@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/client/session/sessionTypes.d.ts

@@ -0,0 +1,153 @@
+import type { ApiClient } from "../../internal/api-client/index.js";
+import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
+import type { SecurityIncidentReporter } from "../../data/securityIncidents.js";
+import type { ProvisionedSystemContainerSpec } from "../../workflows/registration/index.js";
+import type { ClearRemoteSyncStateResult } from "../../workflows/sync/index.js";
+import type { Database } from "../database.js";
+import type { Identity } from "../identity.js";
+import type { BoundUserIdLookup, SessionRegistrationRefusal, UserIdentityAvailable } from "./sessionIdentityTrust.js";
+export type { SessionRegistrationRefusal } from "./sessionIdentityTrust.js";
+export interface SessionDependencies {
+    api: ApiClient;
+    database: Database;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    identity: Identity;
+    log: (message: string) => void;
+    logError: (message: string | Error, cause?: unknown) => void;
+    /** The user this device's trust store already binds a signing key to. */
+    boundUserIdForSigningKey?: BoundUserIdLookup | undefined;
+    onUserIdentityAvailable?: UserIdentityAvailable | undefined;
+    /** App-owned system containers provisioned with each new organization. */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    /**
+     * Records a refused login (a different account than acknowledged) or a
+     * refused root acknowledgement; absent in bare test harnesses.
+     */
+    reportSecurityIncident?: SecurityIncidentReporter | undefined;
+}
+export interface SessionContext {
+    /** Fingerprint-bound host restore only; view selections never acknowledge roots. */
+    rootAcknowledgments?: SessionSnapshot["rootAcknowledgments"] | undefined;
+    authToken?: string | null | undefined;
+    containerId?: string | null | undefined;
+    /** Server-backed personal organization; independent of the active org. */
+    defaultOrganizationId?: string | null | undefined;
+    isAuthenticated?: boolean | undefined;
+    /** Platform-operator flag reported by the server at login. */
+    isRoot?: boolean | undefined;
+    organizationId?: string | null | undefined;
+    userId?: string | null | undefined;
+}
+export interface SessionSnapshot {
+    /**
+     * Server acknowledgements retained independently of the selected container.
+     * Bound to (signing fingerprint, user, organization): once acknowledged, an
+     * organization's root id may only be re-acknowledged or reported purged.
+     */
+    rootAcknowledgments: ReadonlyArray<{
+        readonly signingFingerprint: string;
+        readonly userId: string;
+        readonly organizationId: string;
+        readonly rootContainerId: string | null;
+    }>;
+    authToken: string | null;
+    containerId: string | null;
+    /** Server-backed personal organization; independent of the active org. */
+    defaultOrganizationId: string | null;
+    isAuthenticated: boolean;
+    /** Platform-operator flag reported by the server at login. */
+    isRoot: boolean;
+    organizationId: string | null;
+    userId: string | null;
+}
+export type SessionListener = () => void;
+export interface SessionRegistrationResult {
+    readonly challenge: string;
+    readonly containerId: string;
+    readonly organizationId: string;
+    readonly userId: string;
+}
+export interface SessionCreateOrganizationResult {
+    readonly containerId: string;
+    readonly organizationId: string;
+}
+export interface SessionRecoverOrganizationResult extends SessionCreateOrganizationResult {
+    readonly reset: ClearRemoteSyncStateResult;
+    readonly replacedOrganizationId: string;
+}
+export interface CreateOrganizationOptions {
+    /** Overrides the seeded organization profile name; see registration. */
+    readonly organizationProfileName?: string | undefined;
+    /** Overrides the seeded self roster-profile nickname; see registration. */
+    readonly rosterProfileNickname?: string | undefined;
+}
+export interface RegisterIdentityOptions {
+    /**
+     * Overrides the seeded personal-organization profile name. Optional; when
+     * omitted the default personal-org name is used. The demo host passes each
+     * pane's peer-labeled org name ("Peer 1's Org").
+     */
+    readonly organizationProfileName?: string | undefined;
+    /**
+     * Overrides the seeded self roster-profile nickname. Optional; when omitted
+     * the default ("You") is used. The demo host passes each pane's peer-labeled
+     * self name ("Peer 1 (You)").
+     */
+    readonly rosterProfileNickname?: string | undefined;
+}
+export interface UserSession {
+    readonly createdAt: string;
+    readonly id: string;
+    readonly ipAddresses: string[];
+    readonly isCurrent: boolean;
+    readonly lastActiveAt: string;
+    readonly lastActiveIp: string | null;
+    readonly signingKeyFingerprint: string;
+}
+export interface Session {
+    readonly authToken: string | null;
+    readonly containerId: string | null;
+    /** Server-backed personal organization; independent of the active org. */
+    readonly defaultOrganizationId: string | null;
+    readonly isAuthenticated: boolean;
+    /**
+     * Platform-operator flag reported by the server at login. It only decides
+     * whether the root console is offered; the API enforces root access itself.
+     */
+    readonly isRoot: boolean;
+    readonly organizationId: string | null;
+    readonly snapshot: SessionSnapshot;
+    /** Controls server replication without changing network connectivity. */
+    readonly syncEnabled: boolean;
+    readonly userId: string | null;
+    /**
+     * Whether `userId` was acknowledged by the server for the active signing
+     * identity (a successful login or a fingerprint-bound host restore). A user
+     * ID chosen locally through `setUserId` is not, and hosts must not persist
+     * it as this identity's account.
+     */
+    readonly userIdAcknowledged: boolean;
+    bootstrapLocalRootContainer(): Promise<{
+        containerId: string;
+        created: boolean;
+    }>;
+    clearRemoteSyncState(organizationId: string): Promise<ClearRemoteSyncStateResult>;
+    createOrganization(options?: CreateOrganizationOptions): Promise<SessionCreateOrganizationResult | null>;
+    completeNativeSubscriptionRestoreOrganization(organizationId: string): Promise<boolean>;
+    destroySession(sessionId: string): Promise<boolean>;
+    listSessions(): Promise<UserSession[]>;
+    login(challengeHex?: string | undefined): Promise<boolean>;
+    logout(): void;
+    logoutRemote(): Promise<boolean>;
+    prepareNativeSubscriptionRestoreOrganization(options?: CreateOrganizationOptions): Promise<SessionCreateOrganizationResult | null>;
+    registerIdentity(options?: RegisterIdentityOptions): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null>;
+    recoverPurgedOrganization(organizationId: string, options?: CreateOrganizationOptions): Promise<SessionRecoverOrganizationResult | null>;
+    setAuthToken(authToken: string | null): void;
+    setContainerId(containerId: string | null): void;
+    /** Host-restored context must match the active signing identity; conflicting user acknowledgments throw. */
+    setContext(context: SessionContext): void;
+    setOrganizationId(organizationId: string | null): void;
+    setSyncEnabled(enabled: boolean): void;
+    setUserId(userId: string | null): void;
+    subscribe(listener: SessionListener): () => void;
+}

package/client/session/sessionTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sessionTypes.js.map

package/client/session/sessionTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["sessionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ProvisionedSystemContainerSpec } from \"../../workflows/registration\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport type { Database } from \"../database\";\nimport type { Identity } from \"../identity\";\nimport type {\n  BoundUserIdLookup,\n  SessionRegistrationRefusal,\n  UserIdentityAvailable,\n} from \"./sessionIdentityTrust\";\n\nexport type { SessionRegistrationRefusal } from \"./sessionIdentityTrust\";\n\nexport interface SessionDependencies {\n  api: ApiClient;\n  database: Database;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  identity: Identity;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  /** The user this device's trust store already binds a signing key to. */\n  boundUserIdForSigningKey?: BoundUserIdLookup | undefined;\n  onUserIdentityAvailable?: UserIdentityAvailable | undefined;\n  /** App-owned system containers provisioned with each new organization. */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Records a refused login (a different account than acknowledged) or a\n   * refused root acknowledgement; absent in bare test harnesses.\n   */\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n}\n\nexport interface SessionContext {\n  /** Fingerprint-bound host restore only; view selections never acknowledge roots. */\n  rootAcknowledgments?: SessionSnapshot[\"rootAcknowledgments\"] | undefined;\n  authToken?: string | null | undefined;\n  containerId?: string | null | undefined;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId?: string | null | undefined;\n  isAuthenticated?: boolean | undefined;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot?: boolean | undefined;\n  organizationId?: string | null | undefined;\n  userId?: string | null | undefined;\n}\n\nexport interface SessionSnapshot {\n  /**\n   * Server acknowledgements retained independently of the selected container.\n   * Bound to (signing fingerprint, user, organization): once acknowledged, an\n   * organization's root id may only be re-acknowledged or reported purged.\n   */\n  rootAcknowledgments: ReadonlyArray<{\n    readonly signingFingerprint: string;\n    readonly userId: string;\n    readonly organizationId: string;\n    readonly rootContainerId: string | null;\n  }>;\n  authToken: string | null;\n  containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId: string | null;\n  isAuthenticated: boolean;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot: boolean;\n  organizationId: string | null;\n  userId: string | null;\n}\n\nexport type SessionListener = () => void;\n\nexport interface SessionRegistrationResult {\n  readonly challenge: string;\n  readonly containerId: string;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport interface SessionCreateOrganizationResult {\n  readonly containerId: string;\n  readonly organizationId: string;\n}\n\nexport interface SessionRecoverOrganizationResult\n  extends SessionCreateOrganizationResult {\n  readonly reset: ClearRemoteSyncStateResult;\n  readonly replacedOrganizationId: string;\n}\n\nexport interface CreateOrganizationOptions {\n  /** Overrides the seeded organization profile name; see registration. */\n  readonly organizationProfileName?: string | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface RegisterIdentityOptions {\n  /**\n   * Overrides the seeded personal-organization profile name. Optional; when\n   * omitted the default personal-org name is used. The demo host passes each\n   * pane's peer-labeled org name (\"Peer 1's Org\").\n   */\n  readonly organizationProfileName?: string | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname. Optional; when omitted\n   * the default (\"You\") is used. The demo host passes each pane's peer-labeled\n   * self name (\"Peer 1 (You)\").\n   */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface UserSession {\n  readonly createdAt: string;\n  readonly id: string;\n  readonly ipAddresses: string[];\n  readonly isCurrent: boolean;\n  readonly lastActiveAt: string;\n  readonly lastActiveIp: string | null;\n  readonly signingKeyFingerprint: string;\n}\n\nexport interface Session {\n  readonly authToken: string | null;\n  readonly containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  readonly defaultOrganizationId: string | null;\n  readonly isAuthenticated: boolean;\n  /**\n   * Platform-operator flag reported by the server at login. It only decides\n   * whether the root console is offered; the API enforces root access itself.\n   */\n  readonly isRoot: boolean;\n  readonly organizationId: string | null;\n  readonly snapshot: SessionSnapshot;\n  /** Controls server replication without changing network connectivity. */\n  readonly syncEnabled: boolean;\n  readonly userId: string | null;\n  /**\n   * Whether `userId` was acknowledged by the server for the active signing\n   * identity (a successful login or a fingerprint-bound host restore). A user\n   * ID chosen locally through `setUserId` is not, and hosts must not persist\n   * it as this identity's account.\n   */\n  readonly userIdAcknowledged: boolean;\n  bootstrapLocalRootContainer(): Promise<{\n    containerId: string;\n    created: boolean;\n  }>;\n  clearRemoteSyncState(\n    organizationId: string,\n  ): Promise<ClearRemoteSyncStateResult>;\n  createOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  completeNativeSubscriptionRestoreOrganization(\n    organizationId: string,\n  ): Promise<boolean>;\n  destroySession(sessionId: string): Promise<boolean>;\n  listSessions(): Promise<UserSession[]>;\n  login(challengeHex?: string | undefined): Promise<boolean>;\n  logout(): void;\n  logoutRemote(): Promise<boolean>;\n  prepareNativeSubscriptionRestoreOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  registerIdentity(\n    options?: RegisterIdentityOptions,\n  ): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null>;\n  recoverPurgedOrganization(\n    organizationId: string,\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionRecoverOrganizationResult | null>;\n  setAuthToken(authToken: string | null): void;\n  setContainerId(containerId: string | null): void;\n  /** Host-restored context must match the active signing identity; conflicting user acknowledgments throw. */\n  setContext(context: SessionContext): void;\n  setOrganizationId(organizationId: string | null): void;\n  setSyncEnabled(enabled: boolean): void;\n  setUserId(userId: string | null): void;\n  subscribe(listener: SessionListener): () => void;\n}\n"]}

package/client/syncBillingGate.d.ts

@@ -0,0 +1,50 @@
+export type SyncBillingGateListener = (organizationId: string | null) => void;
+/**
+ * Signals that a sync write was rejected because its target organization cannot
+ * sync (HTTP 402). Identified blocks are retained independently per org; a 402
+ * without an org id is a conservative wildcard. Repeated signals for an already
+ * blocked org are coalesced so they do not fan out into a refresh storm.
+ */
+export declare class SyncBillingGate {
+    private readonly blockedOrganizationIds;
+    private readonly listeners;
+    private readonly unknownBlockExemptOrganizationIds;
+    private hasUnknownOrganizationBlock;
+    private lastBlockedOrganizationIdValue;
+    get blockedOrganizationId(): string | null;
+    /**
+     * Whether a block is currently in effect — true even when the block carries an
+     * unknown/omitted org (`null`), which `blockedOrganizationId` cannot distinguish
+     * from the never-signalled state.
+     */
+    get isBlocked(): boolean;
+    /**
+     * Whether remote sync is blocked for a specific organization. An unattributed 402
+     * without an organization id is treated conservatively as applying to every
+     * organization, while an identified block remains isolated to its target.
+     */
+    isBlockedForOrganization(organizationId: string | null): boolean;
+    /**
+     * The identified organizations *other than* `organizationId` that are
+     * currently blocked — the footer sync indicator's "some other org cannot
+     * sync" signal, since the shared billing snapshot only covers the active
+     * organization. Passing `null` (no active org) lists every identified block.
+     *
+     * Unknown-org wildcard blocks are deliberately omitted: a caller that needs
+     * to tell a lapsed organization apart from a free `local` one has to resolve
+     * the org's billing, which an anonymous block gives it no way to do. Use
+     * {@link isBlocked} for the conservative gate-everything reading.
+     */
+    listBlocksOutsideOrganization(organizationId: string | null): readonly string[];
+    notifyPaymentRequired(organizationId: string | null): void;
+    /**
+     * Clear one recovered organization without disturbing other org blocks. A
+     * named recovery exempts only that org from an unattributed unknown-org wildcard;
+     * unrelated orgs remain conservatively blocked. Omitting the argument retains
+     * the public clear-all behavior. Recovery does not notify subscribers because
+     * the billing refetch that observed it already represents the state change.
+     */
+    clearBlock(organizationId?: string | null): void;
+    private refreshLastBlockedOrganizationId;
+    subscribe: (listener: SyncBillingGateListener) => (() => void);
+}

package/client/syncBillingGate.js

@@ -0,0 +1,107 @@
+import { createListenerSet } from "./listenerSet.js";
+/**
+ * Signals that a sync write was rejected because its target organization cannot
+ * sync (HTTP 402). Identified blocks are retained independently per org; a 402
+ * without an org id is a conservative wildcard. Repeated signals for an already
+ * blocked org are coalesced so they do not fan out into a refresh storm.
+ */
+export class SyncBillingGate {
+    blockedOrganizationIds = new Set();
+    listeners = createListenerSet();
+    unknownBlockExemptOrganizationIds = new Set();
+    hasUnknownOrganizationBlock = false;
+    lastBlockedOrganizationIdValue;
+    get blockedOrganizationId() {
+        return this.lastBlockedOrganizationIdValue ?? null;
+    }
+    /**
+     * Whether a block is currently in effect — true even when the block carries an
+     * unknown/omitted org (`null`), which `blockedOrganizationId` cannot distinguish
+     * from the never-signalled state.
+     */
+    get isBlocked() {
+        return (this.hasUnknownOrganizationBlock || this.blockedOrganizationIds.size > 0);
+    }
+    /**
+     * Whether remote sync is blocked for a specific organization. An unattributed 402
+     * without an organization id is treated conservatively as applying to every
+     * organization, while an identified block remains isolated to its target.
+     */
+    isBlockedForOrganization(organizationId) {
+        if (organizationId === null) {
+            return this.hasUnknownOrganizationBlock;
+        }
+        return (this.blockedOrganizationIds.has(organizationId) ||
+            (this.hasUnknownOrganizationBlock &&
+                !this.unknownBlockExemptOrganizationIds.has(organizationId)));
+    }
+    /**
+     * The identified organizations *other than* `organizationId` that are
+     * currently blocked — the footer sync indicator's "some other org cannot
+     * sync" signal, since the shared billing snapshot only covers the active
+     * organization. Passing `null` (no active org) lists every identified block.
+     *
+     * Unknown-org wildcard blocks are deliberately omitted: a caller that needs
+     * to tell a lapsed organization apart from a free `local` one has to resolve
+     * the org's billing, which an anonymous block gives it no way to do. Use
+     * {@link isBlocked} for the conservative gate-everything reading.
+     */
+    listBlocksOutsideOrganization(organizationId) {
+        return Array.from(this.blockedOrganizationIds).filter((blockedId) => blockedId !== organizationId);
+    }
+    notifyPaymentRequired(organizationId) {
+        if (organizationId === null) {
+            if (this.hasUnknownOrganizationBlock &&
+                this.unknownBlockExemptOrganizationIds.size === 0) {
+                return;
+            }
+            this.hasUnknownOrganizationBlock = true;
+            this.unknownBlockExemptOrganizationIds.clear();
+        }
+        else {
+            if (this.blockedOrganizationIds.has(organizationId)) {
+                return;
+            }
+            this.blockedOrganizationIds.add(organizationId);
+            this.unknownBlockExemptOrganizationIds.delete(organizationId);
+        }
+        this.lastBlockedOrganizationIdValue = organizationId;
+        this.listeners.notify(organizationId);
+    }
+    /**
+     * Clear one recovered organization without disturbing other org blocks. A
+     * named recovery exempts only that org from an unattributed unknown-org wildcard;
+     * unrelated orgs remain conservatively blocked. Omitting the argument retains
+     * the public clear-all behavior. Recovery does not notify subscribers because
+     * the billing refetch that observed it already represents the state change.
+     */
+    clearBlock(organizationId) {
+        if (organizationId === undefined) {
+            this.blockedOrganizationIds.clear();
+            this.hasUnknownOrganizationBlock = false;
+            this.unknownBlockExemptOrganizationIds.clear();
+            this.lastBlockedOrganizationIdValue = undefined;
+            return;
+        }
+        if (organizationId === null) {
+            this.hasUnknownOrganizationBlock = false;
+            this.unknownBlockExemptOrganizationIds.clear();
+        }
+        else {
+            this.blockedOrganizationIds.delete(organizationId);
+            if (this.hasUnknownOrganizationBlock) {
+                this.unknownBlockExemptOrganizationIds.add(organizationId);
+            }
+        }
+        this.refreshLastBlockedOrganizationId();
+    }
+    refreshLastBlockedOrganizationId() {
+        if (this.hasUnknownOrganizationBlock) {
+            this.lastBlockedOrganizationIdValue = null;
+            return;
+        }
+        this.lastBlockedOrganizationIdValue = Array.from(this.blockedOrganizationIds).at(-1);
+    }
+    subscribe = (listener) => this.listeners.subscribe(listener);
+}
+//# sourceMappingURL=syncBillingGate.js.map

package/client/syncBillingGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncBillingGate.js","sourceRoot":"","sources":["syncBillingGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACT,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,SAAS,GAAG,iBAAiB,EAAmB,CAAC;IACjD,iCAAiC,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/D,2BAA2B,GAAG,KAAK,CAAC;IACpC,8BAA8B,CAA4B;IAElE,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,CACL,IAAI,CAAC,2BAA2B,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,wBAAwB,CAAC,cAA6B;QACpD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,2BAA2B,CAAC;QAC1C,CAAC;QAED,OAAO,CACL,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC;YAC/C,CAAC,IAAI,CAAC,2BAA2B;gBAC/B,CAAC,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,6BAA6B,CAC3B,cAA6B;QAE7B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,cAAc,CAC5C,CAAC;IACJ,CAAC;IAED,qBAAqB,CAAC,cAA6B;QACjD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IACE,IAAI,CAAC,2BAA2B;gBAChC,IAAI,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC,EACjD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC;YACxC,IAAI,CAAC,iCAAiC,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,8BAA8B,GAAG,cAAc,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,cAA8B;QACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,CAAC,2BAA2B,GAAG,KAAK,CAAC;YACzC,IAAI,CAAC,iCAAiC,CAAC,KAAK,EAAE,CAAC;YAC/C,IAAI,CAAC,8BAA8B,GAAG,SAAS,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,2BAA2B,GAAG,KAAK,CAAC;YACzC,IAAI,CAAC,iCAAiC,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACrC,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,gCAAgC,EAAE,CAAC;IAC1C,CAAC;IAEO,gCAAgC;QACtC,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACrC,IAAI,CAAC,8BAA8B,GAAG,IAAI,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,8BAA8B,GAAG,KAAK,CAAC,IAAI,CAC9C,IAAI,CAAC,sBAAsB,CAC5B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACX,CAAC;IAED,SAAS,GAAG,CAAC,QAAiC,EAAgB,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;CACtC","sourcesContent":["import { createListenerSet } from \"./listenerSet\";\nexport type SyncBillingGateListener = (organizationId: string | null) => void;\n\n/**\n * Signals that a sync write was rejected because its target organization cannot\n * sync (HTTP 402). Identified blocks are retained independently per org; a 402\n * without an org id is a conservative wildcard. Repeated signals for an already\n * blocked org are coalesced so they do not fan out into a refresh storm.\n */\nexport class SyncBillingGate {\n  private readonly blockedOrganizationIds = new Set<string>();\n  private readonly listeners = createListenerSet<[string | null]>();\n  private readonly unknownBlockExemptOrganizationIds = new Set<string>();\n  private hasUnknownOrganizationBlock = false;\n  private lastBlockedOrganizationIdValue: string | null | undefined;\n\n  get blockedOrganizationId(): string | null {\n    return this.lastBlockedOrganizationIdValue ?? null;\n  }\n\n  /**\n   * Whether a block is currently in effect — true even when the block carries an\n   * unknown/omitted org (`null`), which `blockedOrganizationId` cannot distinguish\n   * from the never-signalled state.\n   */\n  get isBlocked(): boolean {\n    return (\n      this.hasUnknownOrganizationBlock || this.blockedOrganizationIds.size > 0\n    );\n  }\n\n  /**\n   * Whether remote sync is blocked for a specific organization. An unattributed 402\n   * without an organization id is treated conservatively as applying to every\n   * organization, while an identified block remains isolated to its target.\n   */\n  isBlockedForOrganization(organizationId: string | null): boolean {\n    if (organizationId === null) {\n      return this.hasUnknownOrganizationBlock;\n    }\n\n    return (\n      this.blockedOrganizationIds.has(organizationId) ||\n      (this.hasUnknownOrganizationBlock &&\n        !this.unknownBlockExemptOrganizationIds.has(organizationId))\n    );\n  }\n\n  /**\n   * The identified organizations *other than* `organizationId` that are\n   * currently blocked — the footer sync indicator's \"some other org cannot\n   * sync\" signal, since the shared billing snapshot only covers the active\n   * organization. Passing `null` (no active org) lists every identified block.\n   *\n   * Unknown-org wildcard blocks are deliberately omitted: a caller that needs\n   * to tell a lapsed organization apart from a free `local` one has to resolve\n   * the org's billing, which an anonymous block gives it no way to do. Use\n   * {@link isBlocked} for the conservative gate-everything reading.\n   */\n  listBlocksOutsideOrganization(\n    organizationId: string | null,\n  ): readonly string[] {\n    return Array.from(this.blockedOrganizationIds).filter(\n      (blockedId) => blockedId !== organizationId,\n    );\n  }\n\n  notifyPaymentRequired(organizationId: string | null): void {\n    if (organizationId === null) {\n      if (\n        this.hasUnknownOrganizationBlock &&\n        this.unknownBlockExemptOrganizationIds.size === 0\n      ) {\n        return;\n      }\n      this.hasUnknownOrganizationBlock = true;\n      this.unknownBlockExemptOrganizationIds.clear();\n    } else {\n      if (this.blockedOrganizationIds.has(organizationId)) {\n        return;\n      }\n      this.blockedOrganizationIds.add(organizationId);\n      this.unknownBlockExemptOrganizationIds.delete(organizationId);\n    }\n    this.lastBlockedOrganizationIdValue = organizationId;\n    this.listeners.notify(organizationId);\n  }\n\n  /**\n   * Clear one recovered organization without disturbing other org blocks. A\n   * named recovery exempts only that org from an unattributed unknown-org wildcard;\n   * unrelated orgs remain conservatively blocked. Omitting the argument retains\n   * the public clear-all behavior. Recovery does not notify subscribers because\n   * the billing refetch that observed it already represents the state change.\n   */\n  clearBlock(organizationId?: string | null): void {\n    if (organizationId === undefined) {\n      this.blockedOrganizationIds.clear();\n      this.hasUnknownOrganizationBlock = false;\n      this.unknownBlockExemptOrganizationIds.clear();\n      this.lastBlockedOrganizationIdValue = undefined;\n      return;\n    }\n\n    if (organizationId === null) {\n      this.hasUnknownOrganizationBlock = false;\n      this.unknownBlockExemptOrganizationIds.clear();\n    } else {\n      this.blockedOrganizationIds.delete(organizationId);\n      if (this.hasUnknownOrganizationBlock) {\n        this.unknownBlockExemptOrganizationIds.add(organizationId);\n      }\n    }\n    this.refreshLastBlockedOrganizationId();\n  }\n\n  private refreshLastBlockedOrganizationId(): void {\n    if (this.hasUnknownOrganizationBlock) {\n      this.lastBlockedOrganizationIdValue = null;\n      return;\n    }\n\n    this.lastBlockedOrganizationIdValue = Array.from(\n      this.blockedOrganizationIds,\n    ).at(-1);\n  }\n\n  subscribe = (listener: SyncBillingGateListener): (() => void) =>\n    this.listeners.subscribe(listener);\n}\n"]}

package/client/userIdentities.d.ts

@@ -0,0 +1,16 @@
+import { type TrustedUserIdentityResolver } from "../data/trustedUserIdentity/index.js";
+export interface ResolvedUserIdentity {
+    encapsulationKeyFingerprint: string;
+    encapsulationPublicKey: string;
+    signingKeyFingerprint: string;
+    signingPublicKey: string;
+    userId: string;
+}
+export interface UserIdentities {
+    /** `null` when the user is unknown or currently unresolvable; integrity failures throw. */
+    resolve(userId: string): Promise<ResolvedUserIdentity | null>;
+}
+export declare function createUserIdentities(input: {
+    log: (message: string) => void;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+}): UserIdentities;

package/client/userIdentities.js

@@ -0,0 +1,32 @@
+import { bytesToBase64 } from "../internal/encoding/index.js";
+import { ProjectionDependencyUnavailableError } from "../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { requireTrustedUserIdentityResolver, } from "../data/trustedUserIdentity/index.js";
+export function createUserIdentities(input) {
+    const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity);
+    return {
+        async resolve(userId) {
+            input.log(`Loading user identity for userId: ${userId}`);
+            let identity;
+            try {
+                identity = await resolveTrustedUserIdentity(userId);
+            }
+            catch (error) {
+                if (!(error instanceof ProjectionDependencyUnavailableError))
+                    throw error;
+                input.log(`User identity for ${userId} is unavailable: ${error.message}`);
+                return null;
+            }
+            if (!identity) {
+                return null;
+            }
+            return {
+                encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,
+                encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),
+                signingKeyFingerprint: identity.signingKeyFingerprint,
+                signingPublicKey: bytesToBase64(identity.signingPublicKey),
+                userId: identity.userId,
+            };
+        },
+    };
+}
+//# sourceMappingURL=userIdentities.js.map

package/client/userIdentities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userIdentities.js","sourceRoot":"","sources":["userIdentities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4DAA4D,CAAC;AAClH,OAAO,EACL,kCAAkC,GAEnC,MAAM,6BAA6B,CAAC;AAerC,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,GAAG,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,QAA0D,CAAC;YAC/D,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,KAAK,CAAC,GAAG,CACP,qBAAqB,MAAM,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAC/D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;gBACjE,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACtE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;gBACrD,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport { ProjectionDependencyUnavailableError } from \"../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../data/trustedUserIdentity\";\n\nexport interface ResolvedUserIdentity {\n  encapsulationKeyFingerprint: string;\n  encapsulationPublicKey: string;\n  signingKeyFingerprint: string;\n  signingPublicKey: string;\n  userId: string;\n}\n\nexport interface UserIdentities {\n  /** `null` when the user is unknown or currently unresolvable; integrity failures throw. */\n  resolve(userId: string): Promise<ResolvedUserIdentity | null>;\n}\n\nexport function createUserIdentities(input: {\n  log: (message: string) => void;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): UserIdentities {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  return {\n    async resolve(userId) {\n      input.log(`Loading user identity for userId: ${userId}`);\n      let identity: Awaited<ReturnType<TrustedUserIdentityResolver>>;\n      try {\n        identity = await resolveTrustedUserIdentity(userId);\n      } catch (error) {\n        if (!(error instanceof ProjectionDependencyUnavailableError))\n          throw error;\n        input.log(\n          `User identity for ${userId} is unavailable: ${error.message}`,\n        );\n        return null;\n      }\n      if (!identity) {\n        return null;\n      }\n\n      return {\n        encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),\n        signingKeyFingerprint: identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(identity.signingPublicKey),\n        userId: identity.userId,\n      };\n    },\n  };\n}\n"]}

package/client/workflowRuntime.d.ts

@@ -0,0 +1,60 @@
+import type { ApiClient } from "../internal/api-client/index.js";
+import type { DocumentProjectorRegistry } from "../data/documents/documentKinds.js";
+import type { DomainScope } from "../data/domainScope.js";
+import type { PrincipalHistoryProtectionLease } from "../data/principals/principalHistoryProtection.js";
+import type { SecurityIncidentReporter } from "../data/securityIncidents.js";
+import { type LocalUserIdentityCandidate, type TrustedUserIdentityResolver } from "../data/trustedUserIdentity/index.js";
+import type { ContainerContentsRootAdopter } from "../workflows/container-contents/runtime.js";
+import type { WorkflowRuntimeGroups, WorkflowRuntimeUtilInput } from "../workflows/runtimeInput.js";
+import type { Blobs } from "./blobs.js";
+import type { Database } from "./database.js";
+import type { Events } from "./events.js";
+import type { Identity } from "./identity.js";
+import type { Network } from "./network.js";
+import { type PrincipalHistoryKeyProvider } from "./principalHistoryProtection.js";
+import type { Session } from "./session/sessionTypes.js";
+import type { SyncBillingGate } from "./syncBillingGate.js";
+type HostWorkflowRuntimeUtilInput = Omit<WorkflowRuntimeUtilInput, "reportSecurityIncident">;
+export interface WorkflowRuntimeInput extends Omit<WorkflowRuntimeGroups, "util"> {
+    readonly util: HostWorkflowRuntimeUtilInput;
+}
+export type RuntimeListener = () => void;
+export interface Runtime {
+    readonly version: number;
+    input(containerId?: string | null | undefined): WorkflowRuntimeInput;
+    subscribe(listener: RuntimeListener): () => void;
+}
+export interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {
+    readonly apiClient: ApiClient;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
+}
+export interface InternalRuntime {
+    retirePrincipalHistoryProtection(): void;
+    readonly sessionGeneration: number;
+    readonly adoptRootContainer: ContainerContentsRootAdopter;
+    readonly publicRuntime: Runtime;
+    boundUserId(signingKeyFingerprint: string): Promise<string | null>;
+    pinLocalUserIdentity(userId: string, candidate: LocalUserIdentityCandidate): Promise<void>;
+    workflowInput(containerId?: string | null | undefined): InternalWorkflowRuntimeInput;
+}
+interface WorkflowRuntimeDependencies {
+    api: ApiClient;
+    blobs: Blobs;
+    database: Database;
+    documentProjectors: DocumentProjectorRegistry;
+    events: Events;
+    getDomainScope: () => DomainScope;
+    identity: Identity;
+    identityTrustDomain: string | null;
+    log: (message: string) => void;
+    logError: (message: string | Error, cause?: unknown) => void;
+    network: Network;
+    peerScope?: string | null;
+    principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
+    reportSecurityIncident: SecurityIncidentReporter;
+    session: Session;
+    syncBillingGate?: SyncBillingGate | undefined;
+}
+export declare function createRuntime(dependencies: WorkflowRuntimeDependencies): InternalRuntime;
+export {};