownSync(Protocol.Snapshot)(JSON.parse(text), { onExcessProperty: "error" });
+    },
+    catch: (cause) => new import_SyncError.SyncError({ code: "decode_failed", message: "Invalid public snapshot response", cause: (0, import_CauseText.causeCode)(cause) })
+  });
+  yield* (0, import_ProtocolVersion.requireVersion)(snapshot.protocolVersion);
+  if (snapshot.runId !== expected.runId || snapshot.lineageId !== expected.lineageId || snapshot.projection !== expected.projection || snapshot.projectionVersion !== expected.projectionVersion) {
+    return yield* Effect.fail(
+      new import_SyncError.SyncError({
+        code: "protocol_violation",
+        message: "Public snapshot identity does not match the request",
+        cause: "snapshot_identity_mismatch"
+      })
+    );
+  }
+  if (snapshot.seq < expected.atLeastSeq) {
+    return yield* Effect.fail(
+      new import_SyncError.SyncError({
+        code: "compacted",
+        message: "Public snapshot does not cover the required history",
+        resync: { runId: expected.runId, checkpointSeq: expected.atLeastSeq }
+      })
+    );
+  }
+  return snapshot;
+});
+//# sourceMappingURL=SnapshotBoundary.js.map

package/dist/cjs/internal/SnapshotBoundary.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/SnapshotBoundary.ts"],
+  "sourcesContent": ["/** Snapshot validation shared by the hosted and browser-side boundaries.\n * @since 1.0.0-rc.0\n */\n\nimport * as Effect from \"effect/Effect\"\nimport * as Schema from \"effect/Schema\"\nimport { SyncError } from \"../SyncError.ts\"\nimport * as Protocol from \"../SyncProtocol.ts\"\nimport { causeCode } from \"./CauseText.ts\"\nimport { requireVersion } from \"./ProtocolVersion.ts\"\n\n/** Decode a detached request before callbacks can mutate its expected identity.\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const request = (value: unknown): Effect.Effect<Protocol.SnapshotRequest, SyncError> =>\n  Effect.try({\n    try: () => Schema.decodeUnknownSync(Protocol.SnapshotRequest)(value, { onExcessProperty: \"error\" }),\n    catch: (cause) =>\n      new SyncError({ code: \"invalid_request\", message: \"Invalid public snapshot request\", cause: causeCode(cause) })\n  }).pipe(\n    // The schema admits any integer version so this refusal, not a decode\n    // failure, is what a version mismatch produces here as on every other RPC.\n    Effect.tap((decoded) => requireVersion(decoded.protocolVersion)),\n    Effect.map((decoded) => ({ ...decoded }))\n  )\n\n/** Copy JSON bytes once, bound them, then check the exact requested projection.\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const response = (\n  expected: Protocol.SnapshotRequest,\n  value: unknown,\n  maxBytes: number\n): Effect.Effect<Protocol.Snapshot, SyncError> =>\n  Effect.gen(function*() {\n    const text = yield* Effect.try({\n      try: () => JSON.stringify(value),\n      catch: (cause) =>\n        new SyncError({\n          code: \"decode_failed\",\n          message: \"Public snapshot is not JSON encodable\",\n          cause: causeCode(cause)\n        })\n    })\n    if (text === undefined) {\n      return yield* Effect.fail(\n        new SyncError({ code: \"decode_failed\", message: \"Public snapshot is missing\", cause: \"undefined\" })\n      )\n    }\n    if (new TextEncoder().encode(text).length > maxBytes) {\n      return yield* Effect.fail(\n        new SyncError({ code: \"frame_too_large\", message: \"Public snapshot exceeds the response byte limit\" })\n      )\n    }\n    const snapshot = yield* Effect.try({\n      try: () => {\n        // JSON.stringify alone silently drops undefined/functions and turns\n        // non-finite numbers into null. Reject such provider values rather than\n        // returning a different state under the same checkpoint sequence.\n        Schema.decodeUnknownSync(Protocol.Snapshot)(value, { onExcessProperty: \"error\" })\n        return Schema.decodeUnknownSync(Protocol.Snapshot)(JSON.parse(text), { onExcessProperty: \"error\" })\n      },\n      catch: (cause) =>\n        new SyncError({ code: \"decode_failed\", message: \"Invalid public snapshot response\", cause: causeCode(cause) })\n    })\n    yield* requireVersion(snapshot.protocolVersion)\n    if (\n      snapshot.runId !== expected.runId || snapshot.lineageId !== expected.lineageId ||\n      snapshot.projection !== expected.projection || snapshot.projectionVersion !== expected.projectionVersion\n    ) {\n      return yield* Effect.fail(\n        new SyncError({\n          code: \"protocol_violation\",\n          message: \"Public snapshot identity does not match the request\",\n          cause: \"snapshot_identity_mismatch\"\n        })\n      )\n    }\n    if (snapshot.seq < expected.atLeastSeq) {\n      return yield* Effect.fail(\n        new SyncError({\n          code: \"compacted\",\n          message: \"Public snapshot does not cover the required history\",\n          resync: { runId: expected.runId, checkpointSeq: expected.atLeastSeq }\n        })\n      )\n    }\n    return snapshot\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,aAAwB;AACxB,aAAwB;AACxB,uBAA0B;AAC1B,eAA0B;AAC1B,uBAA0B;AAC1B,6BAA+B;AAMxB,MAAM,UAAU,CAAC,UACtB,OAAO,IAAI;AAAA,EACT,KAAK,MAAM,OAAO,kBAAkB,SAAS,eAAe,EAAE,OAAO,EAAE,kBAAkB,QAAQ,CAAC;AAAA,EAClG,OAAO,CAAC,UACN,IAAI,2BAAU,EAAE,MAAM,mBAAmB,SAAS,mCAAmC,WAAO,4BAAU,KAAK,EAAE,CAAC;AAClH,CAAC,EAAE;AAAA;AAAA;AAAA,EAGD,OAAO,IAAI,CAAC,gBAAY,uCAAe,QAAQ,eAAe,CAAC;AAAA,EAC/D,OAAO,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,EAAE;AAC1C;AAMK,MAAM,WAAW,CACtB,UACA,OACA,aAEA,OAAO,IAAI,aAAY;AACrB,QAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7B,KAAK,MAAM,KAAK,UAAU,KAAK;AAAA,IAC/B,OAAO,CAAC,UACN,IAAI,2BAAU;AAAA,MACZ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAO,4BAAU,KAAK;AAAA,IACxB,CAAC;AAAA,EACL,CAAC;AACD,MAAI,SAAS,QAAW;AACtB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,2BAAU,EAAE,MAAM,iBAAiB,SAAS,8BAA8B,OAAO,YAAY,CAAC;AAAA,IACpG;AAAA,EACF;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,SAAS,UAAU;AACpD,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,2BAAU,EAAE,MAAM,mBAAmB,SAAS,kDAAkD,CAAC;AAAA,IACvG;AAAA,EACF;AACA,QAAM,WAAW,OAAO,OAAO,IAAI;AAAA,IACjC,KAAK,MAAM;AAIT,aAAO,kBAAkB,SAAS,QAAQ,EAAE,OAAO,EAAE,kBAAkB,QAAQ,CAAC;AAChF,aAAO,OAAO,kBAAkB,SAAS,QAAQ,EAAE,KAAK,MAAM,IAAI,GAAG,EAAE,kBAAkB,QAAQ,CAAC;AAAA,IACpG;AAAA,IACA,OAAO,CAAC,UACN,IAAI,2BAAU,EAAE,MAAM,iBAAiB,SAAS,oCAAoC,WAAO,4BAAU,KAAK,EAAE,CAAC;AAAA,EACjH,CAAC;AACD,aAAO,uCAAe,SAAS,eAAe;AAC9C,MACE,SAAS,UAAU,SAAS,SAAS,SAAS,cAAc,SAAS,aACrE,SAAS,eAAe,SAAS,cAAc,SAAS,sBAAsB,SAAS,mBACvF;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,SAAS,MAAM,SAAS,YAAY;AACtC,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,2BAAU;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,QACT,QAAQ,EAAE,OAAO,SAAS,OAAO,eAAe,SAAS,WAAW;AAAA,MACtE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT,CAAC;",
+  "names": []
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/test/TestSocket.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Deterministic in-memory socket transport for sync tests.
+ *
+ * @since 0.1.0
+ */
+import * as Effect from "effect/Effect";
+import * as Scope from "effect/Scope";
+import * as Socket from "effect/unstable/socket/Socket";
+/**
+ * A predicate or byte transformation installed between the two socket ends.
+ * Returning `false` drops the frame.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type FrameFilter = (bytes: Uint8Array) => boolean | Uint8Array;
+/**
+ * Deterministic transport failures that can be injected into a test socket pair.
+ *
+ * `dropRange` recognizes the JSON representation of an `Entries` frame without
+ * importing the sync protocol. Tests using another wire representation can use
+ * `installFilter` directly.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface TestFaults {
+    readonly installFilter: (filter: FrameFilter) => void;
+    readonly dropRange: (runId: string, from: number, to: number) => void;
+    readonly stall: () => void;
+    readonly resume: () => void;
+    readonly disconnect: () => Effect.Effect<void>;
+}
+/**
+ * The two endpoints and controls of an in-memory socket connection.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Pair {
+    readonly client: Socket.Socket;
+    readonly server: Socket.Socket;
+    readonly faults: TestFaults;
+}
+/**
+ * Creates a scoped, bounded, bidirectional in-memory socket connection.
+ *
+ * Socket runs wait on queue reads and are therefore interrupted with their
+ * enclosing scope; no host abort signal or timer is involved.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makePair: () => Effect.Effect<Pair, never, Scope.Scope>;
+//# sourceMappingURL=TestSocket.d.ts.map

package/dist/cjs/test/TestSocket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TestSocket.d.ts","sourceRoot":"","sources":["../../../src/test/TestSocket.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,GAAG,UAAU,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAA;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CAC/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAkF9D,CAAA"}