@tearleads/client-sdk 0.1.14 → 0.1.16

package/client/organizations/organizationsTypes.d.ts

@@ -0,0 +1,47 @@
+import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
+import type { addOrganizationGroupUser, cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
+import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
+import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
+import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
+import type { AbandonOrganizationPolicyMutationInput, DiscardUnreadableOrganizationPolicyMutationInput, readPendingOrganizationPolicyMutation } from "./principalMutationRecovery.js";
+import type { AddOrganizationGroupUserInput, deleteGroupForOrganization, OrganizationGrantRef, RemoveOrganizationGroupUserInput } from "./principalMutations.js";
+export interface Organizations {
+    discardUnreadablePolicyMutation: (input: DiscardUnreadableOrganizationPolicyMutationInput) => Promise<boolean>;
+    readPendingPolicyMutation: (organizationId: string) => ReturnType<typeof readPendingOrganizationPolicyMutation>;
+    retryPendingPolicyMutation: (organizationId: string) => Promise<void>;
+    abandonPendingPolicyMutation: (input: AbandonOrganizationPolicyMutationInput) => Promise<boolean>;
+    addUserToGroup: (input: AddOrganizationGroupUserInput) => ReturnType<typeof addOrganizationGroupUser>;
+    createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;
+    deleteGroup: (groupId: string) => ReturnType<typeof deleteGroupForOrganization>;
+    importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;
+    loadBilling: () => ReturnType<typeof loadOrganizationBilling>;
+    /** Billing for an organization the session is not currently switched to. */
+    loadBillingForOrganization: (organizationId: string) => ReturnType<typeof loadOrganizationBilling>;
+    loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;
+    loadBillingManagementUrl: () => ReturnType<typeof loadOrganizationBillingManagementUrl>;
+    /** Direct Stripe checkout (issue #1654): options, start, and cancel. */
+    loadStripeCheckoutOptions: (organizationId?: string) => ReturnType<typeof loadStripeCheckoutOptions>;
+    createStripeCheckout: (organizationId?: string) => ReturnType<typeof createStripeCheckout>;
+    createStripeCheckoutSession: (returnUrl: string, organizationId?: string) => ReturnType<typeof createStripeCheckoutSession>;
+    cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;
+    claimNativeSubscription: (organizationId: string, store: NativeSubscriptionStore) => ReturnType<typeof claimNativeOrganizationSubscription>;
+    checkNativePurchaseEligibility: (organizationId: string, store: NativeSubscriptionStore) => ReturnType<typeof checkNativePurchaseEligibility>;
+    loadDataUsage: () => ReturnType<OrganizationDataUsageCoordinator["reconcile"]>;
+    loadLocalDataUsage: () => ReturnType<OrganizationDataUsageCoordinator["loadLocal"]>;
+    loadDirectoryAndGroups: () => ReturnType<OrganizationReadModelCoordinator["reconcile"]>;
+    loadDirectoryAndGroupsAfterMutation: () => ReturnType<OrganizationReadModelCoordinator["reconcileAfterMutation"]>;
+    loadLocalDirectoryAndGroups: () => ReturnType<OrganizationReadModelCoordinator["loadLocal"]>;
+    loadGroupMembers: (groupId: string) => ReturnType<InternalWorkflowRuntimeInput["apiClient"]["listOrganizationGroupMembers"]>;
+    loadGroupPresentationDetails(groupId: string): ReturnType<typeof loadOrganizationGroupPresentationDetails>;
+    loadGroupContainers: (groupId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalGroupContainers"]>;
+    loadGrants: () => ReturnType<OrganizationReadModelCoordinator["loadLocalGrants"]>;
+    listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;
+    loadPolicyHistory: () => ReturnType<OrganizationReadModelCoordinator["loadOrganizationPolicyHistory"]>;
+    loadUserDetail: (userId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalUserDetail"]>;
+    updateRosterEntry: (userId: string, profileDocumentId: string | null) => ReturnType<typeof updateOrganizationRosterEntry>;
+    updateProfile: (profileDocumentId: string | null) => ReturnType<typeof updateOrganizationProfile>;
+    removeUserFromGroup: (input: RemoveOrganizationGroupUserInput) => ReturnType<typeof removeOrganizationGroupUser>;
+    revokeGrant: (grant: OrganizationGrantRef) => Promise<Awaited<ReturnType<typeof revokeOrganizationContainerGrant>> | Awaited<ReturnType<typeof rotateOrganizationGroupForAccessSetShrink>>>;
+    startTrial: (organizationId?: string) => ReturnType<typeof startOrganizationTrial>;
+}

package/client/organizations/organizationsTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=organizationsTypes.js.map

package/client/organizations/organizationsTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type {\n  addOrganizationGroupUser,\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => ReturnType<typeof addOrganizationGroupUser>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  loadPolicyHistory: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => ReturnType<typeof removeOrganizationGroupUser>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | Awaited<ReturnType<typeof rotateOrganizationGroupForAccessSetShrink>>\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/organizations/principalMutationRecovery.d.ts

@@ -0,0 +1,16 @@
+import type { AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
+import type { InternalRuntime } from "../workflowRuntime.js";
+export interface AbandonOrganizationPolicyMutationInput {
+    readonly organizationId: string;
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly acknowledgeUnknownOutcome: true;
+}
+export interface DiscardUnreadableOrganizationPolicyMutationInput {
+    readonly organizationId: string;
+    readonly recordId: string;
+    readonly acknowledgeUnknownOutcome: true;
+}
+export declare function discardUnreadableOrganizationPolicyMutation(service: InternalRuntime, input: DiscardUnreadableOrganizationPolicyMutationInput): Promise<boolean>;
+export declare function readPendingOrganizationPolicyMutation(service: InternalRuntime, organizationId: string): Promise<AuthoredPrincipalMutation | null>;
+export declare function retryPendingOrganizationPolicyMutation(service: InternalRuntime, organizationId: string): Promise<void>;
+export declare function abandonPendingOrganizationPolicyMutation(service: InternalRuntime, input: AbandonOrganizationPolicyMutationInput): Promise<boolean>;

package/client/organizations/principalMutationRecovery.js

@@ -0,0 +1,23 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { currentOrganizationMutation } from "./principalMutationScope.js";
+async function runRecovery(service, organizationId, run) {
+    const active = currentOrganizationMutation(service, true);
+    const { runtime, stillCurrent } = active;
+    assertProjectionVerificationCurrent(() => stillCurrent() && runtime.auth.organizationId === organizationId);
+    const result = await run(runtime.apiClient);
+    assertProjectionVerificationCurrent(stillCurrent);
+    return result;
+}
+export function discardUnreadableOrganizationPolicyMutation(service, input) {
+    return runRecovery(service, input.organizationId, (api) => api.discardUnreadablePrincipalMutation(input.organizationId, input.recordId, input.acknowledgeUnknownOutcome));
+}
+export function readPendingOrganizationPolicyMutation(service, organizationId) {
+    return runRecovery(service, organizationId, (api) => api.readPendingPrincipalMutation(organizationId));
+}
+export function retryPendingOrganizationPolicyMutation(service, organizationId) {
+    return runRecovery(service, organizationId, (api) => api.recoverPendingPrincipalMutation(organizationId));
+}
+export function abandonPendingOrganizationPolicyMutation(service, input) {
+    return runRecovery(service, input.organizationId, (api) => api.abandonPendingPrincipalMutation(input.organizationId, input.mutation, input.acknowledgeUnknownOutcome));
+}
+//# sourceMappingURL=principalMutationRecovery.js.map

package/client/organizations/principalMutationRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly recordId: string;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n  service: InternalRuntime,\n  organizationId: string,\n  run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n  const active = currentOrganizationMutation(service, true);\n  const { runtime, stillCurrent } = active;\n  assertProjectionVerificationCurrent(\n    () => stillCurrent() && runtime.auth.organizationId === organizationId,\n  );\n  const result = await run(runtime.apiClient);\n  assertProjectionVerificationCurrent(stillCurrent);\n  return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.discardUnreadablePrincipalMutation(\n      input.organizationId,\n      input.recordId,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.readPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.recoverPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: AbandonOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.abandonPendingPrincipalMutation(\n      input.organizationId,\n      input.mutation,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n"]}

package/client/organizations/principalMutationScope.js

@@ -1,12 +1,17 @@
 /** Capture a mutation's identity/database lifetime without freezing live status. */
-export function currentOrganizationMutation(service) {
+export function currentOrganizationMutation(service, allowTokenRenewal = false) {
     const runtime = service.workflowInput();
     const sessionGeneration = service.sessionGeneration;
     return {
         runtime,
         stillCurrent: () => {
             const current = service.workflowInput();
-            return (service.sessionGeneration === sessionGeneration &&
+            return (
+            // Journal API custody survives token renewal, but its identity,
+            // organization and storage generation are still bound immutably.
+            (allowTokenRenewal
+                ? current.apiClient === runtime.apiClient
+                : service.sessionGeneration === sessionGeneration) &&
                 current.infra.dbStatus === "ready" &&
                 current.infra.execSql === runtime.infra.execSql &&
                 current.state.domainScope === runtime.state.domainScope &&

package/client/organizations/principalMutationScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE;IAErE,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,CACL,OAAO,CAAC,iBAAiB,KAAK,iBAAiB;gBAC/C,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n  service: Pick<InternalRuntime, \"workflowInput\" | \"sessionGeneration\">,\n) {\n  const runtime = service.workflowInput();\n  const sessionGeneration = service.sessionGeneration;\n  return {\n    runtime,\n    stillCurrent: () => {\n      const current = service.workflowInput();\n      return (\n        service.sessionGeneration === sessionGeneration &&\n        current.infra.dbStatus === \"ready\" &&\n        current.infra.execSql === runtime.infra.execSql &&\n        current.state.domainScope === runtime.state.domainScope &&\n        current.auth.isAuthenticated &&\n        current.auth.organizationId === runtime.auth.organizationId &&\n        current.auth.userId === runtime.auth.userId &&\n        current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n      );\n    },\n  };\n}\n"]}
+{"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n  service: Pick<InternalRuntime, \"workflowInput\" | \"sessionGeneration\">,\n  allowTokenRenewal = false,\n) {\n  const runtime = service.workflowInput();\n  const sessionGeneration = service.sessionGeneration;\n  return {\n    runtime,\n    stillCurrent: () => {\n      const current = service.workflowInput();\n      return (\n        // Journal API custody survives token renewal, but its identity,\n        // organization and storage generation are still bound immutably.\n        (allowTokenRenewal\n          ? current.apiClient === runtime.apiClient\n          : service.sessionGeneration === sessionGeneration) &&\n        current.infra.dbStatus === \"ready\" &&\n        current.infra.execSql === runtime.infra.execSql &&\n        current.state.domainScope === runtime.state.domainScope &&\n        current.auth.isAuthenticated &&\n        current.auth.organizationId === runtime.auth.organizationId &&\n        current.auth.userId === runtime.auth.userId &&\n        current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n      );\n    },\n  };\n}\n"]}

package/client/principalMutationApi.d.ts

@@ -0,0 +1,24 @@
+import type { ApiClient } from "../internal/api-client/index.js";
+import type { SigningKeyPair } from "../internal/crypto/index.js";
+import type { ExecSql } from "../data/sqlite/sqlSchema.js";
+import { type PrincipalMutationRecoveryApi } from "../workflows/organizations/principalMutationJournalManagement.js";
+export interface PrincipalMutationRuntimeScope {
+    readonly database: object;
+    readonly execSql: ExecSql;
+    readonly generation: number;
+    readonly identityTrustDomain: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly userId: string;
+}
+export type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;
+interface PrincipalMutationApiCustodyInput {
+    readonly api: ApiClient;
+    readonly readScope: () => PrincipalMutationRuntimeScope | null;
+    readonly principalMutationTimeoutMs?: number | undefined;
+}
+/** Keep API methods bound to their real receiver and journal only policy writes. */
+export declare function createPrincipalMutationApiCustody(input: PrincipalMutationApiCustodyInput): {
+    bind(): PrincipalMutationApi;
+};
+export {};

package/client/principalMutationApi.js

@@ -0,0 +1,108 @@
+import { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "../workflows/organizations/principalMutationJournalManagement.js";
+import { recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "../workflows/organizations/principalMutationJournalSession.js";
+import { createPrincipalMutationDispatcher } from "./principalMutationDeadline.js";
+function sameScope(current, bound) {
+    if (!current || !bound)
+        return current === bound;
+    return (current.database === bound.database &&
+        current.execSql === bound.execSql &&
+        current.generation === bound.generation &&
+        current.identityTrustDomain === bound.identityTrustDomain &&
+        current.signingFingerprint === bound.signingFingerprint &&
+        current.signingKeyPair === bound.signingKeyPair &&
+        current.userId === bound.userId);
+}
+function mutationContext(input, scope, organizationId) {
+    if (!scope)
+        throw new Error("Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage");
+    return {
+        execSql: scope.execSql,
+        signingKeyPair: scope.signingKeyPair,
+        scope: {
+            identityTrustDomain: scope.identityTrustDomain,
+            organizationId,
+            signingFingerprint: scope.signingFingerprint,
+            userId: scope.userId,
+        },
+        stillCurrent: () => sameScope(input.readScope(), scope),
+    };
+}
+/** Keep API methods bound to their real receiver and journal only policy writes. */
+export function createPrincipalMutationApiCustody(input) {
+    const dispatch = createPrincipalMutationDispatcher(input.principalMutationTimeoutMs);
+    let cached = null;
+    return {
+        bind() {
+            const scope = input.readScope();
+            if (cached && sameScope(scope, cached.scope))
+                return cached.api;
+            const context = (organizationId) => mutationContext(input, scope, organizationId);
+            const commit = async (organizationId, groupId, request, options) => submitJournaledPrincipalMutation({
+                ...context(organizationId),
+                mutation: { groupId, request },
+                submit: (mutation) => dispatch(options, (dispatchOptions) => input.api.commitOrganizationGroupPolicyResult(organizationId, mutation.groupId, mutation.request, dispatchOptions)),
+            });
+            const read = async (organizationId) => scope
+                ? readJournaledPrincipalMutation(context(organizationId))
+                : null;
+            const abandon = async (organizationId, mutation, acknowledgeUnknownOutcome) => abandonJournaledPrincipalMutation({
+                ...context(organizationId),
+                mutation,
+                acknowledgeUnknownOutcome,
+            });
+            const methods = {
+                discardUnreadablePrincipalMutation: async (organizationId, recordId, acknowledgeUnknownOutcome) => discardUnreadableJournaledPrincipalMutation({
+                    ...context(organizationId),
+                    recordId,
+                    acknowledgeUnknownOutcome,
+                }),
+                readPendingPrincipalMutation: read,
+                abandonPendingPrincipalMutation: abandon,
+                commitOrganizationGroupPolicyResult: commit,
+                commitOrganizationGroupPolicy: async (...args) => {
+                    const result = await commit(...args);
+                    return result.ok ? result.data : null;
+                },
+                recoverPendingPrincipalMutation: async (organizationId) => {
+                    await recoverJournaledPrincipalMutation({
+                        ...context(organizationId),
+                        submit: (mutation) => dispatch({ reportErrors: false }, (dispatchOptions) => input.api.commitOrganizationGroupPolicyResult(organizationId, mutation.groupId, mutation.request, dispatchOptions)),
+                    });
+                },
+            };
+            const api = bindMutationMethods(input.api, methods);
+            cached = { scope, api };
+            return api;
+        },
+    };
+}
+function bindMutationMethods(api, methods) {
+    const boundMethods = new Map();
+    const bound = new Proxy(api, {
+        get(target, property) {
+            if (Object.hasOwn(methods, property))
+                return Reflect.get(methods, property);
+            const value = Reflect.get(target, property, target);
+            if (typeof value !== "function")
+                return value;
+            const previous = boundMethods.get(property);
+            if (previous?.source === value)
+                return previous.bound;
+            const bound = value.bind(target);
+            boundMethods.set(property, { source: value, bound });
+            return bound;
+        },
+    });
+    // The checked overrides supply the signatures; verify their presence through
+    // the reflective boundary before exposing the extended API to callers.
+    if (!hasRecoveryMethods(bound))
+        throw new Error("Principal mutation recovery methods are unavailable");
+    return bound;
+}
+function hasRecoveryMethods(api) {
+    return (typeof Reflect.get(api, "readPendingPrincipalMutation") === "function" &&
+        typeof Reflect.get(api, "recoverPendingPrincipalMutation") === "function" &&
+        typeof Reflect.get(api, "abandonPendingPrincipalMutation") === "function" &&
+        typeof Reflect.get(api, "discardUnreadablePrincipalMutation") === "function");
+}
+//# sourceMappingURL=principalMutationApi.js.map

package/client/principalMutationApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationApi.js","sourceRoot":"","sources":["principalMutationApi.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAE3C,8BAA8B,GAC/B,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACL,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAYhF,SAAS,SAAS,CAChB,OAA6C,EAC7C,KAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IACjD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACjC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACzD,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACvD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAeD,SAAS,eAAe,CACtB,KAAuC,EACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE;YACL,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,cAAc;YACd,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,iCAAiC,CAChD,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,OAAO;QACL,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CACzC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,MAAM,GAAqD,KAAK,EACpE,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,gCAAgC,CAAC;gBAC/B,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;gBAC9B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CACpC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAC3C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,eAAe,CAChB,CACF;aACJ,CAAC,CAAC;YACL,MAAM,IAAI,GACR,KAAK,EAAE,cAAc,EAAE,EAAE,CACvB,KAAK;gBACH,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GACX,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EAAE,CAC5D,iCAAiC,CAAC;gBAChC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ;gBACR,yBAAyB;aAC1B,CAAC,CAAC;YACP,MAAM,OAAO,GAAG;gBACd,kCAAkC,EAAE,KAAK,EACvC,cAAc,EACd,QAAQ,EACR,yBAAyB,EACzB,EAAE,CACF,2CAA2C,CAAC;oBAC1C,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC1B,QAAQ;oBACR,yBAAyB;iBAC1B,CAAC;gBACJ,4BAA4B,EAAE,IAAI;gBAClC,+BAA+B,EAAE,OAAO;gBACxC,mCAAmC,EAAE,MAAM;gBAC3C,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;oBAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;oBACrC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,CAAC;gBACD,+BAA+B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;oBACxD,MAAM,iCAAiC,CAAC;wBACtC,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CACpD,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAC3C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,eAAe,CAChB,CACF;qBACJ,CAAC,CAAC;gBACL,CAAC;aAC0B,CAAC;YAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAc,EACd,OAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;IACH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,UAAU;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  abandonJournaledPrincipalMutation,\n  discardUnreadableJournaledPrincipalMutation,\n  type PrincipalMutationRecoveryApi,\n  readJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalManagement\";\nimport {\n  recoverJournaledPrincipalMutation,\n  submitJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalSession\";\nimport { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\n\nexport interface PrincipalMutationRuntimeScope {\n  readonly database: object;\n  readonly execSql: ExecSql;\n  readonly generation: number;\n  readonly identityTrustDomain: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}\n\nfunction sameScope(\n  current: PrincipalMutationRuntimeScope | null,\n  bound: PrincipalMutationRuntimeScope | null,\n): boolean {\n  if (!current || !bound) return current === bound;\n  return (\n    current.database === bound.database &&\n    current.execSql === bound.execSql &&\n    current.generation === bound.generation &&\n    current.identityTrustDomain === bound.identityTrustDomain &&\n    current.signingFingerprint === bound.signingFingerprint &&\n    current.signingKeyPair === bound.signingKeyPair &&\n    current.userId === bound.userId\n  );\n}\n\nexport type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;\ntype MutationOverrides = Pick<\n  ApiClient,\n  \"commitOrganizationGroupPolicy\" | \"commitOrganizationGroupPolicyResult\"\n> &\n  PrincipalMutationRecoveryApi;\n\ninterface PrincipalMutationApiCustodyInput {\n  readonly api: ApiClient;\n  readonly readScope: () => PrincipalMutationRuntimeScope | null;\n  readonly principalMutationTimeoutMs?: number | undefined;\n}\n\nfunction mutationContext(\n  input: PrincipalMutationApiCustodyInput,\n  scope: PrincipalMutationRuntimeScope | null,\n  organizationId: string,\n) {\n  if (!scope)\n    throw new Error(\n      \"Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage\",\n    );\n  return {\n    execSql: scope.execSql,\n    signingKeyPair: scope.signingKeyPair,\n    scope: {\n      identityTrustDomain: scope.identityTrustDomain,\n      organizationId,\n      signingFingerprint: scope.signingFingerprint,\n      userId: scope.userId,\n    },\n    stillCurrent: () => sameScope(input.readScope(), scope),\n  };\n}\n\n/** Keep API methods bound to their real receiver and journal only policy writes. */\nexport function createPrincipalMutationApiCustody(\n  input: PrincipalMutationApiCustodyInput,\n) {\n  const dispatch = createPrincipalMutationDispatcher(\n    input.principalMutationTimeoutMs,\n  );\n  let cached: {\n    scope: PrincipalMutationRuntimeScope | null;\n    api: PrincipalMutationApi;\n  } | null = null;\n  return {\n    bind(): PrincipalMutationApi {\n      const scope = input.readScope();\n      if (cached && sameScope(scope, cached.scope)) return cached.api;\n      const context = (organizationId: string) =>\n        mutationContext(input, scope, organizationId);\n      const commit: ApiClient[\"commitOrganizationGroupPolicyResult\"] = async (\n        organizationId,\n        groupId,\n        request,\n        options,\n      ) =>\n        submitJournaledPrincipalMutation({\n          ...context(organizationId),\n          mutation: { groupId, request },\n          submit: (mutation) =>\n            dispatch(options, (dispatchOptions) =>\n              input.api.commitOrganizationGroupPolicyResult(\n                organizationId,\n                mutation.groupId,\n                mutation.request,\n                dispatchOptions,\n              ),\n            ),\n        });\n      const read: PrincipalMutationRecoveryApi[\"readPendingPrincipalMutation\"] =\n        async (organizationId) =>\n          scope\n            ? readJournaledPrincipalMutation(context(organizationId))\n            : null;\n      const abandon: PrincipalMutationRecoveryApi[\"abandonPendingPrincipalMutation\"] =\n        async (organizationId, mutation, acknowledgeUnknownOutcome) =>\n          abandonJournaledPrincipalMutation({\n            ...context(organizationId),\n            mutation,\n            acknowledgeUnknownOutcome,\n          });\n      const methods = {\n        discardUnreadablePrincipalMutation: async (\n          organizationId,\n          recordId,\n          acknowledgeUnknownOutcome,\n        ) =>\n          discardUnreadableJournaledPrincipalMutation({\n            ...context(organizationId),\n            recordId,\n            acknowledgeUnknownOutcome,\n          }),\n        readPendingPrincipalMutation: read,\n        abandonPendingPrincipalMutation: abandon,\n        commitOrganizationGroupPolicyResult: commit,\n        commitOrganizationGroupPolicy: async (...args) => {\n          const result = await commit(...args);\n          return result.ok ? result.data : null;\n        },\n        recoverPendingPrincipalMutation: async (organizationId) => {\n          await recoverJournaledPrincipalMutation({\n            ...context(organizationId),\n            submit: (mutation) =>\n              dispatch({ reportErrors: false }, (dispatchOptions) =>\n                input.api.commitOrganizationGroupPolicyResult(\n                  organizationId,\n                  mutation.groupId,\n                  mutation.request,\n                  dispatchOptions,\n                ),\n              ),\n          });\n        },\n      } satisfies MutationOverrides;\n      const api = bindMutationMethods(input.api, methods);\n      cached = { scope, api };\n      return api;\n    },\n  };\n}\n\nfunction bindMutationMethods(\n  api: ApiClient,\n  methods: MutationOverrides,\n): PrincipalMutationApi {\n  const boundMethods = new Map<\n    PropertyKey,\n    { source: unknown; bound: unknown }\n  >();\n  const bound = new Proxy(api, {\n    get(target, property) {\n      if (Object.hasOwn(methods, property))\n        return Reflect.get(methods, property);\n      const value: unknown = Reflect.get(target, property, target);\n      if (typeof value !== \"function\") return value;\n      const previous = boundMethods.get(property);\n      if (previous?.source === value) return previous.bound;\n      const bound = value.bind(target);\n      boundMethods.set(property, { source: value, bound });\n      return bound;\n    },\n  });\n  // The checked overrides supply the signatures; verify their presence through\n  // the reflective boundary before exposing the extended API to callers.\n  if (!hasRecoveryMethods(bound))\n    throw new Error(\"Principal mutation recovery methods are unavailable\");\n  return bound;\n}\n\nfunction hasRecoveryMethods(api: ApiClient): api is PrincipalMutationApi {\n  return (\n    typeof Reflect.get(api, \"readPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"recoverPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"abandonPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"discardUnreadablePrincipalMutation\") === \"function\"\n  );\n}\n"]}

package/client/principalMutationDeadline.js

@@ -0,0 +1,23 @@
+/** One host-configurable deadline covers dispatch and all preparation exchanges. */
+export function createPrincipalMutationDispatcher(timeoutMs = 60_000) {
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > 2_147_483_647)
+        throw new RangeError("Principal mutation timeout must be a positive integer no greater than 2147483647 milliseconds");
+    return async (options, submit) => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            return await submit({
+                ...options,
+                signal: options?.signal
+                    ? AbortSignal.any([options.signal, controller.signal])
+                    : controller.signal,
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+}
+//# sourceMappingURL=principalMutationDeadline.js.map

package/client/principalMutationDeadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationDeadline.js","sourceRoot":"","sources":["principalMutationDeadline.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAAC,SAAS,GAAG,MAAM;IAClE,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;QAChC,SAAS,IAAI,CAAC;QACd,SAAS,GAAG,aAAa;QAEzB,MAAM,IAAI,UAAU,CAClB,+FAA+F,CAChG,CAAC;IACJ,OAAO,KAAK,EACV,OAAyC,EACzC,MAAqD,EACzC,EAAE;QACd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC;gBAClB,GAAG,OAAO;gBACV,MAAM,EAAE,OAAO,EAAE,MAAM;oBACrB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtD,CAAC,CAAC,UAAU,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { RequestResultOptions } from \"@tearleads/api-client\";\n\n/** One host-configurable deadline covers dispatch and all preparation exchanges. */\nexport function createPrincipalMutationDispatcher(timeoutMs = 60_000) {\n  if (\n    !Number.isSafeInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > 2_147_483_647\n  )\n    throw new RangeError(\n      \"Principal mutation timeout must be a positive integer no greater than 2147483647 milliseconds\",\n    );\n  return async <T>(\n    options: RequestResultOptions | undefined,\n    submit: (options: RequestResultOptions) => Promise<T>,\n  ): Promise<T> => {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      return await submit({\n        ...options,\n        signal: options?.signal\n          ? AbortSignal.any([options.signal, controller.signal])\n          : controller.signal,\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n  };\n}\n"]}

package/client/workflowRuntime.d.ts

@@ -12,6 +12,7 @@ import type { Events } from "./events.js";
 import type { Identity } from "./identity.js";
 import type { Network } from "./network.js";
 import { type PrincipalHistoryKeyProvider } from "./principalHistoryProtection.js";
+import { type PrincipalMutationApi } from "./principalMutationApi.js";
 import type { Session } from "./session/sessionTypes.js";
 import type { SyncBillingGate } from "./syncBillingGate.js";
 type HostWorkflowRuntimeUtilInput = Omit<WorkflowRuntimeUtilInput, "reportSecurityIncident">;
@@ -25,7 +26,7 @@ export interface Runtime {
     subscribe(listener: RuntimeListener): () => void;
 }
 export interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {
-    readonly apiClient: ApiClient;
+    readonly apiClient: PrincipalMutationApi;
     readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
     readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
 }
@@ -52,6 +53,7 @@ interface WorkflowRuntimeDependencies {
     network: Network;
     peerScope?: string | null;
     principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
+    principalMutationTimeoutMs?: number | undefined;
     reportSecurityIncident: SecurityIncidentReporter;
     session: Session;
     syncBillingGate?: SyncBillingGate | undefined;

package/client/workflowRuntime.js

@@ -3,8 +3,36 @@ import { unavailableExecSql } from "../data/sqlite/sqlSchema.js";
 import { createApiUserIdentitySource, createTrustedUserIdentityService, } from "../data/trustedUserIdentity/index.js";
 import { createListenerSet } from "./listenerSet.js";
 import { createPrincipalHistoryProtectionCustody, } from "./principalHistoryProtection.js";
+import { createPrincipalMutationApiCustody, } from "./principalMutationApi.js";
 import { adoptSessionRootContainer } from "./rootContainerAdoption.js";
 import { acknowledgedSessionRoot } from "./session/sessionRootAuthority.js";
+function createRuntimeMutationApi(dependencies, readGeneration) {
+    return createPrincipalMutationApiCustody({
+        api: dependencies.api,
+        principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,
+        readScope: () => {
+            const { signingKeyPair, signingFingerprint } = dependencies.identity;
+            const { userId, isAuthenticated } = dependencies.session;
+            const identityTrustDomain = dependencies.identityTrustDomain;
+            if (!isAuthenticated ||
+                !userId ||
+                !signingKeyPair ||
+                !signingFingerprint ||
+                !identityTrustDomain ||
+                dependencies.database.status !== "ready")
+                return null;
+            return {
+                database: dependencies.getDomainScope(),
+                execSql: dependencies.database.requireExecSql("principal mutation"),
+                generation: readGeneration(),
+                identityTrustDomain,
+                signingFingerprint,
+                signingKeyPair,
+                userId,
+            };
+        },
+    });
+}
 export function createRuntime(dependencies) {
     const trustedUserIdentityService = createTrustedUserIdentityService({
         getExecSql: () => dependencies.database.status === "ready"
@@ -50,7 +78,7 @@ export function createRuntime(dependencies) {
             };
         },
     });
-    const runtimeInput = createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, historyProtection.bind);
+    const runtimeInput = createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, historyProtection.bind, createRuntimeMutationApi(dependencies, () => runtimeSubscription.mutationGeneration).bind);
     return {
         retirePrincipalHistoryProtection: historyProtection.retire,
         get sessionGeneration() {
@@ -81,6 +109,7 @@ function createRuntimeSubscription(dependencies) {
     let version = 0;
     let sessionGeneration = 0;
     let recoveryGeneration = 0;
+    let mutationGeneration = 0;
     let sessionSnapshot = dependencies.session.snapshot;
     const notifyListeners = () => {
         version += 1;
@@ -88,6 +117,7 @@ function createRuntimeSubscription(dependencies) {
     };
     const notifyAuthority = () => {
         recoveryGeneration += 1;
+        mutationGeneration += 1;
         notifyListeners();
     };
     dependencies.database.subscribe(notifyAuthority);
@@ -100,11 +130,16 @@ function createRuntimeSubscription(dependencies) {
             sessionGeneration += 1;
             recoveryGeneration += 1;
         }
+        if (sessionScopeChanged(sessionSnapshot, next))
+            mutationGeneration += 1;
         sessionSnapshot = next;
         notifyListeners();
     });
     dependencies.syncBillingGate?.subscribe(notifyListeners);
     return {
+        get mutationGeneration() {
+            return mutationGeneration;
+        },
         get recoveryGeneration() {
             return recoveryGeneration;
         },
@@ -132,13 +167,17 @@ function sessionAuthInput({ session, identity, }) {
 }
 /** Fields whose change invalidates work keyed on the session's authority. */
 function sessionAuthorityChanged(previous, next) {
-    return (next.authToken !== previous.authToken ||
-        next.isAuthenticated !== previous.isAuthenticated ||
+    return (next.authToken !== previous.authToken || sessionScopeChanged(previous, next));
+}
+// A transport token renewal cannot turn a definite write refusal into saved work.
+// Journal custody still expires on every change to its identity or storage scope.
+function sessionScopeChanged(previous, next) {
+    return (next.isAuthenticated !== previous.isAuthenticated ||
         next.isRoot !== previous.isRoot ||
         next.organizationId !== previous.organizationId ||
         next.userId !== previous.userId);
 }
-function createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, bindHistoryProtection) {
+function createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, bindHistoryProtection, bindMutationApi) {
     let auth;
     let crypto;
     let infra;
@@ -190,7 +229,7 @@ function createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, bin
             };
         }
         return {
-            apiClient: dependencies.api,
+            apiClient: bindMutationApi(),
             auth,
             crypto,
             infra,

package/client/workflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GAGjC,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAgEzE,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,GAAG,EAAE,CACf,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;YACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;YAC/D,CAAC,CAAC,IAAI;QACV,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,oBAAoB,GAAG,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACxE,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC5D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;gBAC/D,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,CACvB,CAAC;IAEF,OAAO;QACL,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACrC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE;IAExE,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,YAAY,CAAC,GAAG;YAC3B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/domainScope\";\nimport { runWithSecurityIncidentReporting } from \"../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../data/principals/principalHistoryProtection\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { unavailableExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  type TrustedUserIdentityResolver,\n} from \"../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../workflows/container-contents/runtime\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../workflows/runtimeInput\";\nimport type { Blobs } from \"./blobs\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport type { Identity } from \"./identity\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport { acknowledgedSessionRoot } from \"./session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"./session/sessionTypes\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: () =>\n      dependencies.database.status === \"ready\"\n        ? dependencies.database.requireExecSql(\"trusted user identity\")\n        : null,\n    getLocalIdentity: () => {\n      const encapsulationKeyPair = dependencies.identity.encapsulationKeyPair;\n      const signingKeyPair = dependencies.identity.signingKeyPair;\n      if (!encapsulationKeyPair || !signingKeyPair) {\n        return null;\n      }\n      return {\n        encapsulationPublicKey: encapsulationKeyPair.publicKey,\n        signingKeyFingerprint: dependencies.identity.signingFingerprint,\n        signingPublicKey: signingKeyPair.signingPublicKey,\n      };\n    },\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n  );\n\n  return {\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken ||\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: dependencies.api,\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}
+{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GAGjC,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAiEzE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,GAAG,EAAE,CACf,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;YACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;YAC/D,CAAC,CAAC,IAAI;QACV,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,oBAAoB,GAAG,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACxE,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC5D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;gBAC/D,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/domainScope\";\nimport { runWithSecurityIncidentReporting } from \"../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../data/principals/principalHistoryProtection\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { unavailableExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  type TrustedUserIdentityResolver,\n} from \"../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../workflows/container-contents/runtime\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../workflows/runtimeInput\";\nimport type { Blobs } from \"./blobs\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport type { Identity } from \"./identity\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport { acknowledgedSessionRoot } from \"./session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"./session/sessionTypes\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: () =>\n      dependencies.database.status === \"ready\"\n        ? dependencies.database.requireExecSql(\"trusted user identity\")\n        : null,\n    getLocalIdentity: () => {\n      const encapsulationKeyPair = dependencies.identity.encapsulationKeyPair;\n      const signingKeyPair = dependencies.identity.signingKeyPair;\n      if (!encapsulationKeyPair || !signingKeyPair) {\n        return null;\n      }\n      return {\n        encapsulationPublicKey: encapsulationKeyPair.publicKey,\n        signingKeyFingerprint: dependencies.identity.signingFingerprint,\n        signingPublicKey: signingKeyPair.signingPublicKey,\n      };\n    },\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}

package/data/documents/blob/shared/types.d.ts

@@ -154,6 +154,8 @@ export interface DetachDocumentAttachmentInput {
     resolveProjectionUserKey: ProjectionUserKeyResolver;
     signedAt?: string | undefined;
     slotId: string;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
     writerProjection?: DocumentWriterProjectionResponse | undefined;
 }
 export interface DetachDocumentAttachmentResult {
@@ -169,5 +171,7 @@ export interface DecryptDocumentAttachmentBlobInput {
     execSql: ExecSql;
     resolveProjectionUserKey: ProjectionUserKeyResolver;
     targetSecretKey: Uint8Array;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
     writerProjection: DocumentWriterProjectionResponse;
 }