@tearleads/client-sdk 0.1.45 → 0.1.47

package/client/Tearleads.js

@@ -122,6 +122,9 @@ export class Tearleads {
         this.organizations = createOrganizations(runtime, this.containerContents);
         this.root = createRoot(rootRuntimeOf(runtime, this.session));
         this.userIdentities = createUserIdentities({
+            getOrganizationId: () => this.session.organizationId,
+            reportSecurityIncident: security.service.report,
+            identityLinks: runtime.identityLinks,
             log: this.log,
             resolveTrustedUserIdentity: (userId) => runtime.workflowInput().resolveTrustedUserIdentity(userId),
         });

package/client/Tearleads.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAGL,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AAExG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAEL,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAwB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAe,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EACL,6BAA6B,GAG9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAE3B,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport type { BlobStore } from \"../data/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../data/documents/documentKinds\";\nimport { createDomainScope, type DomainScope } from \"../data/domainScope\";\nimport { createVerifiedManifestCitations } from \"../data/persistence/verifiedManifestBundlePersistence\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"../data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"../data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"../workflows/registration\";\nimport { ApiVersion } from \"./apiVersion\";\nimport { type BlobStoreFactory, Blobs } from \"./blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./containerContents\";\nimport { Database, type DatabaseOptions } from \"./database\";\nimport { createDeviceFirst, type DeviceFirst } from \"./deviceFirst\";\nimport { createDocuments, type Documents } from \"./documents\";\nimport { Events } from \"./events\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./identity\";\nimport { type Logger, logErrorToConsole } from \"./logger\";\nimport { Network } from \"./network\";\nimport { createOrganizations, type Organizations } from \"./organizations\";\nimport type { PrincipalHistoryKeyProvider } from \"./principalHistoryProtection\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./root\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./securityIncidents\";\nimport { createSession } from \"./session\";\nimport type { Session } from \"./session/sessionTypes\";\nimport { SyncBillingGate } from \"./syncBillingGate\";\nimport { createUserIdentities, type UserIdentities } from \"./userIdentities\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./workflowRuntime\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}
+{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAGL,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AAExG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAEL,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAwB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAe,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EACL,6BAA6B,GAG9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAE3B,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport type { BlobStore } from \"../data/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../data/documents/documentKinds\";\nimport { createDomainScope, type DomainScope } from \"../data/domainScope\";\nimport { createVerifiedManifestCitations } from \"../data/persistence/verifiedManifestBundlePersistence\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"../data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"../data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"../workflows/registration\";\nimport { ApiVersion } from \"./apiVersion\";\nimport { type BlobStoreFactory, Blobs } from \"./blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./containerContents\";\nimport { Database, type DatabaseOptions } from \"./database\";\nimport { createDeviceFirst, type DeviceFirst } from \"./deviceFirst\";\nimport { createDocuments, type Documents } from \"./documents\";\nimport { Events } from \"./events\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./identity\";\nimport { type Logger, logErrorToConsole } from \"./logger\";\nimport { Network } from \"./network\";\nimport { createOrganizations, type Organizations } from \"./organizations\";\nimport type { PrincipalHistoryKeyProvider } from \"./principalHistoryProtection\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./root\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./securityIncidents\";\nimport { createSession } from \"./session\";\nimport type { Session } from \"./session/sessionTypes\";\nimport { SyncBillingGate } from \"./syncBillingGate\";\nimport { createUserIdentities, type UserIdentities } from \"./userIdentities\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./workflowRuntime\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.service.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}

package/client/userIdentities.d.ts

@@ -1,4 +1,5 @@
-import { type TrustedUserIdentityResolver } from "../data/trustedUserIdentity/index.js";
+import type { SecurityIncidentReporter } from "../data/securityIncidents.js";
+import { type TrustedUserIdentityResolver, type TrustedUserIdentityService } from "../data/trustedUserIdentity/index.js";
 export interface ResolvedUserIdentity {
     encapsulationKeyFingerprint: string;
     encapsulationPublicKey: string;
@@ -7,10 +8,19 @@ export interface ResolvedUserIdentity {
     userId: string;
 }
 export interface UserIdentities {
+    /** Share a stable link derived exclusively from this user's local keys. */
+    createLink(appUrl: string): Promise<string>;
+    /** Compare an independently received link before durably pinning either key. */
+    verifyLink(link: string): Promise<ResolvedUserIdentity>;
+    /** Read an existing durable pin without fetching or trusting a new identity. */
+    resolvePinned(userId: string): Promise<ResolvedUserIdentity | null>;
     /** `null` when the user is unknown or currently unresolvable; integrity failures throw. */
     resolve(userId: string): Promise<ResolvedUserIdentity | null>;
 }
 export declare function createUserIdentities(input: {
+    getOrganizationId: () => string | null;
+    reportSecurityIncident: SecurityIncidentReporter;
+    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned">;
     log: (message: string) => void;
     resolveTrustedUserIdentity: TrustedUserIdentityResolver;
 }): UserIdentities;

package/client/userIdentities.js

@@ -1,9 +1,33 @@
 import { bytesToBase64 } from "../internal/encoding/index.js";
 import { ProjectionDependencyUnavailableError } from "../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { requireTrustedUserIdentityResolver, } from "../data/trustedUserIdentity/index.js";
+import { runWithSecurityIncidentReporting } from "../data/keyingProjectionVerification/error.js";
+import { parseIdentityLink, requireTrustedUserIdentityResolver, } from "../data/trustedUserIdentity/index.js";
+function toResolvedIdentity(identity) {
+    return {
+        encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,
+        encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),
+        signingKeyFingerprint: identity.signingKeyFingerprint,
+        signingPublicKey: bytesToBase64(identity.signingPublicKey),
+        userId: identity.userId,
+    };
+}
 export function createUserIdentities(input) {
     const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity);
     return {
+        createLink: (appUrl) => input.identityLinks.createLink(appUrl),
+        async verifyLink(link) {
+            const { userId } = parseIdentityLink(link);
+            return runWithSecurityIncidentReporting(input.reportSecurityIncident, {
+                objectId: userId,
+                objectKind: "user",
+                operation: "user.identity.verify_link",
+                organizationId: input.getOrganizationId(),
+            }, async () => toResolvedIdentity(await input.identityLinks.verifyLink(link)));
+        },
+        async resolvePinned(userId) {
+            const identity = await input.identityLinks.resolvePinned(userId);
+            return identity ? toResolvedIdentity(identity) : null;
+        },
         async resolve(userId) {
             input.log(`Loading user identity for userId: ${userId}`);
             let identity;
@@ -19,13 +43,7 @@ export function createUserIdentities(input) {
             if (!identity) {
                 return null;
             }
-            return {
-                encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,
-                encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),
-                signingKeyFingerprint: identity.signingKeyFingerprint,
-                signingPublicKey: bytesToBase64(identity.signingPublicKey),
-                userId: identity.userId,
-            };
+            return toResolvedIdentity(identity);
         },
     };
 }

package/client/userIdentities.js.map

@@ -1 +1 @@
-{"version":3,"file":"userIdentities.js","sourceRoot":"","sources":["userIdentities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4DAA4D,CAAC;AAClH,OAAO,EACL,kCAAkC,GAEnC,MAAM,6BAA6B,CAAC;AAerC,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,GAAG,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,QAA0D,CAAC;YAC/D,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,KAAK,CAAC,GAAG,CACP,qBAAqB,MAAM,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAC/D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;gBACjE,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACtE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;gBACrD,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport { ProjectionDependencyUnavailableError } from \"../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../data/trustedUserIdentity\";\n\nexport interface ResolvedUserIdentity {\n  encapsulationKeyFingerprint: string;\n  encapsulationPublicKey: string;\n  signingKeyFingerprint: string;\n  signingPublicKey: string;\n  userId: string;\n}\n\nexport interface UserIdentities {\n  /** `null` when the user is unknown or currently unresolvable; integrity failures throw. */\n  resolve(userId: string): Promise<ResolvedUserIdentity | null>;\n}\n\nexport function createUserIdentities(input: {\n  log: (message: string) => void;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): UserIdentities {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  return {\n    async resolve(userId) {\n      input.log(`Loading user identity for userId: ${userId}`);\n      let identity: Awaited<ReturnType<TrustedUserIdentityResolver>>;\n      try {\n        identity = await resolveTrustedUserIdentity(userId);\n      } catch (error) {\n        if (!(error instanceof ProjectionDependencyUnavailableError))\n          throw error;\n        input.log(\n          `User identity for ${userId} is unavailable: ${error.message}`,\n        );\n        return null;\n      }\n      if (!identity) {\n        return null;\n      }\n\n      return {\n        encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),\n        signingKeyFingerprint: identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(identity.signingPublicKey),\n        userId: identity.userId,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"userIdentities.js","sourceRoot":"","sources":["userIdentities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4DAA4D,CAAC;AAClH,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAE9F,OAAO,EACL,iBAAiB,EACjB,kCAAkC,GAInC,MAAM,6BAA6B,CAAC;AAqBrC,SAAS,kBAAkB,CACzB,QAA6B;IAE7B,OAAO;QACL,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACtE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KASpC;IACC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,OAAO;QACL,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;QAC9D,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,gCAAgC,CACrC,KAAK,CAAC,sBAAsB,EAC5B;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,2BAA2B;gBACtC,cAAc,EAAE,KAAK,CAAC,iBAAiB,EAAE;aAC1C,EACD,KAAK,IAAI,EAAE,CACT,kBAAkB,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,GAAG,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,QAA0D,CAAC;YAC/D,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,KAAK,CAAC,GAAG,CACP,qBAAqB,MAAM,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAC/D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport { ProjectionDependencyUnavailableError } from \"../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../data/keyingProjectionVerification/error\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport {\n  parseIdentityLink,\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../data/trustedUserIdentity\";\n\nexport interface ResolvedUserIdentity {\n  encapsulationKeyFingerprint: string;\n  encapsulationPublicKey: string;\n  signingKeyFingerprint: string;\n  signingPublicKey: string;\n  userId: string;\n}\n\nexport interface UserIdentities {\n  /** Share a stable link derived exclusively from this user's local keys. */\n  createLink(appUrl: string): Promise<string>;\n  /** Compare an independently received link before durably pinning either key. */\n  verifyLink(link: string): Promise<ResolvedUserIdentity>;\n  /** Read an existing durable pin without fetching or trusting a new identity. */\n  resolvePinned(userId: string): Promise<ResolvedUserIdentity | null>;\n  /** `null` when the user is unknown or currently unresolvable; integrity failures throw. */\n  resolve(userId: string): Promise<ResolvedUserIdentity | null>;\n}\n\nfunction toResolvedIdentity(\n  identity: TrustedUserIdentity,\n): ResolvedUserIdentity {\n  return {\n    encapsulationKeyFingerprint: identity.encapsulationKeyFingerprint,\n    encapsulationPublicKey: bytesToBase64(identity.encapsulationPublicKey),\n    signingKeyFingerprint: identity.signingKeyFingerprint,\n    signingPublicKey: bytesToBase64(identity.signingPublicKey),\n    userId: identity.userId,\n  };\n}\n\nexport function createUserIdentities(input: {\n  getOrganizationId: () => string | null;\n  reportSecurityIncident: SecurityIncidentReporter;\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  log: (message: string) => void;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): UserIdentities {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  return {\n    createLink: (appUrl) => input.identityLinks.createLink(appUrl),\n    async verifyLink(link) {\n      const { userId } = parseIdentityLink(link);\n      return runWithSecurityIncidentReporting(\n        input.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.verify_link\",\n          organizationId: input.getOrganizationId(),\n        },\n        async () =>\n          toResolvedIdentity(await input.identityLinks.verifyLink(link)),\n      );\n    },\n    async resolvePinned(userId) {\n      const identity = await input.identityLinks.resolvePinned(userId);\n      return identity ? toResolvedIdentity(identity) : null;\n    },\n    async resolve(userId) {\n      input.log(`Loading user identity for userId: ${userId}`);\n      let identity: Awaited<ReturnType<TrustedUserIdentityResolver>>;\n      try {\n        identity = await resolveTrustedUserIdentity(userId);\n      } catch (error) {\n        if (!(error instanceof ProjectionDependencyUnavailableError))\n          throw error;\n        input.log(\n          `User identity for ${userId} is unavailable: ${error.message}`,\n        );\n        return null;\n      }\n      if (!identity) {\n        return null;\n      }\n\n      return toResolvedIdentity(identity);\n    },\n  };\n}\n"]}

package/client/workflowRuntime.d.ts

@@ -3,7 +3,7 @@ import type { DocumentProjectorRegistry } from "../data/documents/documentKinds.
 import type { DomainScope } from "../data/domainScope.js";
 import type { PrincipalHistoryProtectionLease } from "../data/principals/principalHistoryProtection.js";
 import type { SecurityIncidentReporter } from "../data/securityIncidents.js";
-import { type LocalUserIdentityCandidate, type TrustedUserIdentityResolver } from "../data/trustedUserIdentity/index.js";
+import { type LocalUserIdentityCandidate, type TrustedUserIdentityResolver, type TrustedUserIdentityService } from "../data/trustedUserIdentity/index.js";
 import type { ContainerContentsRootAdopter } from "../workflows/container-contents/runtime.js";
 import { type ProvisionedPrincipalHistoryPrimer } from "../workflows/registration/provisionedPrincipalHistory.js";
 import type { WorkflowRuntimeGroups, WorkflowRuntimeUtilInput } from "../workflows/runtimeInput.js";
@@ -32,6 +32,7 @@ export interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {
     readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
 }
 export interface InternalRuntime {
+    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned">;
     retirePrincipalHistoryProtection(): void;
     readonly sessionGeneration: number;
     readonly adoptRootContainer: ContainerContentsRootAdopter;

package/client/workflowRuntime.js

@@ -97,6 +97,7 @@ export function createRuntime(dependencies) {
     });
     const runtimeInput = createRuntimeInputFactory(dependencies, resolveTrustedUserIdentity, historyProtection.bind, createRuntimeMutationApi(dependencies, () => runtimeSubscription.mutationGeneration).bind);
     return {
+        identityLinks: trustedUserIdentityService,
         retirePrincipalHistoryProtection: historyProtection.retire,
         get sessionGeneration() {
             return runtimeSubscription.sessionGeneration;

package/client/workflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,EAAgB,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,uCAAuC,GAExC,MAAM,uDAAuD,CAAC;AAa/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAkEzE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/domainScope\";\nimport { runWithSecurityIncidentReporting } from \"../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../data/principals/principalHistoryProtection\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n} from \"../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../workflows/container-contents/runtime\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../workflows/runtimeInput\";\nimport type { Blobs } from \"./blobs\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport type { Identity } from \"./identity\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport { acknowledgedSessionRoot } from \"./session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"./session/sessionTypes\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}
+{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,EAAgB,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,uCAAuC,GAExC,MAAM,uDAAuD,CAAC;AAa/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAsEzE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/domainScope\";\nimport { runWithSecurityIncidentReporting } from \"../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../data/principals/principalHistoryProtection\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../workflows/container-contents/runtime\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../workflows/runtimeInput\";\nimport type { Blobs } from \"./blobs\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport type { Identity } from \"./identity\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport { acknowledgedSessionRoot } from \"./session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"./session/sessionTypes\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}

package/data/trustedUserIdentity/identityLink.d.ts

@@ -0,0 +1,12 @@
+import { type ValidatedUserIdentityCandidate } from "./types.js";
+interface IdentityLinkExpectation {
+    readonly identityTrustDomain: string;
+    readonly userId: string;
+    readonly fingerprint: string;
+}
+export declare function parseIdentityLink(value: string): IdentityLinkExpectation;
+/** Versioned, domain-separated tuple: exact keys, algorithms and account scope. */
+export declare function identityLinkFingerprint(identity: ValidatedUserIdentityCandidate): Promise<string>;
+export declare function createIdentityLink(identity: ValidatedUserIdentityCandidate, appUrl: string): Promise<string>;
+export declare function assertIdentityLinkMatches(expectation: IdentityLinkExpectation, identity: ValidatedUserIdentityCandidate): Promise<void>;
+export {};

package/data/trustedUserIdentity/identityLink.js

@@ -0,0 +1,117 @@
+import { toFingerprint } from "../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { resolveIdentityTrustDomain } from "./trustDomain.js";
+import { TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "./types.js";
+import { assertTrustedUserIdentityUserId } from "./validation.js";
+const LINK_PATH = "/app/contacts/import/";
+/** A supplied link alone cannot establish evidence of server tampering. */
+class IdentityLinkMismatchError extends Error {
+    constructor() {
+        super("The identity keys do not match this link. Ask the person to confirm their identity link through your trusted channel.");
+        this.name = "IdentityLinkMismatchError";
+    }
+}
+function invalidLink() {
+    throw new Error("Enter a complete Tearleads identity link.");
+}
+function httpUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return invalidLink();
+    }
+    if (!["https:", "http:"].includes(url.protocol) ||
+        url.username ||
+        url.password)
+        return invalidLink();
+    return url;
+}
+function encodeExpectation(expectation) {
+    return bytesToBase64(new TextEncoder().encode(JSON.stringify([
+        1,
+        expectation.identityTrustDomain,
+        expectation.userId,
+        expectation.fingerprint,
+    ])))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/u, "");
+}
+export function parseIdentityLink(value) {
+    if (value.length > 4096)
+        return invalidLink();
+    const url = httpUrl(value.trim());
+    if (url.search || url.hash || !url.pathname.startsWith(LINK_PATH)) {
+        return invalidLink();
+    }
+    const token = url.pathname.slice(LINK_PATH.length);
+    if (!/^[A-Za-z0-9_-]+$/u.test(token))
+        return invalidLink();
+    let payload;
+    try {
+        const base64 = token.replaceAll("-", "+").replaceAll("_", "/");
+        payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(base64ToBytes(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="))));
+    }
+    catch {
+        return invalidLink();
+    }
+    if (!Array.isArray(payload) ||
+        payload.length !== 4 ||
+        payload[0] !== 1 ||
+        typeof payload[1] !== "string" ||
+        typeof payload[2] !== "string" ||
+        typeof payload[3] !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(payload[3]))
+        return invalidLink();
+    const expectation = {
+        identityTrustDomain: payload[1],
+        userId: payload[2],
+        fingerprint: payload[3],
+    };
+    try {
+        assertTrustedUserIdentityUserId(expectation.userId);
+        if (resolveIdentityTrustDomain({
+            apiBaseUrl: expectation.identityTrustDomain,
+        }) !== expectation.identityTrustDomain)
+            return invalidLink();
+    }
+    catch {
+        return invalidLink();
+    }
+    if (encodeExpectation(expectation) !== token)
+        return invalidLink();
+    return expectation;
+}
+/** Versioned, domain-separated tuple: exact keys, algorithms and account scope. */
+export function identityLinkFingerprint(identity) {
+    return toFingerprint(new TextEncoder().encode(JSON.stringify([
+        "tearleads.identity-link.v1",
+        identity.identityTrustDomain,
+        identity.userId,
+        TRUSTED_USER_IDENTITY_SIGNING_SUITE,
+        bytesToBase64(identity.signingPublicKey),
+        TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,
+        bytesToBase64(identity.encapsulationPublicKey),
+    ])));
+}
+export async function createIdentityLink(identity, appUrl) {
+    const url = httpUrl(appUrl);
+    url.pathname =
+        LINK_PATH +
+            encodeExpectation({
+                identityTrustDomain: identity.identityTrustDomain,
+                userId: identity.userId,
+                fingerprint: await identityLinkFingerprint(identity),
+            });
+    url.search = "";
+    url.hash = "";
+    return url.href;
+}
+export async function assertIdentityLinkMatches(expectation, identity) {
+    if ((await identityLinkFingerprint(identity)) !== expectation.fingerprint) {
+        throw new IdentityLinkMismatchError();
+    }
+}
+//# sourceMappingURL=identityLink.js.map

package/data/trustedUserIdentity/identityLink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityLink.js","sourceRoot":"","sources":["identityLink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,yCAAyC,EACzC,mCAAmC,GAEpC,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,2EAA2E;AAC3E,MAAM,yBAA0B,SAAQ,KAAK;IAC3C;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAQD,SAAS,WAAW;IAClB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QAEZ,OAAO,WAAW,EAAE,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoC;IAC7D,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,CAAC;QACD,WAAW,CAAC,mBAAmB;QAC/B,WAAW,CAAC,MAAM;QAClB,WAAW,CAAC,WAAW;KACxB,CAAC,CACH,CACF;SACE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,WAAW,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,EAAE,CAAC;IAC3D,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAC9C,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CACpE,CACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAChB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC9B,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAEnC,OAAO,WAAW,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG;QAClB,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,IAAI,CAAC;QACH,+BAA+B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,IACE,0BAA0B,CAAC;YACzB,UAAU,EAAE,WAAW,CAAC,mBAAmB;SAC5C,CAAC,KAAK,WAAW,CAAC,mBAAmB;YAEtC,OAAO,WAAW,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,iBAAiB,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,OAAO,WAAW,EAAE,CAAC;IACnE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CACrC,QAAwC;IAExC,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,4BAA4B;QAC5B,QAAQ,CAAC,mBAAmB;QAC5B,QAAQ,CAAC,MAAM;QACf,mCAAmC;QACnC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxC,yCAAyC;QACzC,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC/C,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAwC,EACxC,MAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,GAAG,CAAC,QAAQ;QACV,SAAS;YACT,iBAAiB,CAAC;gBAChB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,MAAM,uBAAuB,CAAC,QAAQ,CAAC;aACrD,CAAC,CAAC;IACL,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAoC,EACpC,QAAwC;IAExC,IAAI,CAAC,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;AACH,CAAC","sourcesContent":["import { toFingerprint } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { resolveIdentityTrustDomain } from \"./trustDomain\";\nimport {\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n  type ValidatedUserIdentityCandidate,\n} from \"./types\";\nimport { assertTrustedUserIdentityUserId } from \"./validation\";\n\nconst LINK_PATH = \"/app/contacts/import/\";\n\n/** A supplied link alone cannot establish evidence of server tampering. */\nclass IdentityLinkMismatchError extends Error {\n  constructor() {\n    super(\n      \"The identity keys do not match this link. Ask the person to confirm their identity link through your trusted channel.\",\n    );\n    this.name = \"IdentityLinkMismatchError\";\n  }\n}\n\ninterface IdentityLinkExpectation {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly fingerprint: string;\n}\n\nfunction invalidLink(): never {\n  throw new Error(\"Enter a complete Tearleads identity link.\");\n}\n\nfunction httpUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return invalidLink();\n  }\n  if (\n    ![\"https:\", \"http:\"].includes(url.protocol) ||\n    url.username ||\n    url.password\n  )\n    return invalidLink();\n  return url;\n}\n\nfunction encodeExpectation(expectation: IdentityLinkExpectation): string {\n  return bytesToBase64(\n    new TextEncoder().encode(\n      JSON.stringify([\n        1,\n        expectation.identityTrustDomain,\n        expectation.userId,\n        expectation.fingerprint,\n      ]),\n    ),\n  )\n    .replaceAll(\"+\", \"-\")\n    .replaceAll(\"/\", \"_\")\n    .replace(/=+$/u, \"\");\n}\n\nexport function parseIdentityLink(value: string): IdentityLinkExpectation {\n  if (value.length > 4096) return invalidLink();\n  const url = httpUrl(value.trim());\n  if (url.search || url.hash || !url.pathname.startsWith(LINK_PATH)) {\n    return invalidLink();\n  }\n  const token = url.pathname.slice(LINK_PATH.length);\n  if (!/^[A-Za-z0-9_-]+$/u.test(token)) return invalidLink();\n  let payload: unknown;\n  try {\n    const base64 = token.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n    payload = JSON.parse(\n      new TextDecoder(\"utf-8\", { fatal: true }).decode(\n        base64ToBytes(base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\")),\n      ),\n    );\n  } catch {\n    return invalidLink();\n  }\n  if (\n    !Array.isArray(payload) ||\n    payload.length !== 4 ||\n    payload[0] !== 1 ||\n    typeof payload[1] !== \"string\" ||\n    typeof payload[2] !== \"string\" ||\n    typeof payload[3] !== \"string\" ||\n    !/^[a-f0-9]{64}$/u.test(payload[3])\n  )\n    return invalidLink();\n  const expectation = {\n    identityTrustDomain: payload[1],\n    userId: payload[2],\n    fingerprint: payload[3],\n  };\n  try {\n    assertTrustedUserIdentityUserId(expectation.userId);\n    if (\n      resolveIdentityTrustDomain({\n        apiBaseUrl: expectation.identityTrustDomain,\n      }) !== expectation.identityTrustDomain\n    )\n      return invalidLink();\n  } catch {\n    return invalidLink();\n  }\n  if (encodeExpectation(expectation) !== token) return invalidLink();\n  return expectation;\n}\n\n/** Versioned, domain-separated tuple: exact keys, algorithms and account scope. */\nexport function identityLinkFingerprint(\n  identity: ValidatedUserIdentityCandidate,\n): Promise<string> {\n  return toFingerprint(\n    new TextEncoder().encode(\n      JSON.stringify([\n        \"tearleads.identity-link.v1\",\n        identity.identityTrustDomain,\n        identity.userId,\n        TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n        bytesToBase64(identity.signingPublicKey),\n        TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n        bytesToBase64(identity.encapsulationPublicKey),\n      ]),\n    ),\n  );\n}\n\nexport async function createIdentityLink(\n  identity: ValidatedUserIdentityCandidate,\n  appUrl: string,\n): Promise<string> {\n  const url = httpUrl(appUrl);\n  url.pathname =\n    LINK_PATH +\n    encodeExpectation({\n      identityTrustDomain: identity.identityTrustDomain,\n      userId: identity.userId,\n      fingerprint: await identityLinkFingerprint(identity),\n    });\n  url.search = \"\";\n  url.hash = \"\";\n  return url.href;\n}\n\nexport async function assertIdentityLinkMatches(\n  expectation: IdentityLinkExpectation,\n  identity: ValidatedUserIdentityCandidate,\n): Promise<void> {\n  if ((await identityLinkFingerprint(identity)) !== expectation.fingerprint) {\n    throw new IdentityLinkMismatchError();\n  }\n}\n"]}

package/data/trustedUserIdentity/index.d.ts

@@ -1,6 +1,7 @@
 export { createApiUserIdentitySource } from "./apiAdapter.js";
+export { parseIdentityLink } from "./identityLink.js";
 export { requireTrustedUserIdentityResolver } from "./requiredResolver.js";
 export { createTrustedUserIdentityService, loadPinnedUserIdentity, } from "./service.js";
 export { resolveIdentityTrustDomain } from "./trustDomain.js";
-export type { LocalUserIdentityCandidate, TrustedUserIdentity, TrustedUserIdentityResolver, } from "./types.js";
+export type { LocalUserIdentityCandidate, TrustedUserIdentity, TrustedUserIdentityResolver, TrustedUserIdentityService, } from "./types.js";
 export { validateUserIdentityKeys } from "./validation.js";

package/data/trustedUserIdentity/index.js

@@ -1,4 +1,5 @@
 export { createApiUserIdentitySource } from "./apiAdapter.js";
+export { parseIdentityLink } from "./identityLink.js";
 export { requireTrustedUserIdentityResolver } from "./requiredResolver.js";
 export { createTrustedUserIdentityService, loadPinnedUserIdentity, } from "./service.js";
 export { resolveIdentityTrustDomain } from "./trustDomain.js";

package/data/trustedUserIdentity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAM3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export { createApiUserIdentitySource } from \"./apiAdapter\";\nexport { requireTrustedUserIdentityResolver } from \"./requiredResolver\";\nexport {\n  createTrustedUserIdentityService,\n  loadPinnedUserIdentity,\n} from \"./service\";\nexport { resolveIdentityTrustDomain } from \"./trustDomain\";\nexport type {\n  LocalUserIdentityCandidate,\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"./types\";\nexport { validateUserIdentityKeys } from \"./validation\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAO3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export { createApiUserIdentitySource } from \"./apiAdapter\";\nexport { parseIdentityLink } from \"./identityLink\";\nexport { requireTrustedUserIdentityResolver } from \"./requiredResolver\";\nexport {\n  createTrustedUserIdentityService,\n  loadPinnedUserIdentity,\n} from \"./service\";\nexport { resolveIdentityTrustDomain } from \"./trustDomain\";\nexport type {\n  LocalUserIdentityCandidate,\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n  TrustedUserIdentityService,\n} from \"./types\";\nexport { validateUserIdentityKeys } from \"./validation\";\n"]}

package/data/trustedUserIdentity/service.js

@@ -3,13 +3,18 @@ import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
 import { compareOrInsertTrustedUserIdentityPin, loadTrustedUserIdentityPin, loadTrustedUserIdForSigningKey, TrustedUserIdentityPinCorruptError, TrustedUserIdentityPinMismatchError, } from "../persistence/trustedUserIdentityPinPersistence.js";
 import { TrustedUserIdentityPinContentionError } from "../persistence/trustedUserIdentityPinTransaction.js";
 import { DatabaseUnavailableError } from "../sync/databaseUnavailable.js";
+import { assertIdentityLinkMatches, createIdentityLink, parseIdentityLink, } from "./identityLink.js";
 import { brandTrustedUserIdentity, TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_FORMAT_VERSION, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "./types.js";
 import { assertTrustedUserIdentityUserId, validateLocalUserIdentity, validateRemoteUserIdentity, validateUserIdentityKeys, } from "./validation.js";
-function requireTrustStore(dependencies) {
+function requireTrustDomain(dependencies) {
     // A missing trust domain is a static misconfiguration and must stay loud.
     if (!dependencies.identityTrustDomain) {
         throw new KeyingVerificationError("missing_dependency", "Trusted user identity resolution requires a stable API trust domain");
     }
+    return dependencies.identityTrustDomain;
+}
+function requireTrustStore(dependencies) {
+    const identityTrustDomain = requireTrustDomain(dependencies);
     // An absent trust store is not: getExecSql() returns null exactly while the
     // database is not ready, which happens routinely when the runtime is swapped
     // under in-flight sync work. Callers that tolerate a vanishing database
@@ -18,7 +23,7 @@ function requireTrustStore(dependencies) {
     if (!execSql) {
         throw new DatabaseUnavailableError("Trusted user identity resolution requires a ready SQLite trust store");
     }
-    return { execSql, identityTrustDomain: dependencies.identityTrustDomain };
+    return { execSql, identityTrustDomain };
 }
 async function compareWithDurablePin(input) {
     try {
@@ -111,6 +116,47 @@ export async function loadPinnedUserIdentity(input) {
 }
 export function createTrustedUserIdentityService(dependencies) {
     return {
+        async resolvePinned(userId) {
+            const { execSql, identityTrustDomain } = requireTrustStore(dependencies);
+            return loadPinnedUserIdentity({ execSql, identityTrustDomain, userId });
+        },
+        async createLink(appUrl) {
+            const identityTrustDomain = requireTrustDomain(dependencies);
+            const userId = dependencies.getLocalUserId();
+            const candidate = userId ? dependencies.getLocalIdentity(userId) : null;
+            if (!userId || !candidate) {
+                throw new Error("Sign in before sharing your identity link.");
+            }
+            const identity = await validateLocalUserIdentity({
+                candidate,
+                identityTrustDomain,
+                userId,
+            });
+            return createIdentityLink(identity, appUrl);
+        },
+        async verifyLink(link) {
+            const expectation = parseIdentityLink(link);
+            const { execSql, identityTrustDomain } = requireTrustStore(dependencies);
+            if (expectation.identityTrustDomain !== identityTrustDomain) {
+                throw new Error("This identity link belongs to a different Tearleads service.");
+            }
+            const localUserId = dependencies.getLocalUserId();
+            try {
+                const identity = await resolveCandidate(dependencies, expectation.userId, identityTrustDomain);
+                if (!identity)
+                    throw new Error("The identity in this link is unavailable.");
+                await assertIdentityLinkMatches(expectation, identity);
+                if (dependencies.getExecSql() !== execSql ||
+                    dependencies.getLocalUserId() !== localUserId) {
+                    throw new DatabaseUnavailableError("The active identity changed. Open the identity link again.");
+                }
+                return await pinIdentity({ dependencies, execSql, identity });
+            }
+            catch (error) {
+                dependencies.remoteSource.invalidate(expectation.userId);
+                throw error;
+            }
+        },
         async boundUserId(signingKeyFingerprint) {
             const { execSql, identityTrustDomain } = requireTrustStore(dependencies);
             return loadTrustedUserIdForSigningKey({

package/data/trustedUserIdentity/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAEzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GAKpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,SAAS,iBAAiB,CACxB,YAAoD;IAOpD,0EAA0E;IAC1E,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,CAAC,mBAAmB,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAMpC;IACC,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE;gBACH,2BAA2B,EAAE,KAAK,CAAC,QAAQ,CAAC,2BAA2B;gBACvE,sBAAsB,EAAE,aAAa,CACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC;gBACD,kBAAkB,EAAE,yCAAyC;gBAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,oCAAoC;gBACnD,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;gBACvD,qBAAqB,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAC3D,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAChE,YAAY,EAAE,mCAAmC;gBACjD,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM;gBAC9C,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,CAAC,MAAM,wBAAwB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzF,CAAC,CAAC,qCAAqC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4CAA4C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,qCAAqC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,YAAoD,EACpD,MAAc,EACd,mBAA2B;IAE3B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,aAAa;YACxB,mBAAmB;YACnB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,cAAc;QACnB,CAAC,CAAC,0BAA0B,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,mBAAmB;YACnB,eAAe,EAAE,MAAM;SACxB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACC,MAAM,qBAAqB,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,SAAS,EAAE;YACT,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACjE,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACtD;QACD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;KAC7D,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,GAAG,IAAI;QACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,YAAoD;IAEpD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACrC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,8BAA8B,CAAC;gBACpC,OAAO;gBACP,mBAAmB;gBACnB,qBAAqB;aACtB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAC9B,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,SAAS;gBACT,mBAAmB;gBACnB,MAAM;aACP,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,YAAY,EACZ,MAAM,EACN,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  compareOrInsertTrustedUserIdentityPin,\n  loadTrustedUserIdentityPin,\n  loadTrustedUserIdForSigningKey,\n  TrustedUserIdentityPinCorruptError,\n  TrustedUserIdentityPinMismatchError,\n} from \"../persistence/trustedUserIdentityPinPersistence\";\nimport { TrustedUserIdentityPinContentionError } from \"../persistence/trustedUserIdentityPinTransaction\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { DatabaseUnavailableError } from \"../sync/databaseUnavailable\";\nimport {\n  brandTrustedUserIdentity,\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n  type TrustedUserIdentity,\n  type TrustedUserIdentityService,\n  type TrustedUserIdentityServiceDependencies,\n  type ValidatedUserIdentityCandidate,\n} from \"./types\";\nimport {\n  assertTrustedUserIdentityUserId,\n  validateLocalUserIdentity,\n  validateRemoteUserIdentity,\n  validateUserIdentityKeys,\n} from \"./validation\";\n\nfunction requireTrustStore(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identityTrustDomain: string;\n} {\n  // A missing trust domain is a static misconfiguration and must stay loud.\n  if (!dependencies.identityTrustDomain) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Trusted user identity resolution requires a stable API trust domain\",\n    );\n  }\n  // An absent trust store is not: getExecSql() returns null exactly while the\n  // database is not ready, which happens routinely when the runtime is swapped\n  // under in-flight sync work. Callers that tolerate a vanishing database\n  // discriminate on the error type, so this must not share the code above.\n  const execSql = dependencies.getExecSql();\n  if (!execSql) {\n    throw new DatabaseUnavailableError(\n      \"Trusted user identity resolution requires a ready SQLite trust store\",\n    );\n  }\n  return { execSql, identityTrustDomain: dependencies.identityTrustDomain };\n}\n\nasync function compareWithDurablePin(input: {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly firstSeenAt: string;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<void> {\n  try {\n    await compareOrInsertTrustedUserIdentityPin({\n      execSql: input.execSql,\n      pin: {\n        encapsulationKeyFingerprint: input.identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(\n          input.identity.encapsulationPublicKey,\n        ),\n        encapsulationSuite: TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n        firstSeenAt: input.firstSeenAt,\n        formatVersion: TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n        identityTrustDomain: input.identity.identityTrustDomain,\n        signingKeyFingerprint: input.identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(input.identity.signingPublicKey),\n        signingSuite: TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n        userId: input.identity.userId,\n      },\n    });\n  } catch (error) {\n    if (error instanceof TrustedUserIdentityPinMismatchError) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        error.existing.userId !== error.candidate.userId\n          ? `Signing key for ${input.identity.userId} is already bound to ${error.existing.userId}`\n          : `Trusted user identity changed for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinCorruptError) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `Trusted user identity pin is corrupt for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinContentionError) {\n      // Lock contention says nothing about the identity; the caller retries\n      // once the trust store is free, so this must not be recordable evidence.\n      throw new DatabaseUnavailableError(\n        `Trusted user identity pin store is busy for ${input.identity.userId}`,\n      );\n    }\n    throw error;\n  }\n}\n\nasync function resolveCandidate(\n  dependencies: TrustedUserIdentityServiceDependencies,\n  userId: string,\n  identityTrustDomain: string,\n): Promise<ValidatedUserIdentityCandidate | null> {\n  const localUserId = dependencies.getLocalUserId();\n  if (userId === localUserId) {\n    const localIdentity = dependencies.getLocalIdentity(userId);\n    if (!localIdentity) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Authoritative local identity keys are unavailable\",\n      );\n    }\n    return validateLocalUserIdentity({\n      candidate: localIdentity,\n      identityTrustDomain,\n      userId,\n    });\n  }\n\n  const remoteIdentity = await dependencies.remoteSource.load(userId);\n  return remoteIdentity\n    ? validateRemoteUserIdentity({\n        candidate: remoteIdentity,\n        identityTrustDomain,\n        requestedUserId: userId,\n      })\n    : null;\n}\n\nasync function pinIdentity(input: {\n  readonly dependencies: TrustedUserIdentityServiceDependencies;\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<TrustedUserIdentity> {\n  await compareWithDurablePin({\n    execSql: input.execSql,\n    firstSeenAt: (input.dependencies.now?.() ?? new Date()).toISOString(),\n    identity: input.identity,\n  });\n  return brandTrustedUserIdentity(input.identity);\n}\n\n/**\n * Read-only: the identity this trust store already pins for `userId`, or null.\n * The stored keys must still match their stored fingerprints. Never inserts,\n * compares against or replaces a pin.\n */\nexport async function loadPinnedUserIdentity(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentity | null> {\n  assertTrustedUserIdentityUserId(input.userId);\n  const pin = await loadTrustedUserIdentityPin(input);\n  if (!pin) return null;\n  const keys = await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: base64ToBytes(pin.encapsulationPublicKey),\n      signingKeyFingerprint: pin.signingKeyFingerprint,\n      signingPublicKey: base64ToBytes(pin.signingPublicKey),\n    },\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n  });\n  return brandTrustedUserIdentity({\n    ...keys,\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  });\n}\n\nexport function createTrustedUserIdentityService(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): TrustedUserIdentityService {\n  return {\n    async boundUserId(signingKeyFingerprint) {\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      return loadTrustedUserIdForSigningKey({\n        execSql,\n        identityTrustDomain,\n        signingKeyFingerprint,\n      });\n    },\n    async pinLocal(userId, candidate) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      const identity = await validateLocalUserIdentity({\n        candidate,\n        identityTrustDomain,\n        userId,\n      });\n      return pinIdentity({ dependencies, execSql, identity });\n    },\n    async resolve(userId) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      try {\n        const identity = await resolveCandidate(\n          dependencies,\n          userId,\n          identityTrustDomain,\n        );\n        if (!identity) {\n          return null;\n        }\n        return await pinIdentity({ dependencies, execSql, identity });\n      } catch (error) {\n        dependencies.remoteSource.invalidate(userId);\n        throw error;\n      }\n    },\n  };\n}\n"]}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAEzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GAKpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,SAAS,kBAAkB,CACzB,YAAoD;IAEpD,0EAA0E;IAC1E,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,mBAAmB,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAoD;IAEpD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAMpC;IACC,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE;gBACH,2BAA2B,EAAE,KAAK,CAAC,QAAQ,CAAC,2BAA2B;gBACvE,sBAAsB,EAAE,aAAa,CACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC;gBACD,kBAAkB,EAAE,yCAAyC;gBAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,oCAAoC;gBACnD,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;gBACvD,qBAAqB,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAC3D,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAChE,YAAY,EAAE,mCAAmC;gBACjD,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM;gBAC9C,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,CAAC,MAAM,wBAAwB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzF,CAAC,CAAC,qCAAqC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4CAA4C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,qCAAqC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,YAAoD,EACpD,MAAc,EACd,mBAA2B;IAE3B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,aAAa;YACxB,mBAAmB;YACnB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,cAAc;QACnB,CAAC,CAAC,0BAA0B,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,mBAAmB;YACnB,eAAe,EAAE,MAAM;SACxB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACC,MAAM,qBAAqB,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,SAAS,EAAE;YACT,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACjE,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACtD;QACD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;KAC7D,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,GAAG,IAAI;QACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,YAAoD;IAEpD,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,SAAS;gBACT,mBAAmB;gBACnB,MAAM;aACP,CAAC,CAAC;YACH,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,IAAI,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,YAAY,EACZ,WAAW,CAAC,MAAM,EAClB,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ;oBACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,MAAM,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACvD,IACE,YAAY,CAAC,UAAU,EAAE,KAAK,OAAO;oBACrC,YAAY,CAAC,cAAc,EAAE,KAAK,WAAW,EAC7C,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACzD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACrC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,8BAA8B,CAAC;gBACpC,OAAO;gBACP,mBAAmB;gBACnB,qBAAqB;aACtB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAC9B,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,SAAS;gBACT,mBAAmB;gBACnB,MAAM;aACP,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,YAAY,EACZ,MAAM,EACN,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  compareOrInsertTrustedUserIdentityPin,\n  loadTrustedUserIdentityPin,\n  loadTrustedUserIdForSigningKey,\n  TrustedUserIdentityPinCorruptError,\n  TrustedUserIdentityPinMismatchError,\n} from \"../persistence/trustedUserIdentityPinPersistence\";\nimport { TrustedUserIdentityPinContentionError } from \"../persistence/trustedUserIdentityPinTransaction\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { DatabaseUnavailableError } from \"../sync/databaseUnavailable\";\nimport {\n  assertIdentityLinkMatches,\n  createIdentityLink,\n  parseIdentityLink,\n} from \"./identityLink\";\nimport {\n  brandTrustedUserIdentity,\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n  type TrustedUserIdentity,\n  type TrustedUserIdentityService,\n  type TrustedUserIdentityServiceDependencies,\n  type ValidatedUserIdentityCandidate,\n} from \"./types\";\nimport {\n  assertTrustedUserIdentityUserId,\n  validateLocalUserIdentity,\n  validateRemoteUserIdentity,\n  validateUserIdentityKeys,\n} from \"./validation\";\n\nfunction requireTrustDomain(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): string {\n  // A missing trust domain is a static misconfiguration and must stay loud.\n  if (!dependencies.identityTrustDomain) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Trusted user identity resolution requires a stable API trust domain\",\n    );\n  }\n  return dependencies.identityTrustDomain;\n}\n\nfunction requireTrustStore(\n  dependencies: TrustedUserIdentityServiceDependencies,\n) {\n  const identityTrustDomain = requireTrustDomain(dependencies);\n  // An absent trust store is not: getExecSql() returns null exactly while the\n  // database is not ready, which happens routinely when the runtime is swapped\n  // under in-flight sync work. Callers that tolerate a vanishing database\n  // discriminate on the error type, so this must not share the code above.\n  const execSql = dependencies.getExecSql();\n  if (!execSql) {\n    throw new DatabaseUnavailableError(\n      \"Trusted user identity resolution requires a ready SQLite trust store\",\n    );\n  }\n  return { execSql, identityTrustDomain };\n}\n\nasync function compareWithDurablePin(input: {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly firstSeenAt: string;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<void> {\n  try {\n    await compareOrInsertTrustedUserIdentityPin({\n      execSql: input.execSql,\n      pin: {\n        encapsulationKeyFingerprint: input.identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(\n          input.identity.encapsulationPublicKey,\n        ),\n        encapsulationSuite: TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n        firstSeenAt: input.firstSeenAt,\n        formatVersion: TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n        identityTrustDomain: input.identity.identityTrustDomain,\n        signingKeyFingerprint: input.identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(input.identity.signingPublicKey),\n        signingSuite: TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n        userId: input.identity.userId,\n      },\n    });\n  } catch (error) {\n    if (error instanceof TrustedUserIdentityPinMismatchError) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        error.existing.userId !== error.candidate.userId\n          ? `Signing key for ${input.identity.userId} is already bound to ${error.existing.userId}`\n          : `Trusted user identity changed for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinCorruptError) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `Trusted user identity pin is corrupt for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinContentionError) {\n      // Lock contention says nothing about the identity; the caller retries\n      // once the trust store is free, so this must not be recordable evidence.\n      throw new DatabaseUnavailableError(\n        `Trusted user identity pin store is busy for ${input.identity.userId}`,\n      );\n    }\n    throw error;\n  }\n}\n\nasync function resolveCandidate(\n  dependencies: TrustedUserIdentityServiceDependencies,\n  userId: string,\n  identityTrustDomain: string,\n): Promise<ValidatedUserIdentityCandidate | null> {\n  const localUserId = dependencies.getLocalUserId();\n  if (userId === localUserId) {\n    const localIdentity = dependencies.getLocalIdentity(userId);\n    if (!localIdentity) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Authoritative local identity keys are unavailable\",\n      );\n    }\n    return validateLocalUserIdentity({\n      candidate: localIdentity,\n      identityTrustDomain,\n      userId,\n    });\n  }\n\n  const remoteIdentity = await dependencies.remoteSource.load(userId);\n  return remoteIdentity\n    ? validateRemoteUserIdentity({\n        candidate: remoteIdentity,\n        identityTrustDomain,\n        requestedUserId: userId,\n      })\n    : null;\n}\n\nasync function pinIdentity(input: {\n  readonly dependencies: TrustedUserIdentityServiceDependencies;\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<TrustedUserIdentity> {\n  await compareWithDurablePin({\n    execSql: input.execSql,\n    firstSeenAt: (input.dependencies.now?.() ?? new Date()).toISOString(),\n    identity: input.identity,\n  });\n  return brandTrustedUserIdentity(input.identity);\n}\n\n/**\n * Read-only: the identity this trust store already pins for `userId`, or null.\n * The stored keys must still match their stored fingerprints. Never inserts,\n * compares against or replaces a pin.\n */\nexport async function loadPinnedUserIdentity(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentity | null> {\n  assertTrustedUserIdentityUserId(input.userId);\n  const pin = await loadTrustedUserIdentityPin(input);\n  if (!pin) return null;\n  const keys = await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: base64ToBytes(pin.encapsulationPublicKey),\n      signingKeyFingerprint: pin.signingKeyFingerprint,\n      signingPublicKey: base64ToBytes(pin.signingPublicKey),\n    },\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n  });\n  return brandTrustedUserIdentity({\n    ...keys,\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  });\n}\n\nexport function createTrustedUserIdentityService(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): TrustedUserIdentityService {\n  return {\n    async resolvePinned(userId) {\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      return loadPinnedUserIdentity({ execSql, identityTrustDomain, userId });\n    },\n    async createLink(appUrl) {\n      const identityTrustDomain = requireTrustDomain(dependencies);\n      const userId = dependencies.getLocalUserId();\n      const candidate = userId ? dependencies.getLocalIdentity(userId) : null;\n      if (!userId || !candidate) {\n        throw new Error(\"Sign in before sharing your identity link.\");\n      }\n      const identity = await validateLocalUserIdentity({\n        candidate,\n        identityTrustDomain,\n        userId,\n      });\n      return createIdentityLink(identity, appUrl);\n    },\n    async verifyLink(link) {\n      const expectation = parseIdentityLink(link);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      if (expectation.identityTrustDomain !== identityTrustDomain) {\n        throw new Error(\n          \"This identity link belongs to a different Tearleads service.\",\n        );\n      }\n      const localUserId = dependencies.getLocalUserId();\n      try {\n        const identity = await resolveCandidate(\n          dependencies,\n          expectation.userId,\n          identityTrustDomain,\n        );\n        if (!identity)\n          throw new Error(\"The identity in this link is unavailable.\");\n        await assertIdentityLinkMatches(expectation, identity);\n        if (\n          dependencies.getExecSql() !== execSql ||\n          dependencies.getLocalUserId() !== localUserId\n        ) {\n          throw new DatabaseUnavailableError(\n            \"The active identity changed. Open the identity link again.\",\n          );\n        }\n        return await pinIdentity({ dependencies, execSql, identity });\n      } catch (error) {\n        dependencies.remoteSource.invalidate(expectation.userId);\n        throw error;\n      }\n    },\n    async boundUserId(signingKeyFingerprint) {\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      return loadTrustedUserIdForSigningKey({\n        execSql,\n        identityTrustDomain,\n        signingKeyFingerprint,\n      });\n    },\n    async pinLocal(userId, candidate) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      const identity = await validateLocalUserIdentity({\n        candidate,\n        identityTrustDomain,\n        userId,\n      });\n      return pinIdentity({ dependencies, execSql, identity });\n    },\n    async resolve(userId) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      try {\n        const identity = await resolveCandidate(\n          dependencies,\n          userId,\n          identityTrustDomain,\n        );\n        if (!identity) {\n          return null;\n        }\n        return await pinIdentity({ dependencies, execSql, identity });\n      } catch (error) {\n        dependencies.remoteSource.invalidate(userId);\n        throw error;\n      }\n    },\n  };\n}\n"]}

package/data/trustedUserIdentity/types.d.ts

@@ -50,6 +50,9 @@ export interface LocalUserIdentityCandidate {
     readonly signingPublicKey: Uint8Array;
 }
 export interface TrustedUserIdentityService {
+    createLink(appUrl: string): Promise<string>;
+    verifyLink(link: string): Promise<TrustedUserIdentity>;
+    resolvePinned(userId: string): Promise<TrustedUserIdentity | null>;
     /** The user this device's trust store already binds a signing key to. */
     boundUserId(signingKeyFingerprint: string): Promise<string | null>;
     pinLocal(userId: string, candidate: LocalUserIdentityCandidate): Promise<TrustedUserIdentity>;

package/data/trustedUserIdentity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAAC;AAC/D,MAAM,CAAC,MAAM,yCAAyC,GAAG,aAAa,CAAC;AAEvE,MAAM,wBAAwB,GAAkB,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC9E,MAAM,6BAA6B,GAAG,IAAI,CAAC;AA4E3C,MAAM,UAAU,wBAAwB,CACtC,KAAqC;IAErC,OAAO;QACL,GAAG,KAAK;QACR,CAAC,wBAAwB,CAAC,EAAE,6BAA6B;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC;YAC1C,6BAA6B,CAChC,CAAC;AACJ,CAAC","sourcesContent":["import type { ExecSql } from \"../sqlite/sqlSchema\";\n\nexport const TRUSTED_USER_IDENTITY_FORMAT_VERSION = 1;\nexport const TRUSTED_USER_IDENTITY_SIGNING_SUITE = \"ML-DSA-87\";\nexport const TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE = \"ML-KEM-1024\";\n\nconst trustedUserIdentityBrand: unique symbol = Symbol(\"trustedUserIdentity\");\nconst trustedUserIdentityBrandValue = true;\n\n/**\n * A complete user identity bundle that has passed strict key validation and\n * the durable trust-on-first-use comparison for its trust domain.\n *\n * The nominal brand keeps raw API and organization response objects from being\n * accepted at cryptographic boundaries by structural typing. Its private\n * symbol and constructor remain package-private to the SDK trust gateway.\n */\nexport interface TrustedUserIdentity {\n  readonly [trustedUserIdentityBrand]: true;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}\n\n/** Strictly decoded and self-consistent, but not yet accepted by durable TOFU. */\nexport interface ValidatedUserIdentityCandidate {\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}\n\nexport interface RemoteUserIdentityCandidate {\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly userId: string;\n}\n\nexport interface RemoteUserIdentitySource {\n  invalidate(userId: string): void;\n  /**\n   * `null` only when the server asserts the user does not exist. A transport\n   * or non-404 HTTP failure throws a retryable availability error instead.\n   */\n  load(userId: string): Promise<RemoteUserIdentityCandidate | null>;\n}\n\nexport interface LocalUserIdentityCandidate {\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly signingKeyFingerprint?: string | null | undefined;\n  readonly signingPublicKey: Uint8Array;\n}\n\nexport interface TrustedUserIdentityService {\n  /** The user this device's trust store already binds a signing key to. */\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocal(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<TrustedUserIdentity>;\n  resolve(userId: string): Promise<TrustedUserIdentity | null>;\n}\n\nexport type TrustedUserIdentityResolver = TrustedUserIdentityService[\"resolve\"];\n\nexport interface TrustedUserIdentityServiceDependencies {\n  readonly getExecSql: () => ExecSql | null;\n  readonly getLocalIdentity: (\n    userId: string,\n  ) => LocalUserIdentityCandidate | null;\n  readonly getLocalUserId: () => string | null;\n  readonly identityTrustDomain: string | null;\n  readonly now?: (() => Date) | undefined;\n  readonly remoteSource: RemoteUserIdentitySource;\n}\n\nexport function brandTrustedUserIdentity(\n  input: ValidatedUserIdentityCandidate,\n): TrustedUserIdentity {\n  return {\n    ...input,\n    [trustedUserIdentityBrand]: trustedUserIdentityBrandValue,\n  };\n}\n\nexport function isTrustedUserIdentity(\n  value: unknown,\n): value is TrustedUserIdentity {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    Reflect.get(value, trustedUserIdentityBrand) ===\n      trustedUserIdentityBrandValue\n  );\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAAC;AAC/D,MAAM,CAAC,MAAM,yCAAyC,GAAG,aAAa,CAAC;AAEvE,MAAM,wBAAwB,GAAkB,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC9E,MAAM,6BAA6B,GAAG,IAAI,CAAC;AA+E3C,MAAM,UAAU,wBAAwB,CACtC,KAAqC;IAErC,OAAO;QACL,GAAG,KAAK;QACR,CAAC,wBAAwB,CAAC,EAAE,6BAA6B;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC;YAC1C,6BAA6B,CAChC,CAAC;AACJ,CAAC","sourcesContent":["import type { ExecSql } from \"../sqlite/sqlSchema\";\n\nexport const TRUSTED_USER_IDENTITY_FORMAT_VERSION = 1;\nexport const TRUSTED_USER_IDENTITY_SIGNING_SUITE = \"ML-DSA-87\";\nexport const TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE = \"ML-KEM-1024\";\n\nconst trustedUserIdentityBrand: unique symbol = Symbol(\"trustedUserIdentity\");\nconst trustedUserIdentityBrandValue = true;\n\n/**\n * A complete user identity bundle that has passed strict key validation and\n * the durable trust-on-first-use comparison for its trust domain.\n *\n * The nominal brand keeps raw API and organization response objects from being\n * accepted at cryptographic boundaries by structural typing. Its private\n * symbol and constructor remain package-private to the SDK trust gateway.\n */\nexport interface TrustedUserIdentity {\n  readonly [trustedUserIdentityBrand]: true;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}\n\n/** Strictly decoded and self-consistent, but not yet accepted by durable TOFU. */\nexport interface ValidatedUserIdentityCandidate {\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}\n\nexport interface RemoteUserIdentityCandidate {\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly userId: string;\n}\n\nexport interface RemoteUserIdentitySource {\n  invalidate(userId: string): void;\n  /**\n   * `null` only when the server asserts the user does not exist. A transport\n   * or non-404 HTTP failure throws a retryable availability error instead.\n   */\n  load(userId: string): Promise<RemoteUserIdentityCandidate | null>;\n}\n\nexport interface LocalUserIdentityCandidate {\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly signingKeyFingerprint?: string | null | undefined;\n  readonly signingPublicKey: Uint8Array;\n}\n\nexport interface TrustedUserIdentityService {\n  createLink(appUrl: string): Promise<string>;\n  verifyLink(link: string): Promise<TrustedUserIdentity>;\n  resolvePinned(userId: string): Promise<TrustedUserIdentity | null>;\n  /** The user this device's trust store already binds a signing key to. */\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocal(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<TrustedUserIdentity>;\n  resolve(userId: string): Promise<TrustedUserIdentity | null>;\n}\n\nexport type TrustedUserIdentityResolver = TrustedUserIdentityService[\"resolve\"];\n\nexport interface TrustedUserIdentityServiceDependencies {\n  readonly getExecSql: () => ExecSql | null;\n  readonly getLocalIdentity: (\n    userId: string,\n  ) => LocalUserIdentityCandidate | null;\n  readonly getLocalUserId: () => string | null;\n  readonly identityTrustDomain: string | null;\n  readonly now?: (() => Date) | undefined;\n  readonly remoteSource: RemoteUserIdentitySource;\n}\n\nexport function brandTrustedUserIdentity(\n  input: ValidatedUserIdentityCandidate,\n): TrustedUserIdentity {\n  return {\n    ...input,\n    [trustedUserIdentityBrand]: trustedUserIdentityBrandValue,\n  };\n}\n\nexport function isTrustedUserIdentity(\n  value: unknown,\n): value is TrustedUserIdentity {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    Reflect.get(value, trustedUserIdentityBrand) ===\n      trustedUserIdentityBrandValue\n  );\n}\n"]}

package/index.js

@@ -1,4 +1,4 @@
-// Current SDK contract: unified device-first handles and atomic revision checks.
+// SDK: verified identity links, read-only pins and device-first handles.
 // Authority loaders take exact heads, including cached citations. Obsolete
 // adapters are excluded; authored policy journals survive restart. See workflows/README.md.
 export { ApiRequestMetrics, } from "./internal/api-client/index.js";

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAmK/B,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAmB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,uCAAuC,EACvC,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// Current SDK contract: unified device-first handles and atomic revision checks.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ClientDatabaseOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  type ClientOptions,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  Tearleads,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n  addDocumentAttachments,\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readBlobByteSource,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  GroupShareNameMismatchError,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AcknowledgedPrincipalPredecessor,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  captureAcknowledgedPrincipalPredecessor,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAmK/B,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAmB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,uCAAuC,EACvC,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ClientDatabaseOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  type ClientOptions,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  Tearleads,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n  addDocumentAttachments,\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readBlobByteSource,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  GroupShareNameMismatchError,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AcknowledgedPrincipalPredecessor,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  captureAcknowledgedPrincipalPredecessor,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -1816,7 +1816,6 @@ export declare class ApiClient {
         }[];
     } | null>;
     getOrganizationBillingManagementUrl(organizationId: string): Promise<{
-        canCancelDirectly: boolean;
         managementUrl: string | null;
     } | null>;
     getOrganizationNativePurchaseEligibility(organizationId: string, store: NativeSubscriptionStore): Promise<{

package/internal/validators/operation/organizationBilling.d.ts

@@ -497,16 +497,12 @@ export declare const getOrganizationBillingManagementUrlOperation: Omit<{
     readonly path: "/organizations/{organizationId}/billing/management-url";
     readonly responses: {
         readonly 200: z.ZodType<{
-            canCancelDirectly: boolean;
             managementUrl: string | null;
         }, {
-            canCancelDirectly: boolean;
             managementUrl: string | null;
         }, z.core.$ZodTypeInternals<{
-            canCancelDirectly: boolean;
             managementUrl: string | null;
         }, {
-            canCancelDirectly: boolean;
             managementUrl: string | null;
         }>>;
     };

package/internal/validators/response/organizationBillingManagementUrl.d.ts

@@ -12,16 +12,12 @@ import { z } from "zod";
  * this response.
  */
 export declare const OrganizationBillingManagementUrlResponseSchema: z.ZodType<{
-    canCancelDirectly: boolean;
     managementUrl: string | null;
 }, {
-    canCancelDirectly: boolean;
     managementUrl: string | null;
 }, z.core.$ZodTypeInternals<{
-    canCancelDirectly: boolean;
     managementUrl: string | null;
 }, {
-    canCancelDirectly: boolean;
     managementUrl: string | null;
 }>>;
 export type OrganizationBillingManagementUrlResponse = z.infer<typeof OrganizationBillingManagementUrlResponseSchema>;

package/internal/validators/response/organizationBillingManagementUrl.js

@@ -13,8 +13,6 @@ import { loosePlainObject } from "../schema.js";
  * this response.
  */
 export const OrganizationBillingManagementUrlResponseSchema = loosePlainObject({
-    /** Retained for installed clients; current clients read this from the snapshot. */
-    canCancelDirectly: z.boolean(),
     managementUrl: z.string().nullable(),
 });
 export function isOrganizationBillingManagementUrlResponse(value) {

package/internal/validators/response/organizationBillingManagementUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationBillingManagementUrl.js","sourceRoot":"","sources":["organizationBillingManagementUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,gBAAgB,CAAC;IAC7E,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAMH,MAAM,UAAU,0CAA0C,CACxD,KAAc;IAEd,OAAO,8CAA8C,CAAC,SAAS,CAAC,KAAK,CAAC;SACnE,OAAO,CAAC;AACb,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { loosePlainObject } from \"../schema\";\n\n/**\n * The subscription-management URL for an organization's paid subscription. The\n * server resolves it from the billing provider (RevenueCat) using the org's\n * stored customer id, so any org admin — not just the buyer whose device holds\n * the subscription — can reach the manage/cancel page. Native management\n * remains available for lapsed subscriptions so the buyer can repair a payment\n * issue. `managementUrl` is null when the organization has no native\n * provider-managed subscription, the provider exposes no management link, or\n * the lookup could not be completed. Which purchase system owns the\n * subscription is part of the billing snapshot (`subscriptionSource`), not of\n * this response.\n */\nexport const OrganizationBillingManagementUrlResponseSchema = loosePlainObject({\n  /** Retained for installed clients; current clients read this from the snapshot. */\n  canCancelDirectly: z.boolean(),\n  managementUrl: z.string().nullable(),\n});\n\nexport type OrganizationBillingManagementUrlResponse = z.infer<\n  typeof OrganizationBillingManagementUrlResponseSchema\n>;\n\nexport function isOrganizationBillingManagementUrlResponse(\n  value: unknown,\n): value is OrganizationBillingManagementUrlResponse {\n  return OrganizationBillingManagementUrlResponseSchema.safeParse(value)\n    .success;\n}\n"]}
+{"version":3,"file":"organizationBillingManagementUrl.js","sourceRoot":"","sources":["organizationBillingManagementUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,gBAAgB,CAAC;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAMH,MAAM,UAAU,0CAA0C,CACxD,KAAc;IAEd,OAAO,8CAA8C,CAAC,SAAS,CAAC,KAAK,CAAC;SACnE,OAAO,CAAC;AACb,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { loosePlainObject } from \"../schema\";\n\n/**\n * The subscription-management URL for an organization's paid subscription. The\n * server resolves it from the billing provider (RevenueCat) using the org's\n * stored customer id, so any org admin — not just the buyer whose device holds\n * the subscription — can reach the manage/cancel page. Native management\n * remains available for lapsed subscriptions so the buyer can repair a payment\n * issue. `managementUrl` is null when the organization has no native\n * provider-managed subscription, the provider exposes no management link, or\n * the lookup could not be completed. Which purchase system owns the\n * subscription is part of the billing snapshot (`subscriptionSource`), not of\n * this response.\n */\nexport const OrganizationBillingManagementUrlResponseSchema = loosePlainObject({\n  managementUrl: z.string().nullable(),\n});\n\nexport type OrganizationBillingManagementUrlResponse = z.infer<\n  typeof OrganizationBillingManagementUrlResponseSchema\n>;\n\nexport function isOrganizationBillingManagementUrlResponse(\n  value: unknown,\n): value is OrganizationBillingManagementUrlResponse {\n  return OrganizationBillingManagementUrlResponseSchema.safeParse(value)\n    .success;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/organizations/policyHistoryReadModel.js

@@ -75,21 +75,30 @@ function buildPrincipalPolicyHistoryEntries(bundle) {
     });
     return entries.reverse();
 }
+// Entries run newest first; the oldest one held is the cursor for older
+// entries unless it is genesis.
+function olderEntriesCursor(entries) {
+    const oldestVersion = entries.at(-1)?.version;
+    return oldestVersion !== undefined && oldestVersion > 1
+        ? oldestVersion
+        : null;
+}
 export function buildOrganizationGroupPolicyHistory(bundle, organizationId) {
+    const entries = buildPrincipalPolicyHistoryEntries(bundle);
     return {
-        entries: buildPrincipalPolicyHistoryEntries(bundle),
+        entries,
         groupId: bundle.currentState.principalId,
+        nextBeforeVersion: olderEntriesCursor(entries),
         organizationId,
         principalId: bundle.currentState.principalId,
         principalType: "group",
     };
 }
 export function buildOrganizationPolicyHistory(bundle) {
+    const entries = buildPrincipalPolicyHistoryEntries(bundle);
     return {
-        entries: buildPrincipalPolicyHistoryEntries(bundle).map((entry) => ({
-            ...entry,
-            groupChanges: null,
-        })),
+        entries: entries.map((entry) => ({ ...entry, groupChanges: null })),
+        nextBeforeVersion: olderEntriesCursor(entries),
         organizationId: bundle.currentState.principalId,
         principalId: bundle.currentState.principalId,
         principalType: "organization",

package/workflows/organizations/policyHistoryReadModel.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyHistoryReadModel.js","sourceRoot":"","sources":["policyHistoryReadModel.ts"],"names":[],"mappings":"AA8BA,SAAS,mBAAmB,CAC1B,MAAyD;IAEzD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,6BAA6B,CACpC,IAAuC,EACvC,KAAwC;IAExC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAwC,EAAE,CAAC;IAExD,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAC7C,mBAAmB,CAAC,aAAa,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,cAAc,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,YAAY,EAAE,cAAc,CAAC,IAAI;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,IAAI,mBAAmB,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,cAAc,CAAC,IAAI;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH;YACE,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,KAAK,EAAE,MAAM,CAAC,YAAY;SAC3B;KACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,kCAAkC,CACzC,MAAqC;IAErC,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QAE/D,OAAO;YACL,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EAAE,kBAAkB;aAC7B,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAqC,EACrC,cAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,MAAM,CAAC;QACnD,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QACxC,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAqC;IAErC,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClE,GAAG,KAAK;YACR,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC/C,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  PrincipalPolicyBundleResponse,\n  PrincipalProjectionMemberResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationPolicyHistory,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"./policyHistoryTypes\";\n\nexport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"./policyHistoryTypes\";\n\ninterface PrincipalPolicyHistoryState {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberResponse>;\n  readonly state: PrincipalStateResponse;\n}\n\nfunction projectionMemberKey(\n  member: Pick<PrincipalProjectionMemberResponse, \"userId\">,\n): string {\n  return member.userId;\n}\n\nfunction comparePrincipalMemberChanges(\n  left: OrganizationPrincipalMemberChange,\n  right: OrganizationPrincipalMemberChange,\n): number {\n  return (\n    left.userId.localeCompare(right.userId) ||\n    left.changeType.localeCompare(right.changeType)\n  );\n}\n\nexport function diffPrincipalProjectionMembers(input: {\n  readonly current: ReadonlyArray<PrincipalProjectionMemberResponse>;\n  readonly previous: ReadonlyArray<PrincipalProjectionMemberResponse>;\n}): OrganizationPrincipalMemberChange[] {\n  const previousMembersByKey = new Map(\n    input.previous.map((member) => [projectionMemberKey(member), member]),\n  );\n  const currentMembersByKey = new Map(\n    input.current.map((member) => [projectionMemberKey(member), member]),\n  );\n  const changes: OrganizationPrincipalMemberChange[] = [];\n\n  for (const currentMember of input.current) {\n    const previousMember = previousMembersByKey.get(\n      projectionMemberKey(currentMember),\n    );\n    if (!previousMember) {\n      changes.push({\n        changeType: \"added\",\n        userId: currentMember.userId,\n        nextRole: currentMember.role,\n        previousRole: null,\n      });\n      continue;\n    }\n\n    if (previousMember.role !== currentMember.role) {\n      changes.push({\n        changeType: \"role_changed\",\n        userId: currentMember.userId,\n        nextRole: currentMember.role,\n        previousRole: previousMember.role,\n      });\n    }\n  }\n\n  for (const previousMember of input.previous) {\n    if (currentMembersByKey.has(projectionMemberKey(previousMember))) {\n      continue;\n    }\n\n    changes.push({\n      changeType: \"removed\",\n      userId: previousMember.userId,\n      nextRole: null,\n      previousRole: previousMember.role,\n    });\n  }\n\n  return changes.sort(comparePrincipalMemberChanges);\n}\n\nfunction principalPolicyHistoryStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyHistoryState[] {\n  return [\n    ...bundle.previousStates.map((entry) => ({\n      projection: entry.projection,\n      state: entry.state,\n    })),\n    {\n      projection: bundle.currentProjection,\n      state: bundle.currentState,\n    },\n  ].sort((left, right) => left.state.version - right.state.version);\n}\n\nfunction buildPrincipalPolicyHistoryEntries(\n  bundle: PrincipalPolicyBundleResponse,\n): OrganizationPrincipalPolicyHistoryEntry[] {\n  const states = principalPolicyHistoryStates(bundle);\n  const entries = states.map((entry, index) => {\n    const previousProjection = states[index - 1]?.projection ?? [];\n\n    return {\n      changes: diffPrincipalProjectionMembers({\n        current: entry.projection,\n        previous: previousProjection,\n      }),\n      createdAt: entry.state.createdAt,\n      keyEpoch: entry.state.keyEpoch,\n      memberCount: entry.state.memberCount,\n      signedAt: entry.state.signedAt,\n      signerUserId: entry.state.signerUserId,\n      signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n      stateHash: entry.state.stateHash,\n      version: entry.state.version,\n    };\n  });\n\n  return entries.reverse();\n}\n\nexport function buildOrganizationGroupPolicyHistory(\n  bundle: PrincipalPolicyBundleResponse,\n  organizationId: string,\n): OrganizationGroupPolicyHistory {\n  return {\n    entries: buildPrincipalPolicyHistoryEntries(bundle),\n    groupId: bundle.currentState.principalId,\n    organizationId,\n    principalId: bundle.currentState.principalId,\n    principalType: \"group\",\n  };\n}\n\nexport function buildOrganizationPolicyHistory(\n  bundle: PrincipalPolicyBundleResponse,\n): OrganizationPolicyHistory {\n  return {\n    entries: buildPrincipalPolicyHistoryEntries(bundle).map((entry) => ({\n      ...entry,\n      groupChanges: null,\n    })),\n    organizationId: bundle.currentState.principalId,\n    principalId: bundle.currentState.principalId,\n    principalType: \"organization\",\n  };\n}\n"]}
+{"version":3,"file":"policyHistoryReadModel.js","sourceRoot":"","sources":["policyHistoryReadModel.ts"],"names":[],"mappings":"AA8BA,SAAS,mBAAmB,CAC1B,MAAyD;IAEzD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,6BAA6B,CACpC,IAAuC,EACvC,KAAwC;IAExC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAwC,EAAE,CAAC;IAExD,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAC7C,mBAAmB,CAAC,aAAa,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,cAAc,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,YAAY,EAAE,cAAc,CAAC,IAAI;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,IAAI,mBAAmB,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,cAAc,CAAC,IAAI;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH;YACE,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,KAAK,EAAE,MAAM,CAAC,YAAY;SAC3B;KACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,kCAAkC,CACzC,MAAqC;IAErC,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QAE/D,OAAO;YACL,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EAAE,kBAAkB;aAC7B,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,wEAAwE;AACxE,gCAAgC;AAChC,SAAS,kBAAkB,CACzB,OAA+D;IAE/D,MAAM,aAAa,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IAC9C,OAAO,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,CAAC;QACrD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAqC,EACrC,cAAsB;IAEtB,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QACxC,iBAAiB,EAAE,kBAAkB,CAAC,OAAO,CAAC;QAC9C,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAqC;IAErC,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,iBAAiB,EAAE,kBAAkB,CAAC,OAAO,CAAC;QAC9C,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC/C,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  PrincipalPolicyBundleResponse,\n  PrincipalProjectionMemberResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationPolicyHistory,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"./policyHistoryTypes\";\n\nexport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"./policyHistoryTypes\";\n\ninterface PrincipalPolicyHistoryState {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberResponse>;\n  readonly state: PrincipalStateResponse;\n}\n\nfunction projectionMemberKey(\n  member: Pick<PrincipalProjectionMemberResponse, \"userId\">,\n): string {\n  return member.userId;\n}\n\nfunction comparePrincipalMemberChanges(\n  left: OrganizationPrincipalMemberChange,\n  right: OrganizationPrincipalMemberChange,\n): number {\n  return (\n    left.userId.localeCompare(right.userId) ||\n    left.changeType.localeCompare(right.changeType)\n  );\n}\n\nexport function diffPrincipalProjectionMembers(input: {\n  readonly current: ReadonlyArray<PrincipalProjectionMemberResponse>;\n  readonly previous: ReadonlyArray<PrincipalProjectionMemberResponse>;\n}): OrganizationPrincipalMemberChange[] {\n  const previousMembersByKey = new Map(\n    input.previous.map((member) => [projectionMemberKey(member), member]),\n  );\n  const currentMembersByKey = new Map(\n    input.current.map((member) => [projectionMemberKey(member), member]),\n  );\n  const changes: OrganizationPrincipalMemberChange[] = [];\n\n  for (const currentMember of input.current) {\n    const previousMember = previousMembersByKey.get(\n      projectionMemberKey(currentMember),\n    );\n    if (!previousMember) {\n      changes.push({\n        changeType: \"added\",\n        userId: currentMember.userId,\n        nextRole: currentMember.role,\n        previousRole: null,\n      });\n      continue;\n    }\n\n    if (previousMember.role !== currentMember.role) {\n      changes.push({\n        changeType: \"role_changed\",\n        userId: currentMember.userId,\n        nextRole: currentMember.role,\n        previousRole: previousMember.role,\n      });\n    }\n  }\n\n  for (const previousMember of input.previous) {\n    if (currentMembersByKey.has(projectionMemberKey(previousMember))) {\n      continue;\n    }\n\n    changes.push({\n      changeType: \"removed\",\n      userId: previousMember.userId,\n      nextRole: null,\n      previousRole: previousMember.role,\n    });\n  }\n\n  return changes.sort(comparePrincipalMemberChanges);\n}\n\nfunction principalPolicyHistoryStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyHistoryState[] {\n  return [\n    ...bundle.previousStates.map((entry) => ({\n      projection: entry.projection,\n      state: entry.state,\n    })),\n    {\n      projection: bundle.currentProjection,\n      state: bundle.currentState,\n    },\n  ].sort((left, right) => left.state.version - right.state.version);\n}\n\nfunction buildPrincipalPolicyHistoryEntries(\n  bundle: PrincipalPolicyBundleResponse,\n): OrganizationPrincipalPolicyHistoryEntry[] {\n  const states = principalPolicyHistoryStates(bundle);\n  const entries = states.map((entry, index) => {\n    const previousProjection = states[index - 1]?.projection ?? [];\n\n    return {\n      changes: diffPrincipalProjectionMembers({\n        current: entry.projection,\n        previous: previousProjection,\n      }),\n      createdAt: entry.state.createdAt,\n      keyEpoch: entry.state.keyEpoch,\n      memberCount: entry.state.memberCount,\n      signedAt: entry.state.signedAt,\n      signerUserId: entry.state.signerUserId,\n      signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n      stateHash: entry.state.stateHash,\n      version: entry.state.version,\n    };\n  });\n\n  return entries.reverse();\n}\n\n// Entries run newest first; the oldest one held is the cursor for older\n// entries unless it is genesis.\nfunction olderEntriesCursor(\n  entries: ReadonlyArray<OrganizationPrincipalPolicyHistoryEntry>,\n): number | null {\n  const oldestVersion = entries.at(-1)?.version;\n  return oldestVersion !== undefined && oldestVersion > 1\n    ? oldestVersion\n    : null;\n}\n\nexport function buildOrganizationGroupPolicyHistory(\n  bundle: PrincipalPolicyBundleResponse,\n  organizationId: string,\n): OrganizationGroupPolicyHistory {\n  const entries = buildPrincipalPolicyHistoryEntries(bundle);\n  return {\n    entries,\n    groupId: bundle.currentState.principalId,\n    nextBeforeVersion: olderEntriesCursor(entries),\n    organizationId,\n    principalId: bundle.currentState.principalId,\n    principalType: \"group\",\n  };\n}\n\nexport function buildOrganizationPolicyHistory(\n  bundle: PrincipalPolicyBundleResponse,\n): OrganizationPolicyHistory {\n  const entries = buildPrincipalPolicyHistoryEntries(bundle);\n  return {\n    entries: entries.map((entry) => ({ ...entry, groupChanges: null })),\n    nextBeforeVersion: olderEntriesCursor(entries),\n    organizationId: bundle.currentState.principalId,\n    principalId: bundle.currentState.principalId,\n    principalType: \"organization\",\n  };\n}\n"]}

package/workflows/organizations/policyHistoryTypes.d.ts

@@ -24,14 +24,15 @@ export interface OrganizationPrincipalPolicyHistory {
     readonly principalType: PrincipalStateResponse["principalType"];
 }
 export interface OrganizationGroupPolicyHistory extends OrganizationPrincipalPolicyHistory {
-    /** Exclusive cursor for older entries; absent on a legacy complete history. */
-    readonly nextBeforeVersion?: number | null;
+    /** Exclusive cursor for older entries; null once the oldest is loaded. */
+    readonly nextBeforeVersion: number | null;
     readonly groupId: string;
     readonly organizationId: string;
     readonly principalType: "group";
 }
 export interface OrganizationPolicyHistory extends OrganizationPrincipalPolicyHistory {
-    readonly nextBeforeVersion?: number | null;
+    /** Exclusive cursor for older entries; null once the oldest is loaded. */
+    readonly nextBeforeVersion: number | null;
     readonly entries: OrganizationPolicyHistoryEntry[];
     readonly organizationId: string;
     readonly principalType: "organization";

package/workflows/organizations/policyHistoryTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyHistoryTypes.js","sourceRoot":"","sources":["policyHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  PrincipalContainerGrantResponse,\n  PrincipalProjectionMemberResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\n\nexport type OrganizationPrincipalMemberChangeType =\n  | \"added\"\n  | \"removed\"\n  | \"role_changed\";\nexport interface OrganizationPrincipalMemberChange {\n  readonly changeType: OrganizationPrincipalMemberChangeType;\n  readonly userId: string;\n  readonly nextRole: PrincipalProjectionMemberResponse[\"role\"] | null;\n  readonly previousRole: PrincipalProjectionMemberResponse[\"role\"] | null;\n}\nexport interface OrganizationPrincipalPolicyHistoryEntry {\n  readonly changes: OrganizationPrincipalMemberChange[];\n  readonly createdAt: string;\n  readonly keyEpoch: number;\n  readonly memberCount: number;\n  readonly signedAt: string;\n  readonly signerUserId: string;\n  readonly signerUserKeyFingerprint: string;\n  readonly stateHash: string;\n  readonly version: number;\n}\nexport type OrganizationGroupPolicyHistoryEntry =\n  OrganizationPrincipalPolicyHistoryEntry;\nexport interface OrganizationPrincipalPolicyHistory {\n  readonly entries: OrganizationPrincipalPolicyHistoryEntry[];\n  readonly principalId: string;\n  readonly principalType: PrincipalStateResponse[\"principalType\"];\n}\nexport interface OrganizationGroupPolicyHistory\n  extends OrganizationPrincipalPolicyHistory {\n  /** Exclusive cursor for older entries; absent on a legacy complete history. */\n  readonly nextBeforeVersion?: number | null;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly principalType: \"group\";\n}\nexport interface OrganizationPolicyHistory\n  extends OrganizationPrincipalPolicyHistory {\n  readonly nextBeforeVersion?: number | null;\n  readonly entries: OrganizationPolicyHistoryEntry[];\n  readonly organizationId: string;\n  readonly principalType: \"organization\";\n}\n\nexport interface OrganizationPolicyHistoryEntry\n  extends OrganizationPrincipalPolicyHistoryEntry {\n  /** Null when the additional signed evidence has not been loaded. */\n  readonly groupChanges: OrganizationPolicyGroupChange[] | null;\n}\n\nexport interface OrganizationPolicyGrantChange {\n  readonly containerId: string;\n  readonly previousAccess:\n    | PrincipalContainerGrantResponse[\"accessLevel\"]\n    | null;\n  readonly nextAccess: PrincipalContainerGrantResponse[\"accessLevel\"] | null;\n}\n\nexport interface OrganizationPolicyGroupChange {\n  readonly groupId: string;\n  readonly changeType: \"created\" | \"updated\" | \"deleted\";\n  readonly previousVersion: number | null;\n  readonly version: number;\n  readonly previousKeyEpoch: number | null;\n  readonly keyEpoch: number;\n  readonly changes: OrganizationPrincipalMemberChange[];\n  readonly grantChanges: OrganizationPolicyGrantChange[];\n}\n"]}
+{"version":3,"file":"policyHistoryTypes.js","sourceRoot":"","sources":["policyHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  PrincipalContainerGrantResponse,\n  PrincipalProjectionMemberResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\n\nexport type OrganizationPrincipalMemberChangeType =\n  | \"added\"\n  | \"removed\"\n  | \"role_changed\";\nexport interface OrganizationPrincipalMemberChange {\n  readonly changeType: OrganizationPrincipalMemberChangeType;\n  readonly userId: string;\n  readonly nextRole: PrincipalProjectionMemberResponse[\"role\"] | null;\n  readonly previousRole: PrincipalProjectionMemberResponse[\"role\"] | null;\n}\nexport interface OrganizationPrincipalPolicyHistoryEntry {\n  readonly changes: OrganizationPrincipalMemberChange[];\n  readonly createdAt: string;\n  readonly keyEpoch: number;\n  readonly memberCount: number;\n  readonly signedAt: string;\n  readonly signerUserId: string;\n  readonly signerUserKeyFingerprint: string;\n  readonly stateHash: string;\n  readonly version: number;\n}\nexport type OrganizationGroupPolicyHistoryEntry =\n  OrganizationPrincipalPolicyHistoryEntry;\nexport interface OrganizationPrincipalPolicyHistory {\n  readonly entries: OrganizationPrincipalPolicyHistoryEntry[];\n  readonly principalId: string;\n  readonly principalType: PrincipalStateResponse[\"principalType\"];\n}\nexport interface OrganizationGroupPolicyHistory\n  extends OrganizationPrincipalPolicyHistory {\n  /** Exclusive cursor for older entries; null once the oldest is loaded. */\n  readonly nextBeforeVersion: number | null;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly principalType: \"group\";\n}\nexport interface OrganizationPolicyHistory\n  extends OrganizationPrincipalPolicyHistory {\n  /** Exclusive cursor for older entries; null once the oldest is loaded. */\n  readonly nextBeforeVersion: number | null;\n  readonly entries: OrganizationPolicyHistoryEntry[];\n  readonly organizationId: string;\n  readonly principalType: \"organization\";\n}\n\nexport interface OrganizationPolicyHistoryEntry\n  extends OrganizationPrincipalPolicyHistoryEntry {\n  /** Null when the additional signed evidence has not been loaded. */\n  readonly groupChanges: OrganizationPolicyGroupChange[] | null;\n}\n\nexport interface OrganizationPolicyGrantChange {\n  readonly containerId: string;\n  readonly previousAccess:\n    | PrincipalContainerGrantResponse[\"accessLevel\"]\n    | null;\n  readonly nextAccess: PrincipalContainerGrantResponse[\"accessLevel\"] | null;\n}\n\nexport interface OrganizationPolicyGroupChange {\n  readonly groupId: string;\n  readonly changeType: \"created\" | \"updated\" | \"deleted\";\n  readonly previousVersion: number | null;\n  readonly version: number;\n  readonly previousKeyEpoch: number | null;\n  readonly keyEpoch: number;\n  readonly changes: OrganizationPrincipalMemberChange[];\n  readonly grantChanges: OrganizationPolicyGrantChange[];\n}\n"]}